024416d6d5e1cbda9c48bf90f1b2d1ccdebec832b900c7d340b9a105d773b524

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 18:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_88915e90b632b3aadffff3e71c7814fe_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 3.7MB
Sample260930-xhvbrazdmh
SHA256 024416d6d5e1cbda9c48bf90f1b2d1ccdebec832b900c7d340b9a105d773b524
MD5 88915e90b632b3aadffff3e71c7814fe
SHA1 18f03219b97ea58868bb2feb779deb237767616a
SHA512 31954e036348cb807cf91172d12ad68579abe049901f1bc0a17dbb123d4c57366349c747c322bd0525fe4cfcb046e50b897d25299f7a840fbb2616c71275e3a8
SSDEEP 49152:uAUrgszC/lMKByJ/Q0yHlJkGYYZTk+T1iH7efPcMwMLEeC6B:52C/l6JieM6efPcMLo4
TLSH
T1F706C04AFBC6A677C53F063584B57314A7B0B8454762C7AB6AD0BB3E1C323D06E25389
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
25	2064	dfsvc.exe
25	2064	dfsvc.exe
25	2064	dfsvc.exe
25	2064	dfsvc.exe
25	2064	dfsvc.exe
25	2064	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
392	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\C89KK6Z8.RKD\G6965088.ODR\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_88915e90b632b3aadffff3e71c7814fe_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_88915e90b632b3aadffff3e71c7814fe_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_88915e90b632b3aadffff3e71c7814fe_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\OnlineAppQuotaUsageEstimate = "6361029"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_8a43ecd02823c469	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 680074007400700073003a002f002f00670065007400680065006c0070002e00690074002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e003f0065003d0053007500700070006f0072007400260079003d0047007500650073007400260068003d00670065007400680065006c0070002e0069007400260070003d003800300034003100260073003d00380031003600330036003800610064002d0034006500310064002d0034006200630031002d0061003300360063002d0030003000620066006600300031003100640065006400320026006b003d0042006700490041004100410043006b004100410042005300550030004500780041004100670041004100410045004100410051004400350066002500320066004400770052006100480064006400720035007300720037006c003900580072006d006300710050005200540052006a0057004200420062006e00370051005200360056005a004600250032006600640077004e0071006d00250032006600420059003900590054005200630034006b007500440039003200650079002500320066003600630025003200660075006a005400490076004700780025003200660051007a00410055007700530045004e006b0044006d007a004b0071007400490079006f003200320030003700710032005a0051006d005a0042007a005100250032006600300054006f0063004300780043006500570061006600520073003500380073007700510050003700300068004c00730059004e005000670058006e006700360076004c006600590041004e00250032006200580035007900730046007200660035005100660030006e007200520042006d00370071004a00430030004d004700660058004600720065005800450031004200580051006b0046007000350078006e004d0063006d002500320062004b003400690057005a005a00710046003300360032004a00560035006d00250032006200530045004b004a004f006c0031007200770050004e007700540025003200620057004e007100330079006c00500066005a0057004500510044004d006d004d005a005200370045007a00310039006b00460054006800440053005600470048005600340075006d0053006a00500054006c0041005900450037005300330076006400720039004300720056004c003100390043007000630076004700250032006600690054005500520073005500490035005200770037004b003800550068003300420039007a00430075005a004a00320050004f00460053005800760054006f00630035004c0061004c007800360072007300790055004d00310070006f0049004a006e004e007000250032006600350047006e0052007a0058006d00260072003d00260069003d004b00610075007400680065006e002500320030004c006500670061006c000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_6e19d454ea2041ee\appid = 68747470733a2f2f67657468656c702e69742f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_8cee6e97f62f7d68\scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18ac85d96\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18ac85d96\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_8cee6e97f62f7d68\scre...exe_0000000000000000_001a.0006_none_5cdffdcdb	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_none_0a65abd5bb43263d	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0006_none_374ca698f508fa2b\lock!1c00000004d4580e88010000bc0b0000000000000000000 = 30303030303138382c30316464353130636366376334353034	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_none_0a65abd5bb43263d\lock!1000000004d4580e88010000bc0b0000000000000000000 = 30303030303138382c30316464353130636366376334353034	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0458502f\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_8cee6e97f62f7d68\appid = 68747470733a2f2f67657468656c702e69742f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_98937fbcddecdd38\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_6e19d454ea2041ee	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5cdffdcdbb880340\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5cdffdcdbb880340\Files\ScreenConnect.WindowsClient.exe.config_f7 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0458502f\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0458502f\implication!scre..tion_0000000000000000_001a.0006_6e = 68747470733a2f2f67657468656c702e69742f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5cdffdcdbb880340\Files\ScreenConnect.WindowsFileManager.exe.conf = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0458502f\SizeOfStronglyNamedComponent = 1fea090000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_98937fbcddecdd38\lock!0c000000f5d3580e88010000bc0b0000000000000000000 = 30303030303138382c30316464353130636366376334353034	ScreenConnect.WindowsClient.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 54007200750065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0006_none_5cdffdcdbb880340\implication!scre..tion_0000000000000000_001a.0006_6e = 68747470733a2f2f67657468656c702e69742f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0006_none_374ca698f508fa2b	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_8cee6e97f62f7d68\scre..core_420d02d3849b7992_001a.0006_none_374ca698f	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 680074007400700073003a002f002f00670065007400680065006c0070002e00690074002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320036002e0036002e0036002e0039003700340037002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320036002e0036002e0036002e0039003700340037002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e00330032000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_8cee6e97f62f7d68	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0006_none_374ca698f508fa2b	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0006_none_374ca698f508fa2b\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_98937fbcddecdd38\DigestValue = 6d43d3f402986dd9ef0feeecb87d146e6d92f890	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0006_none_3bc47e7a31570d5b\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_none_0a65abd5bb43263d\lock!04000000d8d0580e1008000014090000000000000000000 = 30303030303831302c30316464353130636336353033386562	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_0000000000000 = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d002200680074007400700073003a002f002f00670065007400680065006c0070002e00690074002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320036002e0036002e0036002e0039003700340037002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320036002e0036002e0036002e0039003700340037002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e00530065007400200063006c006100730073003d002200530079007300740065006d002e00530065006300750072006900740079002e005000650072006d0069007300730069006f006e0053006500740022000d000a00760065007200730069006f006e003d002200310022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d00220028006800740074007000730029003a002f002f00670065007400680065006c0070005c002e00690074002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300030003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "V9D0MOMOVB5QA47M0HM67DBZ"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0006_none_5cdffdcdbb880340\lock!0100000080cf580e1008000014090000000000000000000 = 30303030303831302c30316464353130636336353033386562	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_6e19d454ea2041ee\scre...exe_0000000000000000_001a.0006_none_5cdffdcdb = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_98937fbcddecdd38\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18ac85d96\SizeOfStronglyNamedComponent = 4b24030000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0006_8cee6e97f62f7d68	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_0000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_none_0a65abd5bb43263d\implication!scre..tion_0000000000000000_001a.0006_6e = 68747470733a2f2f67657468656c702e69742f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0006_none_374ca698f508fa2b\Files\ScreenConnect.Core.dll_b96889d378047e27 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0006_none_3bc47e7a31570d5b\SizeOfStronglyNamedComponent = 7c381e0000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0006_none_3bc47e7a31570d5b\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18ac85d96\Files\ScreenConnect.ClientService.dll_e781b1c63 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_8cee6e97f62f7d68\lock!11000000d8d0580e100800001409000000000000000000006644 = 30303030303831302c30316464353130636336353033386562	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 30000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0006_none_3bc47e7a31570d5b	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0458502f	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0006_none_3bc47e7a31570d5b\lock!1800000004d4580e88010000bc0b0000000000000000000 = 30303030303138382c30316464353130636366376334353034	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0458502f\lock!1600000004d4580e88010000bc0b0000000000000000000 = 30303030303138382c30316464353130636366376334353034	ScreenConnect.WindowsClient.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\C89KK6Z8.RKD\G6965088.ODR\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\H0N1NLBM.8KX\ELBG6GBH.CZ1\scre..ient_420d02d3849b7992_001a.0006_none_98937fbcddecdd38\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1748	2026-09-29_88915e90b632b3aadffff3e71c7814fe_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	2064	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2064	1748	2026-09-29_88915e90b632b3aadffff3e71c7814fe_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	96
PID 2064 wrote to memory of 392	2064	dfsvc.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-09-29_88915e90b632b3aadffff3e71c7814fe_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_88915e90b632b3aadffff3e71c7814fe_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Users\Admin\AppData\Local\Apps\2.0\H0N1NLBM.8KX\ELBG6GBH.CZ1\scre..tion_0000000000000000_001a.0006_8cee6e97f62f7d68\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\H0N1NLBM.8KX\ELBG6GBH.CZ1\scre..tion_0000000000000000_001a.0006_8cee6e97f62f7d68\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0006_none_5cdffdcdbb880340.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\H0N1NLBM.8KX\ELBG6GBH.CZ1\manifests\scre...exe_0000000000000000_001a.0006_none_5cdffdcdbb880340.cdf-ms
Size 14KB
SHA256 f493138239a25abf9c593411aa07fd30b18264d8a6c151410d10c4c7310de180
MD5 83cff788b370b1544c041d0af0a9bb45
SHA1 79ff4358a59568927fa29f9ce85e761ab4f0675d
SHA512 b1cbe3211006835fcadc7508086c9d8e3b097d4451517606002a6f21f23396c29a31f65d21a0088def91ed43d176ad524c6c9dd021a8364523a69874a0a1d59d
SSDEEP 192:fflUwHfSERWcKoGnGzq/CWDVdOojDUO9V9Y6JsrvreGV07gqp4:fFDRWcK1Gzq/CvqDU69YoQI4
TLSH
T158620C01B791E833E25517339CA6C2D5B321BDE99DB6139B30803B3EDD712DA4A326E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0006_none_374ca698f508fa2b.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\H0N1NLBM.8KX\ELBG6GBH.CZ1\manifests\scre..core_420d02d3849b7992_001a.0006_none_374ca698f508fa2b.cdf-ms
Size 3KB
SHA256 c79fb741f0a0396bcbe948c5f3311db999ee5c8ea55920fb46b0dfe9914408b9
MD5 7911900b03bbdf767f72c566ab4e03f3
SHA1 adc525dbc94750f225d06c7721bc65309ddbcaaa
SHA512 ae73187f2fdfe8c4f116101674c4f81635ebe2a1ff6651b056616e74f3e8e55bd2779b16143a063d28e9d77bee1c47b20b660abe251e2ca0938d8bd9c3ad26d6
TLSH
T1C6615702B284DE17D9690633ACD6D6EA3775BE83DF43430B74C4BB2F7A322E55212195
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0006_none_3bc47e7a31570d5b.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\H0N1NLBM.8KX\ELBG6GBH.CZ1\manifests\scre..dows_420d02d3849b7992_001a.0006_none_3bc47e7a31570d5b.cdf-ms
Size 5KB
SHA256 4b13c6fa3f32ff36d897994b6776e549a65c1fd534098eba399a0aab073cd36a
MD5 bc4f1e13b25f25f8860984a2f87942d2
SHA1 dcdf8da6db56b7750f092f6efab0907c43c5a8d7
SHA512 b6547f75976a66dc08b69a3ea8a3358720b752542a77e75891b18e3637acc775da0d8f01217f79d4c5f560d4775dce495a6cf024669273a591fdd0056036166a
SSDEEP 96:RPA+RxlLNheV+Ww7OLNXIuJOlVmlviv3zgiqPu:tRxlLEJfN4uSkBsr
TLSH
T104B14311B290DE1BD5B80633AC96C3ED2B36BE92DF43430B70D4BB1F7A726D65222195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_98937fbcddecdd38.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\H0N1NLBM.8KX\ELBG6GBH.CZ1\manifests\scre..ient_420d02d3849b7992_001a.0006_none_98937fbcddecdd38.cdf-ms
Size 7KB
SHA256 79a9bc91a00c1bf6e1cd6d95b2e084bdf2501afa1b675865f84a84e15eaa3e54
MD5 085665f5c561e5e35675adc1cca8b50f
SHA1 824065a2b2018217fa8c0422a84de1ed951582a0
SHA512 20ebf9f303c49e59f996d2eea06ecea24f8ceced76638e1987a11fecf662a712c5f728a70c1c51db50d3c5bd24e8ad06f1e98af97dd03c04bc923c4d365cb3fc
SSDEEP 96:9OOpMnebEP4yVFeV+WwwOLNv863OJVMNgoP1v+W8+q9iS86quq41:0dnezyVaJ4NP3gMCm8Hrh5
TLSH
T104F13502B291EE16D6A906339CD6C3ED7635BED6DE83070B70C4BB2F76326D613120A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0458502f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\H0N1NLBM.8KX\ELBG6GBH.CZ1\manifests\scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0458502f.cdf-ms
Size 2KB
SHA256 f6c6aa9cdce72b6cbbd9befd241a286bdd504c56bf6c35fae631e4f063e6c098
MD5 eebe5ab453846af4fa157d786356bcdd
SHA1 4ab60b5c8504591bfb12aca65e93152c84a64b9e
SHA512 100170e8b910b6225c5a60caa1b0f2bf069aa5572c29d588818fdbee708de34333453c00556b2f332a77b14eccad78e970f64f1a1ea0037a14fdada9007fcedc
TLSH
T1D2511F157744E6A7DA760331ACA2C2CA3BB83E83DE91110BB0C0377F5D726C5961A1A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0006_none_0a65abd5bb43263d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\H0N1NLBM.8KX\ELBG6GBH.CZ1\manifests\scre..tion_0000000000000000_001a.0006_none_0a65abd5bb43263d.cdf-ms
Size 4KB
SHA256 43882a878c2f429914a48c3929c095f250b19c41ec552afbc89eda1061a14150
MD5 5b5bfbdfe0270bfde079238b6573c89e
SHA1 aca72b3a7df2a321cf068791754ac48bf6f1ba9b
SHA512 953a40523f2c52a181824b6b7db5b03bd92672730bb7bb4b60753acd2d7320dd23b9a3e57fa3a665be4206f2b3872eb3e32863274257fcfcb6151774e4acd68a
SSDEEP 96:XOUGGdLEW0m5R/NGUmIkYVn4yMgh13MFs:XXdLZG9t2jMu
TLSH
T1A1916580B740FD33DA144732ACD2D2D13335BDA60FD553173098773FAD3A289621225A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18ac85d96.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\H0N1NLBM.8KX\ELBG6GBH.CZ1\manifests\scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18ac85d96.cdf-ms
Size 4KB
SHA256 b86138a8794abe69c0a9922c15cfa5204dad4968d8567bb0e0f2ee2e4237e146
MD5 07c3b644e32cd9e3ecb99d04c2654242
SHA1 8a321e71eba96190e419947308dd9835e56a455d
SHA512 2ef431cc23dfe15978f0a86d8f5a9d331671e610d8e77af95934248c1bf7c7a551a8d028154802958f66f36257ec94b1c8dd31b27b382f1a84156ce39982784e
SSDEEP 96:k5Q4nOZ1eV+Ww8OLNv4cSGYHXxrI10j/X+3SDKu4uiV:kCKJoNhSXxC0CC6NV
TLSH
T137A1DF017341EA27E5A50633AC96C3EE3B797D82DE42120B71C47F2F75725E643261D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\H0N1NLBM.8KX\ELBG6GBH.CZ1\scre...exe_0000000000000000_001a.0006_none_5cdffdcdbb880340\ScreenConnect.ClientService.exe
Size 93KB
SHA256 5e5595e292b9cd0e1855fba5c114adde313b4e1af2dfe9ac2814e62879fca75b
MD5 d8a39f9938e6bd333b501f9d10782313
SHA1 b7f8e84ff945a18401480893c5d26c6174d50878
SHA512 bc81ff522715e5382b73274bb5d21324ed25b135fe75d49683b5373bb7f8e57cd211c5e9f33bafb748f6e1bd10e37638ccc5605772273307296f18a8c1c0a366
SSDEEP 1536:fg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoU0HMC7R:IhbNDxZGXfdHrX7rAc6myJkgoU0Hjd
TLSH
T16C935B13B5C28871D573093158E0DAB09A7FF9215E21DEAB3798022E4F742C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\H0N1NLBM.8KX\ELBG6GBH.CZ1\scre..tion_0000000000000000_001a.0006_8cee6e97f62f7d68\ScreenConnect.WindowsClient.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\H0N1NLBM.8KX\ELBG6GBH.CZ1\scre..tion_0000000000000000_001a.0006_8cee6e97f62f7d68\user.config
Size 520B
SHA256 b80044c4824e22539fd67c214881b1b190073afc981ccc039bbcd709a8fb3365
MD5 8512bf128228d1f400be05aa14e4343e
SHA1 6b898f16f716bbb0f19d99fc8bb9a3dd4658e6b2
SHA512 c24e34c3e0cf7e6ed377cdad4ecb1e87ddf8164a8825d80d50585591fa270124ded6b9414dee57816fef275c4aa26e8e0a362d3564373018d3a9c861439c4700
TLSH
T1E9F0E9A531806D4703635E23C5114745EE725A9B0555209874AF617A5F315CE03A32CF
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\H0N1NLBM.8KX\ELBG6GBH.CZ1\scre..tion_0000000000000000_001a.0006_8cee6e97f62f7d68\user.config
Size 655B
SHA256 a1d91d7456a95f581a4a376c364bec62d8f65791366267fefcaa3dd266475bd8
MD5 e109ee398de1d59ffea293113ad063af
SHA1 affcbb563091f062b8ff757424b08820df17b69e
SHA512 fdf811758c3d920811df80f5f625531c509964c9cbb99f47e3708360a6ac534933dc694f28e6e9e59be4411ae2397f502314a342d2a8be2894d122ac81079394
TLSH
T143F0286971C4AE4B02732E32C5214385EE715A970265209874AE217BAF308CE07A32DE
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\C89KK6Z8.RKD\G6965088.ODR\ScreenConnect.Client.dll
Size 630KB
SHA256 c36505bffe4ea8ec6683cac3fed181d4cd45d5db360b4a48aeffdc0af731b622
MD5 b4422108267afc85e9d4a1f47c4b2462
SHA1 1186495707bd7a3b06a4969c98fc025512d8b962
SHA512 57b48c1b89e4edc0566501b95650a8be0d568f7d20064fa289070129ea2e49c47bd19294cadabbddf82504f32cb1951d50a7ef738e67f2eae3eaa47f445701a8
SSDEEP 12288:zLQzhEnSY4iyHz2StwiWXVczHTEavSW7OQniuFdSqETb9:z0enT4iyHz2SHWXIzEn8quCqsp
TLSH
T168D4D049AB94ED2AEE5E0733F1612A109AB16CD69957D30F1E68377D8D723843F4C2C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\C89KK6Z8.RKD\G6965088.ODR\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 0ad1e1eab6457792bb0aec39da5aca0e494233551fb97f524ce207207ff33c72
MD5 f2fb2467ad54050085fc9e21dee62187
SHA1 32ace3dce0084864c048acec3373c9d555839aec
SHA512 d614a35a3c42145ea9109dff2026a3b7bfb9f81463a5a02c97c259798096444203ec610504cfc12467f15d2628b971f5a49ef968dd46aa2c890c0769791efea9
TLSH
T1FF117B0191C4FA361F3341D2BEE7E420676D5B3308CE194BB069686F8B29AD743471B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\C89KK6Z8.RKD\G6965088.ODR\ScreenConnect.ClientService.dll
Size 194KB
SHA256 618b8d31ee7e8783118fce2f6216cfba98d0df95f48215eb9e6d4e712b397890
MD5 8853f0be4c8409b68a55f9ac62106c14
SHA1 2f13e76faa168c262414f4a7a0380adab7a12fdd
SHA512 1c018505fa8fbf0bcbadbad235710d66468c05f2bcec4c4833fe6a196977d3c59a0b78940ab6bc97b0ff5ebd2a8f66d9efb56ead7a59afea7d3eaf0cda6da9e2
SSDEEP 3072:k7WCwZBNzcIH8vfq4GU5aH+fPpxNpqxr7zjs6LIDqJEdAQZVp2ME5NtN:k7WCwZBxyK4GU8H+nfnqxrjsoQdAG2RJ
TLSH
T15814AF89BB5FD966C49E0A3BA461B32007F1B083CAE6C74F6CD852DE1E563D42E543C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\C89KK6Z8.RKD\G6965088.ODR\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 0c8790e55c350ef3f39207cf925eeb4fca34472faf118ee1aa8da7be64475098
MD5 6e7cec7ced217b947f28d8b114a1c06b
SHA1 82add771cd844cef34a9895d7daa5254deff45b3
SHA512 b2cd4f569158bc723f638debb944dca7387922a3993e45d66a05c7c72c626ca391a9ddee242ef082e68ead7831e0ca3ada58ef1d87a1589d66431845d88186b0
TLSH
T17E31F61195C4FA351F3302C2BEE7E4705B9D5B2215CE194BB059695FCF29A97434B073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\C89KK6Z8.RKD\G6965088.ODR\ScreenConnect.Core.dll
Size 1.3MB
SHA256 1d0095df628d85b58fd29fa3f47af2819e75dac78fd7b8edf6cdf698f0d46e6e
MD5 c60c47c74cd29ce5bceba11e31229741
SHA1 b6076976c810f66044cee5856f4899f2ec1b4ec7
SHA512 de264cc5d29765e37c7e178a2e7d1e71c5bbc6be2478b7bbef39cd5d25f74863b2e6dffc826d54866bd0dcbce28e4a34e3d3648af051e097d68debaa8ccb6785
SSDEEP 24576:HA9qrgkdpRLuKAew75bP3RwsZBybV/Q0yzL:HAUrgszC/lMKByJ/Q0yH
TLSH
T161557C8E7B89DB23DA6E063790A0720467F0E1965B63D34B69A0B73F1C453E87E481DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\C89KK6Z8.RKD\G6965088.ODR\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 4d9eb3c7da5331ada700e4ccbbb695b70b1e5fc7690a70a51d100e1bba113914
MD5 613c9f2812c951da1f1ab3fc968b9dcb
SHA1 9fdd9fcdd8e26c6f6fbfd1fe29921e62953e69cc
SHA512 4d88c52e613cd04779a768e9c4d59b753940ed3d916171d233a271a36357b918279aa2ec0a153320a695eb79967afb1fe1ba73ca4505786d07402e066a719cc9
TLSH
T15C21370181C8FA261F3302D2BEE7E42197AE5B3318CD194B74A9699FCB2DAD64747173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\C89KK6Z8.RKD\G6965088.ODR\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 26c117e7d169cc3fe378af22ff201ac213b901123a312bed0749801816a1f425
MD5 87e0a7fa71b1549dd3f7cac049d99fa5
SHA1 d72f205440f0321a9cd59f8e17fe96d4f05c666d
SHA512 72a009b04a75e782cf7749893fd798bea9489af1a81a69a6656e8e690802f0212430a41de08d00612cc950d5f0b11578e739c9302ef8c7584a5cefb26faba238
SSDEEP 24576:TFjtTFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKPTsUL:RlJkGYYZTk+T1iH7efPcMwt
TLSH
T12895AD45F6C365FAD42B047888BE632AA7743C040355CBFB97D0AA3A6D337C09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\C89KK6Z8.RKD\G6965088.ODR\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 e23a52248507cfef209906c06b522a9d6ca9e6762750efd03dc6fda37dd3ddbb
MD5 2d52aba918ebe58e297b40e17694ebbd
SHA1 2d4bfafa63ac1bca6b46c24b4aedf8abaebd6391
SHA512 3179a5e0e951dfb7e17b1258445cefb70000ca15bb439b3398d2b37c98f147c7039e67fa16633add8af32b21c87e11169024eadbc9ca9c9d897c60f6327fedd9
TLSH
T10341D11181C8FA250F3302C2BEEBE431979E5723198E194B7499AD9BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\C89KK6Z8.RKD\G6965088.ODR\ScreenConnect.WindowsBackstageShell.exe
Size 134KB
SHA256 d00380a0f46426baf93b2e1e1ba4fc8bbcb3713a2b786c799cab7164d289f3ac
MD5 892e2c8d833d4db30530a68d40b767fc
SHA1 1ff76592703e0bcfbe64e3416a3c65e05433e523
SHA512 c322528d3409033ded03eb7d721993b3e793d1d6f3f1048b282e9ea3c8693adc88986d713abdda03d791034d87d5090347052b53761ec6e017548bc174db4d7b
SSDEEP 1536:u7CpFO3u5wZ4ioBIOW76+gcONmV07W0AiECxv4ubQJY+FhxLOG4kzHpvvJDtMJaJ:WeAoB29181ZMJYa6G4kzHuJaKYEthVI
TLSH
T13FD39D8077999616C9EE0E3BA0E2F31046F1B493C9D3C75B6CA426BE2F19BD16F502C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\C89KK6Z8.RKD\G6965088.ODR\ScreenConnect.WindowsClient.exe
Size 1.6MB
SHA256 173e7f2893e16bdc5a3f2a034d3234df9f3926190c2ba578f014cbb481f45853
MD5 d46c9ca10c66b3738d80c8d9a32f1639
SHA1 6d43d3f402986dd9ef0feeecb87d146e6d92f890
SHA512 c31ca2ef825401c85eacdc3d326eff1de7aa7dd1a97cb93e0280b377c64a30451e30776dd39403b95d172af76d11b36ea3f00988ee3a144e40f44a62b8e4c1c0
SSDEEP 24576:X3NRddzQFIyJu1df6llsfQDemcKpIsIAijI3dGFM:X3pUjUHq3p
TLSH
T15B758D897F95EE6BC86E077B9490220477F094918F22E70768A4B77E1C853C4BD48ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\C89KK6Z8.RKD\G6965088.ODR\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\C89KK6Z8.RKD\G6965088.ODR\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 84b6196856da07fd13c045108ec8dd08ae23f3127511d079001126936c98bba9
MD5 274ebe7a7b02554f10c69d232fe856cd
SHA1 a3c3aa4dbe597b38d240a5894401041a968dfb43
SHA512 8c62b7ceadedbe871cbe129667ec2e6ceb2c1db5c846f4351511aace5650a50448055f84144d7367017446eaaf0d720605cda6c6c4ce4324e41f2fa322a306d2
TLSH
T17C51061151C4FA310F3302C2BEEBE0709B9E4B22158E194B7099A99FCF2DA97478B067
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\C89KK6Z8.RKD\G6965088.ODR\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 920243e5c7b0f562fc5910c84ed9ab1ad4bc35e7e6f3eaa0bc122d3a7fcc57c5
MD5 f58818dd15e6966daacdddb841124822
SHA1 f894c064a4d5c6f7435c0c70134af3b0b34f7b94
SHA512 281836e88dba1cb9845cc85a9225383953927b11ee754dd63187c175992170d02c133cabad81796ddab26b074afb115bfcb4abecac2abf800d5d321d6db03422
SSDEEP 96:xWLwOhoyT4b1ie2wvyJ3kz3k523ko3k03kIqkHLykt4kOpQkOpsSkSAkOpD:oR4Jie6UzUAUoU0UeHL7t9UFUsbSVUD
TLSH
T10CF1CD5688C0BC21573281D1FEE3D924BD157F6302AE148E7C4D19AF9FB25899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\C89KK6Z8.RKD\G6965088.ODR\ScreenConnect.WindowsFileManager.exe
Size 119KB
SHA256 44bcf8773c030654343b688dbf06829700e69d54eef5e159c26d34f2a1de5857
MD5 4daefa78e98097b23ddc016999049a96
SHA1 3c6af797872141a731bebae1b447d1fc9415802b
SHA512 12f25017eba5dcfae895fb73f1383f582b930049b7eedb59a91e67bc352762b4ec9927a22fbaa08fc49ccf1777e45e2c310062eab074ac9bbd03eb5f0121f530
SSDEEP 1536:/awe5+HVx9yxluZuDbOB9zuPuI5BLP+VVVVVVVVVVVVVVVVVVVVVVVVVSg2S7Xb:/axY1SW0bouBLNHSH
TLSH
T115C34B4135266235EEC5C433A452D6B099737F6607FEC2BD2CA1BA3A38F43943E59970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EZG32AMH.1MO.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\DBMVVNG5.YOT\EZG32AMH.1MO.application
Size 103KB
SHA256 2a800dd47be5b2ba0fded8defc05be1c47e15c575ce7084ff3dba28c151f7597
MD5 35be7cd32c601650e5d7f72a5f9fd3b7
SHA1 f9158f1643fa9ccb263c30dfb92fd68198c19f87
SHA512 9ab7ead6d0baa4435d4a3da7380b74e7dab7c1b36d69bf173d824aabe54ed9423f1e26bde1a90e306f3662a051e328cc8e93e725e052ce61469e651aae288e71
SSDEEP 1536:AncK+zuLD4UABnjRnfduUW5Ab4KpSE5GP/uLTvooycuv2JYKQ/IuKE:5uuBn1nfdvg2XOcuv2JYX1
TLSH
T19AA3713ACE30F4C0477DB021D1A52D673D811B93DB731BACE90A186B0E69796EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/392-341-0x0000000000B20000-0x0000000000CB6000-memory.dmp

Download

memory/1748-7-0x0000000006380000-0x0000000006924000-memory.dmp

Download

memory/1748-5-0x00000000056F0000-0x0000000005842000-memory.dmp

Download

memory/1748-1-0x0000000001520000-0x0000000001528000-memory.dmp

Download

memory/1748-0-0x00000000055A0000-0x00000000055B0000-memory.dmp

Download

memory/1748-2-0x00000000055A0000-0x00000000055B0000-memory.dmp

Download

memory/1748-3-0x00000000015E0000-0x00000000015EE000-memory.dmp

Download

memory/1748-4-0x00000000055A0000-0x00000000055B0000-memory.dmp

Download

memory/1748-9-0x00000000055A0000-0x00000000055B0000-memory.dmp

Download

memory/1748-6-0x0000000005AD0000-0x0000000005B3E000-memory.dmp

Download

memory/1748-13-0x00000000055A0000-0x00000000055B0000-memory.dmp

Download

memory/1748-12-0x00000000055A0000-0x00000000055B0000-memory.dmp

Download

memory/1748-11-0x0000000006930000-0x0000000006B16000-memory.dmp

Download

memory/1748-10-0x00000000055A0000-0x00000000055B0000-memory.dmp

Download

memory/1748-8-0x0000000005ED0000-0x0000000005F62000-memory.dmp

Download

memory/2064-36-0x000002646E8B0000-0x000002646EA02000-memory.dmp

Download

memory/2064-26-0x000002646E470000-0x000002646E4C0000-memory.dmp

Download

memory/2064-44-0x000002646E940000-0x000002646EAD6000-memory.dmp

Download

memory/2064-50-0x000002646E6B0000-0x000002646E752000-memory.dmp

Download

memory/2064-40-0x00000264679F0000-0x0000026467A00000-memory.dmp

Download

memory/2064-62-0x000002646E500000-0x000002646E534000-memory.dmp

Download

memory/2064-14-0x0000026467630000-0x0000026467638000-memory.dmp

Download

memory/2064-16-0x00000264679F0000-0x0000026467A00000-memory.dmp

Download

memory/2064-39-0x000002646B170000-0x000002646B272000-memory.dmp

Download

memory/2064-56-0x000002646E9E0000-0x000002646EBC6000-memory.dmp

Download

memory/2064-15-0x0000026469CC0000-0x0000026469E46000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads