024416d6d5e1cbda9c48bf90f1b2d1ccdebec832b900c7d340b9a105d773b524

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 18:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_88915e90b632b3aadffff3e71c7814fe_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 3.7MB
Sample260930-xhvbrazdmh
SHA256 024416d6d5e1cbda9c48bf90f1b2d1ccdebec832b900c7d340b9a105d773b524
MD5 88915e90b632b3aadffff3e71c7814fe
SHA1 18f03219b97ea58868bb2feb779deb237767616a
SHA512 31954e036348cb807cf91172d12ad68579abe049901f1bc0a17dbb123d4c57366349c747c322bd0525fe4cfcb046e50b897d25299f7a840fbb2616c71275e3a8
SSDEEP 49152:uAUrgszC/lMKByJ/Q0yHlJkGYYZTk+T1iH7efPcMwMLEeC6B:52C/l6JieM6efPcMLo4
TLSH
T1F706C04AFBC6A677C53F063584B57314A7B0B8454762C7AB6AD0BB3E1C323D06E25389
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
3	2556	dfsvc.exe
3	2556	dfsvc.exe
3	2556	dfsvc.exe
3	2556	dfsvc.exe
3	2556	dfsvc.exe
3	2556	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
2412	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\4ZT1G3PA.7P4\42O5X9G1.0XJ\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_88915e90b632b3aadffff3e71c7814fe_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_88915e90b632b3aadffff3e71c7814fe_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_88915e90b632b3aadffff3e71c7814fe_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_0000000000000 = 68747470733a2f2f67657468656c702e69742f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_6e19d454ea2041ee\pin!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_98937fbcddecdd38\SizeOfStronglyNamedComponent = f358190000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0458502f	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5cdffdcdbb880340	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5cdffdcdbb880340\Files\ScreenConnect.ClientService.exe_e781b1ee3 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0458502f\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18ac85d96\SizeOfStronglyNamedComponent = 4b24030000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0006_none_3bc47e7a31570d5b\lock!0c0000006392590efc09000064110000000000000000000 = 30303030303966632c30316464353130636337313335653337	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0006_none_3bc47e7a31570d5b\lock!0a0000002894590e6c090000380b0000000000000000000 = 30303030303936632c30316464353130636434356163373161	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 680074007400700073003a002f002f00670065007400680065006c0070002e00690074002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006d0061006e00690066006500730074000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 32003000320036002f00300039002f00330030002000310038003a00350032003a00320032000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_none_0a65abd5bb43263d\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_6e19d454ea2041ee\scre...exe_0000000000000000_001a.0006_none_5cdffdcdb = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_none_0a65abd5bb43263d	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_none_0a65abd5bb43263d\lock!020000002894590e6c090000380b0000000000000000000 = 30303030303936632c30316464353130636434356163373161	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 680074007400700073003a002f002f00670065007400680065006c0070002e00690074002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320036002e0036002e0036002e0039003700340037002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320036002e0036002e0036002e0039003700340037002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e00330032000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18ac85d96	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18ac85d96\implication!scre..tion_0000000000000000_001a.0006_6e = 68747470733a2f2f67657468656c702e69742f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0006_none_374ca698f508fa2b\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0458502f\lock!080000002894590e6c090000380b0000000000000000000 = 30303030303936632c30316464353130636434356163373161	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5cdffdcdbb880340\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18ac85d96\lock!060000002894590e6c090000380b0000000000000000000 = 30303030303936632c30316464353130636434356163373161	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_0000000000000000_57051d5779c6eb7e	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_none_0a65abd5bb43263d\SizeOfStronglyNamedComponent = 70ae010000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_98937fbcddecdd38\lock!1a0000005794590e6c090000380b0000000000000000000 = 30303030303936632c30316464353130636434356163373161	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0006_8cee6e97f62f7d68\HasRunBefore = 01	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_8cee6e97f62f7d68	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5cdffdcdbb880340\SizeOfStronglyNamedComponent = 09c7050000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0458502f\SizeOfStronglyNamedComponent = 1fea090000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_6e19d454ea2041ee\appid = 68747470733a2f2f67657468656c702e69742f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0006_none_374ca698f508fa2b\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0006_none_5cdffdcdbb880340	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_0000000000000 = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d002200680074007400700073003a002f002f00670065007400680065006c0070002e00690074002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320036002e0036002e0036002e0039003700340037002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320036002e0036002e0036002e0039003700340037002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e00530065007400200063006c006100730073003d002200530079007300740065006d002e00530065006300750072006900740079002e005000650072006d0069007300730069006f006e0053006500740022000d000a00760065007200730069006f006e003d002200310022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d00220028006800740074007000730029003a002f002f00670065007400680065006c0070005c002e00690074002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300030003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_none_0a65abd5bb43263d\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5cdffdcdbb880340\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5cdffdcdbb880340\Files\ScreenConnect.WindowsFileManager.exe_0e21 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0006_none_374ca698f508fa2b\SizeOfStronglyNamedComponent = 73fa140000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0458502f\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0006_none_3bc47e7a31570d5b\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 54007200750065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 30000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_98937fbcddecdd38	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5cdffdcdbb880340\Files\ScreenConnect.WindowsFileManager.exe.conf = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0006_none_3bc47e7a31570d5b\DigestValue = d72f205440f0321a9cd59f8e17fe96d4f05c666d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0006_none_5cdffdcdbb880340\lock!060000006392590efc09000064110000000000000000000 = 30303030303966632c30316464353130636337313335653337	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_8cee6e97f62f7d68\lock!110000007292590efc09000064110000000000000000000051a7 = 30303030303966632c30316464353130636337313335653337	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_8cee6e97f62f7d68\scre...exe_0000000000000000_001a.0006_none_5cdffdcdb	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_8cee6e97f62f7d68\scre..core_420d02d3849b7992_001a.0006_none_374ca698f	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0006_none_3bc47e7a31570d5b\SizeOfStronglyNamedComponent = 7c381e0000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_8cee6e97f62f7d68\SubstructureCreated = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 68747470733a2f2f67657468656c702e69742f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\4ZT1G3PA.7P4\42O5X9G1.0XJ\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\C75CRYNC.T9O\YAQG222J.TOR\scre..ient_420d02d3849b7992_001a.0006_none_98937fbcddecdd38\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4484	2026-09-29_88915e90b632b3aadffff3e71c7814fe_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	2556	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 2556	4484	2026-09-29_88915e90b632b3aadffff3e71c7814fe_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	89
PID 2556 wrote to memory of 2412	2556	dfsvc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-09-29_88915e90b632b3aadffff3e71c7814fe_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_88915e90b632b3aadffff3e71c7814fe_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Users\Admin\AppData\Local\Apps\2.0\C75CRYNC.T9O\YAQG222J.TOR\scre..tion_0000000000000000_001a.0006_8cee6e97f62f7d68\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\C75CRYNC.T9O\YAQG222J.TOR\scre..tion_0000000000000000_001a.0006_8cee6e97f62f7d68\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:2412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0006_none_5cdffdcdbb880340.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\C75CRYNC.T9O\YAQG222J.TOR\manifests\scre...exe_0000000000000000_001a.0006_none_5cdffdcdbb880340.cdf-ms
Size 14KB
SHA256 389ab4869f93d5c771a75c6a128282d40f9d767d3dcfade43d51d0025bd41eec
MD5 e4976d64212e131847453dc0d0a83b27
SHA1 0f46c04c5b9cf44820fd7897ef7b0f4dede8f39e
SHA512 aa6e9094a982bc13a672a3db0ff43cad4e42ac4160d8b284b2115639ced7d5acddba952d36f3ed1f5558a288f50e1320e50a49da2e1147a49e6687f443a27add
SSDEEP 192:oflUwHfSETSmCnGzqG17l84l8RerererSrZIQGV67gqd74:oFDTSm+GzqGJmOS+++a374
TLSH
T16C628501BBD6E932E2501733DC9AC3D57232BCE55F66135B30853B2EED702D98A23695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0006_none_374ca698f508fa2b.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\C75CRYNC.T9O\YAQG222J.TOR\manifests\scre..core_420d02d3849b7992_001a.0006_none_374ca698f508fa2b.cdf-ms
Size 3KB
SHA256 9b4b4a75df48870cacb4ac2a474b88e46b148012fdbd338a2c822c0a90250b7a
MD5 c592a869ec5bca5a206f984b93c456cc
SHA1 b3d2f30cf8a44e47b490830c85ed64ffdd42cfc2
SHA512 b214a981d28e4aae72fcbb7446ed9e0903764eeac820b99ba7676ebe5299e7a66fd02888f3194eb2a0735b6e70f80c008e65183cad4d668b5aacfe0b77bac370
TLSH
T195611F01B244DA27D9690633ACE6D6FE2B747E83DE81420B74C47F2F79361F62211295
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0006_none_3bc47e7a31570d5b.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\C75CRYNC.T9O\YAQG222J.TOR\manifests\scre..dows_420d02d3849b7992_001a.0006_none_3bc47e7a31570d5b.cdf-ms
Size 5KB
SHA256 09a2dfb90d976ba81cb4b150366c741db740f22dec3fb5dd13fc317bcf96fa16
MD5 e5c0b6230d14e9a4392c9ebf15e8642d
SHA1 830dacf226ece298eda3fb8e26366e9a563137e6
SHA512 5fe0d4179eee463a5f3ff0f7efa6b8175d972c9199f00020ee1270a0bac75ed85611e15876cbb8776248a9ab55bdd5db6dd8c67894d6994eb050edc843f33873
SSDEEP 96:/PA+RxlrNheV+Ww7OLNXIuOQlVXXezoZpvi+giqPu:fRxlrEJfN4uNB62r
TLSH
T10DB153117290DD1BE5B90633ACA6D3ED3B36BE92DE43030B70D4BB1F7A326D65222195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_98937fbcddecdd38.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\C75CRYNC.T9O\YAQG222J.TOR\manifests\scre..ient_420d02d3849b7992_001a.0006_none_98937fbcddecdd38.cdf-ms
Size 7KB
SHA256 05a1382b0dcfdbf33a99e8e30949949654c6b2b979fecac9c04ba48edcd42c00
MD5 83cad0a0d0eecd26dbbc7a6962268395
SHA1 d2bb0683e4c442a0d3e0fb5e5461a4f1cb283dde
SHA512 c909ecff86d02a90ffa3c4e6c7a63e91995e981be85b2067e622b795fb55c3ccb95f3e27d469f2c7da13c808af830de53dbef0734f5cf3f57ffdccb0d16f1293
SSDEEP 96:wOOpMnebEP4sVFeV+WwwOLNv86pp9sFxHz6prvGdD2bJv3Wc6quq41:hdnezsVaJ4NPpjsFRe5asmB5
TLSH
T1AFF1DB01B351EE12D5B94A339CAAC3DD37387E92DE42170B71C4BB2F76325EA1322195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0458502f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\C75CRYNC.T9O\YAQG222J.TOR\manifests\scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0458502f.cdf-ms
Size 2KB
SHA256 7b5888b9be7b82a1240d5d827edca5ec6ba6e25131a2814f229aad07d8e18d25
MD5 879ea3a94f668cad95b32221e11a6eb2
SHA1 bdfba81ad6a5a97b130474437f1a75016d031bb4
SHA512 589147c903f70c6fee02d056e822a4042860e1d9f422b61dc6be37a89e93f43ef9e0ca0618e93acac9f589cb47379962a7fafcbdc33cc9a85b2dded8d769177b
TLSH
T1A85198053684EA67E67A0233EC96D2D932357E83EF47030BB190BB6F7A722C54612092
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0006_none_0a65abd5bb43263d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\C75CRYNC.T9O\YAQG222J.TOR\manifests\scre..tion_0000000000000000_001a.0006_none_0a65abd5bb43263d.cdf-ms
Size 4KB
SHA256 a93dadc1670b15768ff3f669e76e5a7b651974d2b120802a605ed6dfd7bc5f99
MD5 0362a860804d689ee3ba03f545c62147
SHA1 a76397b6e7b3773c95a999be5fc4327def03119a
SHA512 f216eeb97d37cc013c862a2e435c5a8ccdef311410f184fb543db109648b3b20dd4582e5776d871b72cc8ca6e0f93e3a08b3e54bd8a71e03b0a39608f2f05129
SSDEEP 48:CP/mrIYAqzIvKSgKLRu9o0m5RD7NGU7gFUTUETkKf48Vvgf2ZJms4UX6+eQZch:wOUGGlLEW0m5R/NGUmIk8Vv3XmvOeQZs
TLSH
T122915240B740F833D60447339CE3D2D037357DA60ED6571770987B2FAD3668AA6217A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18ac85d96.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\C75CRYNC.T9O\YAQG222J.TOR\manifests\scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18ac85d96.cdf-ms
Size 4KB
SHA256 5f621443e2a7b14f415eee954b1d506851fe10fc07682ab8e542f314a5ea9aca
MD5 9c208f32f6c168d4e5de6b1917e56014
SHA1 29d87f503525d5267448d04a44dd1efc88abd8bd
SHA512 550d6c15cf262b2cf635fca94ebdba9f4f10fb020097a07f98a2c3c0d16f7519e0ec7e602654e731ea72a1ecfcd8c978b04f17517fe739e184e2765d33c5cc78
SSDEEP 96:wQ4nO/1eV+Ww8OLNv4cSGYHXxrI10j/X+3QDKu4uiV:/KJoNhSXxC0CA6NV
TLSH
T192A100027340EA27E6A50633AC96C3ED3B797D82EE42120F71C47F2F75725E643261A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hiqcxtxn.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\C75CRYNC.T9O\YAQG222J.TOR\scre..tion_0000000000000000_001a.0006_8cee6e97f62f7d68\hiqcxtxn.newcfg
Size 655B
SHA256 a1d91d7456a95f581a4a376c364bec62d8f65791366267fefcaa3dd266475bd8
MD5 e109ee398de1d59ffea293113ad063af
SHA1 affcbb563091f062b8ff757424b08820df17b69e
SHA512 fdf811758c3d920811df80f5f625531c509964c9cbb99f47e3708360a6ac534933dc694f28e6e9e59be4411ae2397f502314a342d2a8be2894d122ac81079394
TLSH
T143F0286971C4AE4B02732E32C5214385EE715A970265209874AE217BAF308CE07A32DE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\C75CRYNC.T9O\YAQG222J.TOR\scre..tion_0000000000000000_001a.0006_8cee6e97f62f7d68\user.config
Size 520B
SHA256 b80044c4824e22539fd67c214881b1b190073afc981ccc039bbcd709a8fb3365
MD5 8512bf128228d1f400be05aa14e4343e
SHA1 6b898f16f716bbb0f19d99fc8bb9a3dd4658e6b2
SHA512 c24e34c3e0cf7e6ed377cdad4ecb1e87ddf8164a8825d80d50585591fa270124ded6b9414dee57816fef275c4aa26e8e0a362d3564373018d3a9c861439c4700
TLSH
T1E9F0E9A531806D4703635E23C5114745EE725A9B0555209874AF617A5F315CE03A32CF
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4ZT1G3PA.7P4\42O5X9G1.0XJ\ScreenConnect.Client.dll
Size 630KB
SHA256 c36505bffe4ea8ec6683cac3fed181d4cd45d5db360b4a48aeffdc0af731b622
MD5 b4422108267afc85e9d4a1f47c4b2462
SHA1 1186495707bd7a3b06a4969c98fc025512d8b962
SHA512 57b48c1b89e4edc0566501b95650a8be0d568f7d20064fa289070129ea2e49c47bd19294cadabbddf82504f32cb1951d50a7ef738e67f2eae3eaa47f445701a8
SSDEEP 12288:zLQzhEnSY4iyHz2StwiWXVczHTEavSW7OQniuFdSqETb9:z0enT4iyHz2SHWXIzEn8quCqsp
TLSH
T168D4D049AB94ED2AEE5E0733F1612A109AB16CD69957D30F1E68377D8D723843F4C2C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4ZT1G3PA.7P4\42O5X9G1.0XJ\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 0ad1e1eab6457792bb0aec39da5aca0e494233551fb97f524ce207207ff33c72
MD5 f2fb2467ad54050085fc9e21dee62187
SHA1 32ace3dce0084864c048acec3373c9d555839aec
SHA512 d614a35a3c42145ea9109dff2026a3b7bfb9f81463a5a02c97c259798096444203ec610504cfc12467f15d2628b971f5a49ef968dd46aa2c890c0769791efea9
TLSH
T1FF117B0191C4FA361F3341D2BEE7E420676D5B3308CE194BB069686F8B29AD743471B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4ZT1G3PA.7P4\42O5X9G1.0XJ\ScreenConnect.ClientService.dll
Size 194KB
SHA256 618b8d31ee7e8783118fce2f6216cfba98d0df95f48215eb9e6d4e712b397890
MD5 8853f0be4c8409b68a55f9ac62106c14
SHA1 2f13e76faa168c262414f4a7a0380adab7a12fdd
SHA512 1c018505fa8fbf0bcbadbad235710d66468c05f2bcec4c4833fe6a196977d3c59a0b78940ab6bc97b0ff5ebd2a8f66d9efb56ead7a59afea7d3eaf0cda6da9e2
SSDEEP 3072:k7WCwZBNzcIH8vfq4GU5aH+fPpxNpqxr7zjs6LIDqJEdAQZVp2ME5NtN:k7WCwZBxyK4GU8H+nfnqxrjsoQdAG2RJ
TLSH
T15814AF89BB5FD966C49E0A3BA461B32007F1B083CAE6C74F6CD852DE1E563D42E543C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4ZT1G3PA.7P4\42O5X9G1.0XJ\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 0c8790e55c350ef3f39207cf925eeb4fca34472faf118ee1aa8da7be64475098
MD5 6e7cec7ced217b947f28d8b114a1c06b
SHA1 82add771cd844cef34a9895d7daa5254deff45b3
SHA512 b2cd4f569158bc723f638debb944dca7387922a3993e45d66a05c7c72c626ca391a9ddee242ef082e68ead7831e0ca3ada58ef1d87a1589d66431845d88186b0
TLSH
T17E31F61195C4FA351F3302C2BEE7E4705B9D5B2215CE194BB059695FCF29A97434B073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4ZT1G3PA.7P4\42O5X9G1.0XJ\ScreenConnect.ClientService.exe
Size 93KB
SHA256 5e5595e292b9cd0e1855fba5c114adde313b4e1af2dfe9ac2814e62879fca75b
MD5 d8a39f9938e6bd333b501f9d10782313
SHA1 b7f8e84ff945a18401480893c5d26c6174d50878
SHA512 bc81ff522715e5382b73274bb5d21324ed25b135fe75d49683b5373bb7f8e57cd211c5e9f33bafb748f6e1bd10e37638ccc5605772273307296f18a8c1c0a366
SSDEEP 1536:fg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoU0HMC7R:IhbNDxZGXfdHrX7rAc6myJkgoU0Hjd
TLSH
T16C935B13B5C28871D573093158E0DAB09A7FF9215E21DEAB3798022E4F742C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4ZT1G3PA.7P4\42O5X9G1.0XJ\ScreenConnect.Core.dll
Size 1.3MB
SHA256 1d0095df628d85b58fd29fa3f47af2819e75dac78fd7b8edf6cdf698f0d46e6e
MD5 c60c47c74cd29ce5bceba11e31229741
SHA1 b6076976c810f66044cee5856f4899f2ec1b4ec7
SHA512 de264cc5d29765e37c7e178a2e7d1e71c5bbc6be2478b7bbef39cd5d25f74863b2e6dffc826d54866bd0dcbce28e4a34e3d3648af051e097d68debaa8ccb6785
SSDEEP 24576:HA9qrgkdpRLuKAew75bP3RwsZBybV/Q0yzL:HAUrgszC/lMKByJ/Q0yH
TLSH
T161557C8E7B89DB23DA6E063790A0720467F0E1965B63D34B69A0B73F1C453E87E481DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4ZT1G3PA.7P4\42O5X9G1.0XJ\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 4d9eb3c7da5331ada700e4ccbbb695b70b1e5fc7690a70a51d100e1bba113914
MD5 613c9f2812c951da1f1ab3fc968b9dcb
SHA1 9fdd9fcdd8e26c6f6fbfd1fe29921e62953e69cc
SHA512 4d88c52e613cd04779a768e9c4d59b753940ed3d916171d233a271a36357b918279aa2ec0a153320a695eb79967afb1fe1ba73ca4505786d07402e066a719cc9
TLSH
T15C21370181C8FA261F3302D2BEE7E42197AE5B3318CD194B74A9699FCB2DAD64747173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4ZT1G3PA.7P4\42O5X9G1.0XJ\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 26c117e7d169cc3fe378af22ff201ac213b901123a312bed0749801816a1f425
MD5 87e0a7fa71b1549dd3f7cac049d99fa5
SHA1 d72f205440f0321a9cd59f8e17fe96d4f05c666d
SHA512 72a009b04a75e782cf7749893fd798bea9489af1a81a69a6656e8e690802f0212430a41de08d00612cc950d5f0b11578e739c9302ef8c7584a5cefb26faba238
SSDEEP 24576:TFjtTFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKPTsUL:RlJkGYYZTk+T1iH7efPcMwt
TLSH
T12895AD45F6C365FAD42B047888BE632AA7743C040355CBFB97D0AA3A6D337C09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4ZT1G3PA.7P4\42O5X9G1.0XJ\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 e23a52248507cfef209906c06b522a9d6ca9e6762750efd03dc6fda37dd3ddbb
MD5 2d52aba918ebe58e297b40e17694ebbd
SHA1 2d4bfafa63ac1bca6b46c24b4aedf8abaebd6391
SHA512 3179a5e0e951dfb7e17b1258445cefb70000ca15bb439b3398d2b37c98f147c7039e67fa16633add8af32b21c87e11169024eadbc9ca9c9d897c60f6327fedd9
TLSH
T10341D11181C8FA250F3302C2BEEBE431979E5723198E194B7499AD9BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4ZT1G3PA.7P4\42O5X9G1.0XJ\ScreenConnect.WindowsBackstageShell.exe
Size 134KB
SHA256 d00380a0f46426baf93b2e1e1ba4fc8bbcb3713a2b786c799cab7164d289f3ac
MD5 892e2c8d833d4db30530a68d40b767fc
SHA1 1ff76592703e0bcfbe64e3416a3c65e05433e523
SHA512 c322528d3409033ded03eb7d721993b3e793d1d6f3f1048b282e9ea3c8693adc88986d713abdda03d791034d87d5090347052b53761ec6e017548bc174db4d7b
SSDEEP 1536:u7CpFO3u5wZ4ioBIOW76+gcONmV07W0AiECxv4ubQJY+FhxLOG4kzHpvvJDtMJaJ:WeAoB29181ZMJYa6G4kzHuJaKYEthVI
TLSH
T13FD39D8077999616C9EE0E3BA0E2F31046F1B493C9D3C75B6CA426BE2F19BD16F502C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4ZT1G3PA.7P4\42O5X9G1.0XJ\ScreenConnect.WindowsClient.exe
Size 1.6MB
SHA256 173e7f2893e16bdc5a3f2a034d3234df9f3926190c2ba578f014cbb481f45853
MD5 d46c9ca10c66b3738d80c8d9a32f1639
SHA1 6d43d3f402986dd9ef0feeecb87d146e6d92f890
SHA512 c31ca2ef825401c85eacdc3d326eff1de7aa7dd1a97cb93e0280b377c64a30451e30776dd39403b95d172af76d11b36ea3f00988ee3a144e40f44a62b8e4c1c0
SSDEEP 24576:X3NRddzQFIyJu1df6llsfQDemcKpIsIAijI3dGFM:X3pUjUHq3p
TLSH
T15B758D897F95EE6BC86E077B9490220477F094918F22E70768A4B77E1C853C4BD48ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4ZT1G3PA.7P4\42O5X9G1.0XJ\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4ZT1G3PA.7P4\42O5X9G1.0XJ\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 84b6196856da07fd13c045108ec8dd08ae23f3127511d079001126936c98bba9
MD5 274ebe7a7b02554f10c69d232fe856cd
SHA1 a3c3aa4dbe597b38d240a5894401041a968dfb43
SHA512 8c62b7ceadedbe871cbe129667ec2e6ceb2c1db5c846f4351511aace5650a50448055f84144d7367017446eaaf0d720605cda6c6c4ce4324e41f2fa322a306d2
TLSH
T17C51061151C4FA310F3302C2BEEBE0709B9E4B22158E194B7099A99FCF2DA97478B067
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4ZT1G3PA.7P4\42O5X9G1.0XJ\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 920243e5c7b0f562fc5910c84ed9ab1ad4bc35e7e6f3eaa0bc122d3a7fcc57c5
MD5 f58818dd15e6966daacdddb841124822
SHA1 f894c064a4d5c6f7435c0c70134af3b0b34f7b94
SHA512 281836e88dba1cb9845cc85a9225383953927b11ee754dd63187c175992170d02c133cabad81796ddab26b074afb115bfcb4abecac2abf800d5d321d6db03422
SSDEEP 96:xWLwOhoyT4b1ie2wvyJ3kz3k523ko3k03kIqkHLykt4kOpQkOpsSkSAkOpD:oR4Jie6UzUAUoU0UeHL7t9UFUsbSVUD
TLSH
T10CF1CD5688C0BC21573281D1FEE3D924BD157F6302AE148E7C4D19AF9FB25899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4ZT1G3PA.7P4\42O5X9G1.0XJ\ScreenConnect.WindowsFileManager.exe
Size 119KB
SHA256 44bcf8773c030654343b688dbf06829700e69d54eef5e159c26d34f2a1de5857
MD5 4daefa78e98097b23ddc016999049a96
SHA1 3c6af797872141a731bebae1b447d1fc9415802b
SHA512 12f25017eba5dcfae895fb73f1383f582b930049b7eedb59a91e67bc352762b4ec9927a22fbaa08fc49ccf1777e45e2c310062eab074ac9bbd03eb5f0121f530
SSDEEP 1536:/awe5+HVx9yxluZuDbOB9zuPuI5BLP+VVVVVVVVVVVVVVVVVVVVVVVVVSg2S7Xb:/axY1SW0bouBLNHSH
TLSH
T115C34B4135266235EEC5C433A452D6B099737F6607FEC2BD2CA1BA3A38F43943E59970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3390QMKO.MZZ.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6TCB2VTM.Y36\3390QMKO.MZZ.application
Size 103KB
SHA256 2a800dd47be5b2ba0fded8defc05be1c47e15c575ce7084ff3dba28c151f7597
MD5 35be7cd32c601650e5d7f72a5f9fd3b7
SHA1 f9158f1643fa9ccb263c30dfb92fd68198c19f87
SHA512 9ab7ead6d0baa4435d4a3da7380b74e7dab7c1b36d69bf173d824aabe54ed9423f1e26bde1a90e306f3662a051e328cc8e93e725e052ce61469e651aae288e71
SSDEEP 1536:AncK+zuLD4UABnjRnfduUW5Ab4KpSE5GP/uLTvooycuv2JYKQ/IuKE:5uuBn1nfdvg2XOcuv2JYX1
TLSH
T19AA3713ACE30F4C0477DB021D1A52D673D811B93DB731BACE90A186B0E69796EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2412-293-0x0000000000BF0000-0x0000000000D86000-memory.dmp

Download

memory/2556-15-0x000001DF731F0000-0x000001DF73378000-memory.dmp

Download

memory/2556-62-0x00007FF839B70000-0x00007FF83A514000-memory.dmp

Download

memory/2556-36-0x00007FF839B70000-0x00007FF83A514000-memory.dmp

Download

memory/2556-37-0x00007FF839B70000-0x00007FF83A514000-memory.dmp

Download

memory/2556-47-0x000001DF784C0000-0x000001DF78612000-memory.dmp

Download

memory/2556-33-0x000001DF77F30000-0x000001DF77F80000-memory.dmp

Download

memory/2556-53-0x000001DF78550000-0x000001DF786E6000-memory.dmp

Download

memory/2556-34-0x00007FF839B70000-0x00007FF83A514000-memory.dmp

Download

memory/2556-59-0x000001DF782C0000-0x000001DF78362000-memory.dmp

Download

memory/2556-18-0x00007FF839CFF000-0x00007FF839D00000-memory.dmp

Download

memory/2556-24-0x00007FF839B70000-0x00007FF83A514000-memory.dmp

Download

memory/2556-63-0x00007FF839B70000-0x00007FF83A514000-memory.dmp

Download

memory/2556-23-0x00007FF839B70000-0x00007FF83A514000-memory.dmp

Download

memory/2556-67-0x000001DF789F0000-0x000001DF78BD6000-memory.dmp

Download

memory/2556-73-0x000001DF78110000-0x000001DF78144000-memory.dmp

Download

memory/2556-22-0x00007FF839B70000-0x00007FF83A514000-memory.dmp

Download

memory/2556-21-0x00007FF839B70000-0x00007FF83A514000-memory.dmp

Download

memory/2556-19-0x00007FF839B70000-0x00007FF83A514000-memory.dmp

Download

memory/2556-14-0x000001DF58B70000-0x000001DF58B78000-memory.dmp

Download

memory/2556-35-0x00007FF839B70000-0x00007FF83A514000-memory.dmp

Download

memory/4484-17-0x0000000074AE0000-0x000000007529C000-memory.dmp

Download

memory/4484-16-0x0000000074AE0000-0x000000007529C000-memory.dmp

Download

memory/4484-0-0x0000000074AF2000-0x0000000074AF3000-memory.dmp

Download

memory/4484-20-0x0000000074AE0000-0x000000007529C000-memory.dmp

Download

memory/4484-13-0x0000000074AE0000-0x000000007529C000-memory.dmp

Download

memory/4484-12-0x0000000074AF2000-0x0000000074AF3000-memory.dmp

Download

memory/4484-11-0x0000000009280000-0x0000000009466000-memory.dmp

Download

memory/4484-10-0x0000000005BC0000-0x0000000005C52000-memory.dmp

Download

memory/4484-9-0x0000000005F60000-0x000000000651A000-memory.dmp

Download

memory/4484-8-0x0000000074AE0000-0x000000007529C000-memory.dmp

Download

memory/4484-7-0x0000000074AE0000-0x000000007529C000-memory.dmp

Download

memory/4484-6-0x00000000056B0000-0x000000000571E000-memory.dmp

Download

memory/4484-5-0x0000000074AE0000-0x000000007529C000-memory.dmp

Download

memory/4484-4-0x0000000005460000-0x00000000055B2000-memory.dmp

Download

memory/4484-3-0x0000000074AE0000-0x000000007529C000-memory.dmp

Download

memory/4484-2-0x0000000002C50000-0x0000000002C5E000-memory.dmp

Download

memory/4484-1-0x0000000001330000-0x0000000001338000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads