684e35d0441a631aa0d63a6e134c00bc9fb4619ee5b1ca80c7c838ce4ac1b30d

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 21:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_efd1a70c7f70d9969bd689664fc6bf26_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 2.5MB
Sample260910-1qs1fahl2w
SHA256 684e35d0441a631aa0d63a6e134c00bc9fb4619ee5b1ca80c7c838ce4ac1b30d
MD5 efd1a70c7f70d9969bd689664fc6bf26
SHA1 6a25b400c1a3e2b06438d1f916660e8b93626368
SHA512 00dcabfa50877ac8ab0fdffbe05c2f5884d0b41b9886d21c7fd2ca09748624239c6a6e5f2132b4b6a3b3baa7b3b76dae822840ce58d004211c8ba865a0d69f70
SSDEEP 24576:yvId9BbVER68MYBjf5QN9Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT06:9C3QN9JkGYYpT0+TFiH7efP8Ol
TLSH
T10AC5BD01F3D695B6C4AF0538D47A925A6A70BC0403A6CBFB67C4B9762D337C08E357A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
9	244	dfsvc.exe
9	244	dfsvc.exe
9	244	dfsvc.exe
9	244	dfsvc.exe
9	244	dfsvc.exe
9	244	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
3316	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\O1169ZRP.7Y3\RO88XLEC.O5A\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_efd1a70c7f70d9969bd689664fc6bf26_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4\implication!scre..tion_27fa83f1ad328157_001a.0006_c5 = 68747470733a2f2f6b697262746563682e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\lock!0a000000a0e3590ef40000004c170000000000000000000 = 30303030303066342c30316464343136653937633238646139	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0006_none_7e70b65b6dae36bc\lock!02000000e8e4590ef40c00001c0d0000000000000000000 = 30303030306366342c30316464343136653965663637343331	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\lock!16000000e8e4590ef40c00001c0d0000000000000000000 = 30303030306366342c30316464343136653965663637343331	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0006_d8e2daa46d12c047	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0006_none_7e70b65b6dae36bc\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\DigestValue = 71481bc198a840642511a9ab6e686953c623ed25	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669\lock!0e000000a0e3590ef40000004c170000000000000000000 = 30303030303066342c30316464343136653937633238646139	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_27fa83f1ad328157_001a.0006_none_af5d3fd07299a935	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0006_c50e8ff25a21fbc4\scre...exe_27fa83f1ad328157_001a.0006_none_af5d3fd07 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669\DigestValue = b6750e1e287c36199294215d49e4613f43d8d271	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0006_d8e2daa46d12c047\scre..core_420d02d3849b7992_001a.0006_none_3770af6af	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_27fa83f1ad328157_001a.0006_none_af5d3fd07299a935\lock!06000000a0e3590ef40000004c170000000000000000000 = 30303030303066342c30316464343136653937633238646139	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4\lock!0e000000e8e4590ef40c00001c0d0000000000000000000 = 30303030306366342c30316464343136653965663637343331	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_27fa83f1ad328157_b8eec52c7628edb7	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad328 = 680074007400700073003a002f002f006b0069007200620074006500630068002e00730063007200650065006e0063006f006e006e006500630074002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006d0061006e00690066006500730074000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0006_d8e2daa46d12c047\appid = 68747470733a2f2f6b697262746563682e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0006_none_af5d3fd07299a935	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0006_d8e2daa46d12c047\scre..core_420d02d3849b7992_001a.0006_none_3770af6af = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\lock!0c000000a0e3590ef40000004c170000000000000000000 = 30303030303066342c30316464343136653937633238646139	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "TNHHPNL85GWQLLWWHBMYBQPZ"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0006_none_af5d3fd07299a935\Files\ScreenConnect.ClientService.exe_e781b1ee3 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669\implication!scre..tion_27fa83f1ad328157_001a.0006_c5 = 68747470733a2f2f6b697262746563682e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d\implication!scre..tion_27fa83f1ad328157_001a.0006_c5 = 68747470733a2f2f6b697262746563682e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0006_none_af5d3fd07299a935\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0006_none_af5d3fd07299a935\Files\ScreenConnect.WindowsFileManager.exe_0e21 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0006_none_af5d3fd07299a935\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0006_none_af5d3fd07299a935\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d\DigestValue = d8457f6d5f37198a1d3aaddf286cb1c5293c9e9c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669\Files\ScreenConnect.Core.dll_b96889d378047e27 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_27fa83f1ad328157_a9e506f09baf7137	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad328	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\Files\ScreenConnect.Windows.dll_fc0d83aff7df0b5 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_27fa83f1ad328157_001a.0006_d8e2daa46d12c047\identity = 68747470733a2f2f6b697262746563682e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0006_d8e2daa46d12c047\lock!1d000000f7e4590ef40c00001c0d000000000000000000001c8f = 30303030306366342c30316464343136653965663637343331	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_27fa83f1ad328157_001a.0006_d8e2daa46d12c047	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_47fb5f1b9f4d6efe	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0006_none_7e70b65b6dae36bc	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_27fa83f1ad328157_001a.0006_d8e2daa46d12c047\HasRunBefore = 01	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad328 = 32003000320036002f00300039002f00310030002000320031003a00350032003a00300035000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0006_d8e2daa46d12c047	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0006_none_7e70b65b6dae36bc\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0006_d8e2daa46d12c047\scre..ient_420d02d3849b7992_001a.0006_none_98b7888ed = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\lock!08000000e8e4590ef40c00001c0d0000000000000000000 = 30303030306366342c30316464343136653965663637343331	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0006_d8e2daa46d12c047\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d0 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Apps\2.0\TNHHPNL8.5GW\QLLWWHBM.YBQ\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\O1169ZRP.7Y3\RO88XLEC.O5A\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2632	2026-09-09_efd1a70c7f70d9969bd689664fc6bf26_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	244	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 244	2632	2026-09-09_efd1a70c7f70d9969bd689664fc6bf26_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	89
PID 244 wrote to memory of 3316	244	dfsvc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-09_efd1a70c7f70d9969bd689664fc6bf26_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_efd1a70c7f70d9969bd689664fc6bf26_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Users\Admin\AppData\Local\Apps\2.0\TNHHPNL8.5GW\QLLWWHBM.YBQ\scre..tion_27fa83f1ad328157_001a.0006_d8e2daa46d12c047\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\TNHHPNL8.5GW\QLLWWHBM.YBQ\scre..tion_27fa83f1ad328157_001a.0006_d8e2daa46d12c047\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:3316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_27fa83f1ad328157_001a.0006_none_af5d3fd07299a935.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\TNHHPNL8.5GW\QLLWWHBM.YBQ\manifests\scre...exe_27fa83f1ad328157_001a.0006_none_af5d3fd07299a935.cdf-ms
Size 32KB
SHA256 f14395967fd4f3babea9e1a36e8a68ee91cd1e7055f8ff563880c8c1e92d37c6
MD5 31d6389191bfac353e6ce8780a40b0e3
SHA1 8b60d9a3057c5bbddeda4bd5831ab38a28382b0c
SHA512 3cc30b1e345d237ee3a857c2a9548a28d2b8dfe6e7b5b5ff600b2673bfea93354adc98a54f0bf714d450716c42a889bafdd0e1771bb44c85fb73fc90ae08ed19
SSDEEP 768:LzOTaNQPL10mckfgP2am6Yc2bS4VR+ZdMQ+plpLLh:AiXGPLfvAbMQI7Lh
TLSH
T173E23AD2BA82E7B7D2626B32FCB6C7D471447DA50DE821BB7041372C4439D192F32AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\TNHHPNL8.5GW\QLLWWHBM.YBQ\manifests\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669.cdf-ms
Size 3KB
SHA256 0e3851ce45466bdba1c8ad03d2fa40dcfed9db9af564f6b09c47bb6fe0b7f3ac
MD5 2496d8011b6cf5ff4c98fa3c76fead58
SHA1 1e985794e9ae765a03be7f1daa65eae2af93526e
SHA512 7260cc6159fc3316aa1161688188d0570846418cc5b918192b41600f8e35809e85a9a0d291383b16a7e8305d10ef7eeca41c316e74f25193df5b10a2c82d73e8
TLSH
T10C61CB017285DE17D9690233ACE1D3EE27357E83DE42830B75C0BF2FBA721E55622295
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\TNHHPNL8.5GW\QLLWWHBM.YBQ\manifests\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999.cdf-ms
Size 5KB
SHA256 f0fd42cc93a1da2133b053fe274213c5538c71c49865d9f2b2146646b2c9caa4
MD5 d89ee041cb25be202a41863994c423fc
SHA1 a4057768758fdc96b880736dac06f40815844d08
SHA512 00300fafcdba6701114c812efb0e1f32d288bfb089326e19f1866f91fd2216add9b23b81261494846352847b208959ae10b561599cfba1f5b30987d13a7e9331
SSDEEP 96:JBW+RzgtheV+Ww7OLFIUE0fhtKdUzX8Hwnr+C:hRzgkJfaUxhKUrzl
TLSH
T183B11D11B244EA17D5780333ACAAD3EC6B707D92DF83061B70C4BB6FBA723E65211285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\TNHHPNL8.5GW\QLLWWHBM.YBQ\manifests\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976.cdf-ms
Size 7KB
SHA256 8cef529388eaaa27816b0c93b27641f77a3bfa02dcb8a6cb89fa2e23eda13e5b
MD5 7781d43f4416d1f48a87470a67ae6892
SHA1 e2f07e7b5581226200f7a29542d253031b2f6a4a
SHA512 614d9b6f963572f830558655dbafabf7a206a24d62852b2a7b02770fb2c4cd1a7337be8bc6d48a64f7a51f4574af84e9b6e15851ef848ebcd1571b8de1a29c12
SSDEEP 96:1OON9gnxfi4qheV+WwwOL586lecwO5VfmeqKowgJs132oK4bpks6Tb+y:MHnJbquJ4lleFO5Vfmuo69BST
TLSH
T185F19912B351DE26D5A90A33AC97C3ED27683E97DE42430B71C4BF2F7A725A61222095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\TNHHPNL8.5GW\QLLWWHBM.YBQ\manifests\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d.cdf-ms
Size 2KB
SHA256 f0c42aacb44a1a88c085035cd177798d3c92343b90204f51c95f26036bd0db6b
MD5 f7fb77c24142c9e94b9626c0ae2062c5
SHA1 b088e804e241f8836fbb01b61a7ffa393978e76f
SHA512 1a1bb6a4bc8c371e5d279db6cb5466e865ae1957481e5c97cb61fce1878c04a7fa5f2399a95d35ca5c4739ba054806b92c417d30153a7567064dc84a1be91ba8
TLSH
T1195179057784EA67E97A0233EC92D2D932357E82EF07031BB180BB7F3A716C65612092
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_27fa83f1ad328157_001a.0006_none_7e70b65b6dae36bc.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\TNHHPNL8.5GW\QLLWWHBM.YBQ\manifests\scre..tion_27fa83f1ad328157_001a.0006_none_7e70b65b6dae36bc.cdf-ms
Size 22KB
SHA256 e32b188501f0e9eb9e1f421ad001219b58995aa47cc7e78099d9b89ac525b980
MD5 e583cb0eb156f543bc67ed6c7185d80d
SHA1 6535a0043950561ea64a2b608888e9079716b20b
SHA512 f0c430e321799765792536b948ea754efd67cf3e396723cf15af174a11c2f6ef5bfec319113441806dbed9aa6cebd8ea0881eb7913fbe0cf77bd66c9d682b648
SSDEEP 384:/f9OyapDiYEezKdLEeznljP2psgM7Y6fi17P2aa16YcnVC1bS4VkTkM5jd9mvRdq:tJaNM7PL106fgP2am6Yc2bS4VRrw/
TLSH
T17DA26C853B81EE53C2225632DCD3C7E97238BDD34EC2835B78453B1F6934F592A22985
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\TNHHPNL8.5GW\QLLWWHBM.YBQ\manifests\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4.cdf-ms
Size 4KB
SHA256 a793ffff1a2b07e58f0df71b3959daadb8e5557a4fce99df30448470821e29c3
MD5 63c21b1a618d88b695fcb9679c588164
SHA1 b20719b2f841cbff8c63b9b9d9a27d515d1d9e32
SHA512 560b16d5f8df0666479a0e6a842c2343a75456a08bc6a64f57510ed66f689ebcb13b2a97525302c80b65276c5d7eaaf1db0ac61bf3c4725648aba89f87cc10f4
SSDEEP 96:n5QItJ0heV+Ww8OL54wBTjxsnVr/QvNFkyn+6i:nrRJoDBn6Vr6sZ
TLSH
T163A1BF117340EE67E9654273EC9AD2ED2A787D82EE02420B71C0BF2F76725EA4325195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2o252k5x.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\TNHHPNL8.5GW\QLLWWHBM.YBQ\scre..tion_27fa83f1ad328157_001a.0006_d8e2daa46d12c047\2o252k5x.newcfg
Size 683B
SHA256 213663cf978f79c51485a5a3c6b5ff7b21ea4dc370f0ca270d0acd99df94413a
MD5 ce9dc396e72bcf73aa92a5a843977a02
SHA1 cf9827232d99a471b6bd7bb67271c2194999d96a
SHA512 4ef3608ed06d0d8ff44882de3d1bda7b60445529d588101b6240cb7659fd0ad4251ffcaf561fcc4d2c5b053ebea58a7bf8067cdd222915572de5fac164bd8413
TLSH
T19A0128A571C4AE9B03B76E33D5218345FE7116AB02A560D874AE213B9F315DB03E32DE
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\TNHHPNL8.5GW\QLLWWHBM.YBQ\scre..tion_27fa83f1ad328157_001a.0006_d8e2daa46d12c047\app.config
Size 1KB
SHA256 3accda7d40c67a680130c973143aba77685af19a77757165dd8532491ce98810
MD5 50ecf5304124de5b2ccbc12547198ef3
SHA1 0c569c03bb3839056f6f68c4e4da96add67e8265
SHA512 bfadefed25bb2c42bc8134e7bab52de7d42bffb072243216a424e57716ca96fbee25f9c94a21ef38c74863aa1339ce86ce939e2a6977b1c4bcfe543d8a1db748
TLSH
T1B621650D70C1AFA912776732EA315281FD70862315A6B0E474EE21375F70BDA1AF36E6
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\TNHHPNL8.5GW\QLLWWHBM.YBQ\scre..tion_27fa83f1ad328157_001a.0006_d8e2daa46d12c047\user.config
Size 520B
SHA256 b321b10c3f4d295bea15b1f3192636f838522e5341d99094bd8abb82138c5e8e
MD5 5602b0d7f081b53b42b4c0b8c55399e8
SHA1 0a9294493ce2b6a073a04379840b41a535234cc2
SHA512 edbd990bd0986ee4c139646565068f47cca9c28d881fba04ce4ebdc9d620916d04aae5ba3e694d9462f3de5ddb0256c7703a3c27f9849039c9011beedc88471a
TLSH
T1B0F0E9A131846E5B03636E23C5118741EE72569B0561249874AF613A5F315CF03A31CE
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O1169ZRP.7Y3\RO88XLEC.O5A\ScreenConnect.Client.dll
Size 412KB
SHA256 27e873d0fceefdd1a12ca77e3bbecec2ece7acdba433b47dca102c35e1c5896c
MD5 495ae918d089b4846bd4a50bdc06b0b7
SHA1 d8457f6d5f37198a1d3aaddf286cb1c5293c9e9c
SHA512 8c4de18ae53c4858826e1dc17fc95293ab03dd30a12db29aaa4638c8e840ae5717c24b44d5d2f59ae99e4d8935fc260b336d084dcbc450b36593084256e0ba67
SSDEEP 6144:eS59LDc+cf1vp82Y5sD8ETEavHy+vd7JPYIYyqQni65/PTtR:lpcw2xDHTEavSW7OQniOb
TLSH
T13194CF8163E85D6EE9AF1F73F0A1A1344E76BC056182F2EA0D0475F41A7B7828B547E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O1169ZRP.7Y3\RO88XLEC.O5A\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 8929cfa8bbea4aa718881c3a63e629417df02a709acc8528bf7b8ba18c3ca06c
MD5 019356a9dbbfd64a3b4053b525c82b1b
SHA1 94c617d66698691ac8c48b91b16edf6c4f2a2500
SHA512 4bca960c60f45896defda926e0de61a7c944a0271f5d7587ed26be93f4ba0cbac970aeaf6e8102ba2cdff5a12c20445221de03a4d307f28d963a5c2ef51cde65
TLSH
T16B117B0191C8FA361F3341D1BEE7E420676D5B33058E194BB06A689F8B29AD743470B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O1169ZRP.7Y3\RO88XLEC.O5A\ScreenConnect.ClientService.dll
Size 92KB
SHA256 78fa9cf69577f6990275c7c472f7114f9d0c85e660f3b9c81b085fc3cfbc8673
MD5 20b930dc08fde485186d7687a48779ab
SHA1 0142109ebe6b95d9704f0954c232fc8ad2f25630
SHA512 a5f612f7aa678cf37d7b2f7bd6c490d192397ea62f6dfe3ec798acef610fb6b252ca073bbda14d2f88c771a0a34260308132ba26de9cdf180a574c0310a83b87
SSDEEP 1536:Vzu1ewsuwDP/2ovANyI9xhpxZUuQOV+eGI0ZUazxvmVRo9dE7h:Vzc2j/BAkI9JXQOVAIAUazxvmVRoTE1
TLSH
T1F6935C4293ECA92BC9DF0E38B461F26106B1B913D9E6E7D46D8860DA2F527C11F1439F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O1169ZRP.7Y3\RO88XLEC.O5A\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 4e9b73cfb5991714c61d57d55506aad9faf503c518191b8100174b8b67775402
MD5 c4b733c5d3bc8c38e940aada18e5f56c
SHA1 0583bd5cf81d7ef44a2bf8b2c7608ae204857c39
SHA512 ec2b052467a881026a314ebcd07dedeaa6912be2eeaab5ab412e209333607f930f95a51ab8d2c23c1e39890657c44d71bf3ff85658692e314b1b8cfbd319ebf1
TLSH
T14831261591C8FA350F7302D1BDE7E0305B9D5B32158E194BB05AA99FCF29A97434B073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O1169ZRP.7Y3\RO88XLEC.O5A\ScreenConnect.ClientService.exe
Size 93KB
SHA256 5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3
MD5 1973034f7b83f666cbd3264bade6e6e5
SHA1 51340eee61b2b3df88bc48060104a32c0f101b4b
SHA512 8a28d7a5e347fe7d7d9977b74eaaaa6ac03ac615ed236235a28d2edb5d2f123945c98b8ea5b7713d3e4d034db580fd530b82c40c98162a7bcb259c2c8b384243
SSDEEP 1536:Lg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoU0HMB7R:EhbNDxZGXfdHrX7rAc6myJkgoU0Hk1
TLSH
T12B935B13B5C28872D473193158E0DAB09A3FF9615E21DEAB3788022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O1169ZRP.7Y3\RO88XLEC.O5A\ScreenConnect.Core.dll
Size 582KB
SHA256 4eab8752d05cd31bafd07edde7d18061cb63eea99af3132460e6dc08bb5f9e73
MD5 fb7b3b452a84b3c591abd35f1cf68eac
SHA1 b6750e1e287c36199294215d49e4613f43d8d271
SHA512 a20afb8d8cf1926d7bf9a05b71edf544f85bdeadb2b8733446b39d9f893bdad2659d023544e50f8bcd4fc8af4588aa8e0e60414ecfb7931e96895d8fac65da44
SSDEEP 6144:GobZO37pir0uomvrTk8AG2sTwR87HNSxyoiuHiWm9kzKY7vhNS/chwDTax4kzm7x:fZnAuhy7CsJlHiWKPYbhN4Ao
TLSH
T1DCC48D3073A4A776C5AE1B7AE072619503B0F413659AF34B7B85E5F92DC23C88F107A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O1169ZRP.7Y3\RO88XLEC.O5A\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 5bef6c316992b20a446529d90cf9eacd76882ae8c8ccbb5a48e082255a714589
MD5 f0d61fa6e938195134f7a6b8bcde1d0b
SHA1 9e9385362ebc6e63990b8b09742b12de51364550
SHA512 7d73511dc473509a01e816530d13425b2beb0e5f02caaa7310e8293fda5f7f88b4b76393d2251e10245e1a61bc4dd7ccc592835c905ef95b89e2055e18cd8eb6
TLSH
T189216A0181C8FA261F3302D2BDE7E42197AE5B33148D194B7069689FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O1169ZRP.7Y3\RO88XLEC.O5A\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 ec4de5e6e9c079a30a5780d79ee662e0a4c6d009f0e3f911edc560973fb17d1e
MD5 d55cdc5fcefe87de68c201bdc08967b1
SHA1 be13fc7f876f28eb388e8a446d369a963516e30c
SHA512 9df975e885af260ec2d14484852260be64b07e576fc5808181ac7638bf69a6fd7006f53aefeb9116da8d3604c27ccef99356fddc063120819255184ac11bd7bc
SSDEEP 24576:kkFuqFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUJ:xFuqJkGYYpT0+TFiH7efPU
TLSH
T14B85BE41E2C364F5D46B047888BF572ABA743C080365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O1169ZRP.7Y3\RO88XLEC.O5A\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 032ce68230b8fcbf3ec246463076d43eb9bf2f53585c8e39d375921a8f9725e7
MD5 bd986fee8ac6b35971159f45798b07d0
SHA1 3e521bf243ea40c9ae670b616c9a4f6ffd7f36f4
SHA512 1698351e25c078b146771bc643d7ae9a02c2e5cfb150c9609e4da67451379c31f809acccd38ae7a355e39b6717b9c4c6530399e6782df4053f75a45a05bff961
TLSH
T14341F11181C8FA250F3302D2BEEBE431979E5733158E194B7099AD8BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O1169ZRP.7Y3\RO88XLEC.O5A\ScreenConnect.WindowsBackstageShell.exe
Size 71KB
SHA256 d8a6ef30d0aec9060032fd528777cf396a5ae7d41481f13f3b19797c1bf1d1c2
MD5 1d6f75631d8c27ab8fbf54917d523681
SHA1 a1ffea609d20ee57d58cef8c45991a390d74d874
SHA512 e1f9a4560fd7a701f367268f81301eacd5c03fabc3220d6c78e24a7e0c9e563f372d2608dbc24ff46dcdf03896c346870191becbc035cbddd686f380bb03f261
SSDEEP 1536:oRYKtd739PDNdvmDqfQX5E+TC7vuUn7no:o/td7NPxtfQOvHnro
TLSH
T106637D5023DCD525E9FF2E34B0E1F6600AB3BA638CE1D7D52DA821DA2E127D14F64396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O1169ZRP.7Y3\RO88XLEC.O5A\ScreenConnect.WindowsClient.exe
Size 685KB
SHA256 2763b953657e3c4d6b2f952218a1e1963bcd6971f0b1102d99bb7efea04ceb29
MD5 ac23969c4bb28b9faa93f4e794f02cb4
SHA1 71481bc198a840642511a9ab6e686953c623ed25
SHA512 d4d50cda9d78623bda48f838ca97ad6357091efd1578e8b7e5d2b29033c2e72f8738504f80be5bb9090264e5e4edfea6e4d0245a091575e2fc0b3226037463f4
SSDEEP 6144:+5kZnhlsW7J1IaIE2N7HbpORQ9JuQbFU3I/3ITEELXsLnnP2iODgck22/E4IUeh+:uk2W7J1IDEknpNFf/bqXWnBOphRAD
TLSH
T192E47E2537BCDBBBC7AF0F39A02219145FF0F8856696D79ED540A4E70D923808E463A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O1169ZRP.7Y3\RO88XLEC.O5A\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O1169ZRP.7Y3\RO88XLEC.O5A\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 94b84edf9ee81b2a064f37a0480c2bdc4850a6fc2be4a74f19faa03a14da7481
MD5 eb80d31f75f888b3d201f5569bedc783
SHA1 894e37e99c11dbb145a6f32c5203f1473fce7dbf
SHA512 cfeb43bc7a1a4d975611bba1c72ee772db7252ae6ba8f8d7cf55751de450a6448e202a804da548ebe415728c567364640466c5696e2b2192da7d0aeadbfa3eeb
TLSH
T11851071551C4FA310F7302D1BDEBE070979E4B32158E194B7099998FCF2DA97478B027
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O1169ZRP.7Y3\RO88XLEC.O5A\ScreenConnect.WindowsClient.exe.manifest
Size 25KB
SHA256 2a017b208fe1dc4d279417857361cfe586e2e97399f2de33a213e55804f0d19c
MD5 8a922e9c2c5a034fa464499e4c0f848e
SHA1 cee9b458470992f70c85404b679bcbcc5dbefb95
SHA512 03845072fca38c2c864f41cfe63c4f47577d907c34c82fa1490e854f1cb0cd57acce6f53a0081b042b728639a0a39d0086d663683b9480a1cbb7dc831545cf97
SSDEEP 384:veboquMk0L7a6ffaLvEezWEezuEeznljP2psHM7YlZckfi17P2aa16YcnVC1bS44:vc1aLdPLs0/ckfgP2am6Yc2bS4VR+Z
TLSH
T1AEC24B9A8CC13C21033390A4FEE38914ED087F7345F9119A7D4E15AF9F65A1A67A32E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O1169ZRP.7Y3\RO88XLEC.O5A\ScreenConnect.WindowsFileManager.exe
Size 91KB
SHA256 2ae8aa570f062c78de8df5ab7a2b4610d3a6767c956a07c27924a20424f5daec
MD5 879bd9493293d0b91179075e687fcf9d
SHA1 604f8743ea16ce28d70299b46957e5a21fcea5bb
SHA512 6fda7dac46ce3a1d1b33d49db0498c11949e1c6a2ffe1831d7d47ec8dfd744cd8ab89c890a57146cb83c8e57b26ca0edb51b6c08d3c7ab29b05ca9c0bcbf788d
SSDEEP 1536:dUMOIrlP4myXI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVdiEV785:eIJKukLCPVm
TLSH
T12D93E652352A6235DEC5C037A492E9B198377F6207FDC5BD28A1BE3639E03903E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5G2COGNA.ZKP.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZGEDAED6.OL9\5G2COGNA.ZKP.application
Size 117KB
SHA256 a17e80976a0f532cc2a90f953bd82073e78cc3ca0c3e889daa0a930f659b771e
MD5 908687c11ed9bed01d2e59ffb04e43cd
SHA1 1eef738f91e0251d054f1335b86371cb065b94a8
SHA512 75e339370ee82d0fc7a783c968aa43936477418748c4ba9bcfa85a204364ada904c5fdce8e4d311b9052b7e60b0a33423f97aa05a25f79a59b837243391d58b0
SSDEEP 1536:hlvxPLfvt/y6K+zuLD4UABnjRnfduUW5Ab4KpSE5GP/uLTvooycuaKQ/IuKE:zJPLfvt/tuuBn1nfdvg2XOcuaX1
TLSH
T1ABC3B63ACE30F4C0477DB021D1A52D673D811B93DBB31BACD90A186B0E69796EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-15-0x0000027F05AA0000-0x0000027F05AA8000-memory.dmp

Download

memory/244-16-0x0000027F200B0000-0x0000027F20238000-memory.dmp

Download

memory/244-30-0x0000027F24780000-0x0000027F247D0000-memory.dmp

Download

memory/244-61-0x0000027F24DD0000-0x0000027F24E80000-memory.dmp

Download

memory/244-27-0x00007FFFCFE60000-0x00007FFFD0804000-memory.dmp

Download

memory/244-67-0x0000027F24CE0000-0x0000027F24D4C000-memory.dmp

Download

memory/244-25-0x00007FFFCFE60000-0x00007FFFD0804000-memory.dmp

Download

memory/244-24-0x00007FFFCFE60000-0x00007FFFD0804000-memory.dmp

Download

memory/244-73-0x0000027F24FD0000-0x0000027F25180000-memory.dmp

Download

memory/244-26-0x00007FFFCFE60000-0x00007FFFD0804000-memory.dmp

Download

memory/244-79-0x0000027F245D0000-0x0000027F245EA000-memory.dmp

Download

memory/244-85-0x0000027F24D10000-0x0000027F24DA6000-memory.dmp

Download

memory/244-23-0x00007FFFCFE60000-0x00007FFFD0804000-memory.dmp

Download

memory/244-21-0x00007FFFCFE60000-0x00007FFFD0804000-memory.dmp

Download

memory/244-20-0x00007FFFCFE60000-0x00007FFFD0804000-memory.dmp

Download

memory/244-19-0x00007FFFCFE60000-0x00007FFFD0804000-memory.dmp

Download

memory/244-339-0x00007FFFCFE60000-0x00007FFFD0804000-memory.dmp

Download

memory/244-18-0x00007FFFCFFEF000-0x00007FFFCFFF0000-memory.dmp

Download

memory/2632-22-0x0000000074A60000-0x000000007521C000-memory.dmp

Download

memory/2632-8-0x0000000005E20000-0x00000000063DA000-memory.dmp

Download

memory/2632-14-0x0000000074A60000-0x000000007521C000-memory.dmp

Download

memory/2632-13-0x0000000074A60000-0x000000007521C000-memory.dmp

Download

memory/2632-12-0x0000000074A60000-0x000000007521C000-memory.dmp

Download

memory/2632-11-0x0000000074A72000-0x0000000074A73000-memory.dmp

Download

memory/2632-10-0x0000000009140000-0x00000000092F0000-memory.dmp

Download

memory/2632-9-0x0000000005960000-0x00000000059F2000-memory.dmp

Download

memory/2632-7-0x0000000074A60000-0x000000007521C000-memory.dmp

Download

memory/2632-0-0x0000000074A72000-0x0000000074A73000-memory.dmp

Download

memory/2632-6-0x0000000074A60000-0x000000007521C000-memory.dmp

Download

memory/2632-5-0x0000000005830000-0x0000000005858000-memory.dmp

Download

memory/2632-4-0x0000000005780000-0x0000000005814000-memory.dmp

Download

memory/2632-17-0x0000000074A60000-0x000000007521C000-memory.dmp

Download

memory/2632-3-0x0000000074A60000-0x000000007521C000-memory.dmp

Download

memory/2632-2-0x0000000005710000-0x000000000571C000-memory.dmp

Download

memory/2632-1-0x00000000056F0000-0x00000000056F8000-memory.dmp

Download

memory/3316-309-0x0000000000DD0000-0x0000000000E80000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads