d00c2da240fd75af43ce0fa7e063d890e14c361d095e92c09a033955274b74ed

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_5a290ac11e99ca72cad108a06d975428_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 3.7MB
Sample261002-redlyasths
SHA256 d00c2da240fd75af43ce0fa7e063d890e14c361d095e92c09a033955274b74ed
MD5 5a290ac11e99ca72cad108a06d975428
SHA1 575d1e9053e0b78d3f73f9138f4cae5d159c5cd3
SHA512 0ce4e41ba5b0f6b5f58ad710e084becfab31a26d1c8319ce18e3a124e41a624f5934f285cb39df4848f52f9b91adf2bcc19e4dc77719143028721006967d5a8f
SSDEEP 49152:c37WzvyUv6M/QLxuekbtJkGYYZTk+T1iH7efPoV8D7C3:07SpSuSM6efPoGU
TLSH
T1D006C04AFBC6A677C47E053584666314A3B0B4464B63CBAF6AE07B3D1D323D06E253C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 3 IoCs

flow	pid	Process
8	4672	dfsvc.exe
8	4672	dfsvc.exe
8	4672	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
4652	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\K78Z20KA.1ZM\73Q4YX7M.T4L\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-01_5a290ac11e99ca72cad108a06d975428_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-01_5a290ac11e99ca72cad108a06d975428_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_5a290ac11e99ca72cad108a06d975428_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_2ea1bc8fddfd7b85\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_2ea1bc8fddfd7b85\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_2ea1bc8fddfd7b85\appid = 68747470733a2f2f737570706f72742e6c696e6b74656368732e6e65742f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\DigestValue = 814099c577c446e8a8121c2d30809d3f4aa73b15	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_2ea1bc8fddfd7b85\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d0 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_2ea1bc8fddfd7b85\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3 = 01	dfsvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\OnlineAppQuotaUsageEstimate = "6339225"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0006_2ea1bc8fddfd7b85\PreparedForExecution = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 30000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_8a159e29746d92cd	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b\implication!scre..tion_0000000000000000_001a.0006_8a = 68747470733a2f2f737570706f72742e6c696e6b74656368732e6e65742f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\Files\ScreenConnect.WindowsClient.exe.config_f7 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\SizeOfStronglyNamedComponent = f332190000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_2ea1bc8fddfd7b85\SubstructureCreated = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\lock!0a000000d5a6590e4012000054160000000000000000000 = 30303030313234302c30316464353237373332346439333866	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b\lock!02000000bfa7590e2c1200006c160000000000000000000 = 30303030313232632c30316464353237373337396239653336	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_2ea1bc8fddfd7b85\lock!11000000d5a6590e4012000054160000000000000000000032d0 = 30303030313234302c30316464353237373332346439333866	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4\lock!0e000000bfa7590e2c1200006c160000000000000000000 = 30303030313232632c30316464353237373337396239653336	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669\lock!1a000000cfa7590e2c1200006c160000000000000000000 = 30303030313232632c30316464353237373337396239653336	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0006_2ea1bc8fddfd7b85\HasRunBefore = 01	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "P3KXR7PGRMZ9T4CEQWD58DG8"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b\SizeOfStronglyNamedComponent = 449b010000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\Files\ScreenConnect.WindowsFileManager.exe.conf = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b\lock!04000000d5a6590e4012000054160000000000000000000 = 30303030313234302c30316464353237373332346439333866	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d\SizeOfStronglyNamedComponent = 1f000a0000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 680074007400700073003a002f002f0073007500700070006f00720074002e006c0069006e006b00740065006300680073002e006e00650074002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006d0061006e00690066006500730074000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 460061006c00730065000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4\lock!1c000000cfa7590e2c1200006c160000000000000000000 = 30303030313232632c30316464353237373337396239653336	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_2ea1bc8fddfd7b85	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_8a159e29746d92cd\scre...exe_0000000000000000_001a.0006_none_5d04069fb = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\Files\ScreenConnect.WindowsBackstageShell.exe_8 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_2ea1bc8fddfd7b85\scre...exe_0000000000000000_001a.0006_none_5d04069fb = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0006_2ea1bc8fddfd7b85	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 32003000320036002f00310030002f00300032002000310034003a00300036003a00320037000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_0000000000000000_57051d5779c6eb7e\LastRunVersion = 68747470733a2f2f737570706f72742e6c696e6b74656368732e6e65742f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\lock!08000000bfa7590e2c1200006c160000000000000000000 = 30303030313232632c30316464353237373337396239653336	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\implication!scre..tion_0000000000000000_001a.0006_8a = 68747470733a2f2f737570706f72742e6c696e6b74656368732e6e65742f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\K78Z20KA.1ZM\73Q4YX7M.T4L\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\0YZPKD4K.C1R\6L98M3OC.XHL\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	484	2026-10-01_5a290ac11e99ca72cad108a06d975428_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	4672	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 4672	484	2026-10-01_5a290ac11e99ca72cad108a06d975428_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	90
PID 4672 wrote to memory of 4652	4672	dfsvc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-10-01_5a290ac11e99ca72cad108a06d975428_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_5a290ac11e99ca72cad108a06d975428_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:484
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Users\Admin\AppData\Local\Apps\2.0\0YZPKD4K.C1R\6L98M3OC.XHL\scre..tion_0000000000000000_001a.0006_2ea1bc8fddfd7b85\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\0YZPKD4K.C1R\6L98M3OC.XHL\scre..tion_0000000000000000_001a.0006_2ea1bc8fddfd7b85\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:4652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\0YZPKD4K.C1R\6L98M3OC.XHL\manifests\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e.cdf-ms
Size 14KB
SHA256 5b281a58e49a0a53058bccac7fed01a72509a2019ff9996dc983e4bd9261cd7f
MD5 3915ea2c1e1dcb21cde2b07d2afda93d
SHA1 cff6371d9b74e554f5474b35def3169b555cd207
SHA512 798119bb8233166aff539925e9d8d140c3d5532983689d6b0d825976ec1e08ba2020d8caee6571aba9c975b8cdf892dcc5b553b85b0481c7f687804fa4b7997a
SSDEEP 192:F33wHfSOD2yY6ZynXIrhrOr7hNrc8WYf67gqj4:FQXNzZnRu91E4
TLSH
T166627301B7D6E822E2502773DCDAC3D47232BDE55F56135B30843B2EAD712D98A23696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\0YZPKD4K.C1R\6L98M3OC.XHL\manifests\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669.cdf-ms
Size 3KB
SHA256 983467911bea24c43cb458e849e6362f9203a79bd595869cfa5ffe78b6303bb7
MD5 ce14e4384d39096bc85c4e12c659d17f
SHA1 80bce8cb43de806ffa64a9d103e26a7cb1d20168
SHA512 7a57c1f0cc34c9094029decbc9fdd556a6404e5c7559bb26918906433eb90ab0366eb64ca584a07ced6bd8a69685c9a3a620f569a36138e7644ff4b8a853d04d
TLSH
T1B061A902B284DE17D9690633ACD6D7EE27357E83DE42830B74C4BF2F7A721E552121A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\0YZPKD4K.C1R\6L98M3OC.XHL\manifests\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669.manifest
Size 1KB
SHA256 5bef6c316992b20a446529d90cf9eacd76882ae8c8ccbb5a48e082255a714589
MD5 f0d61fa6e938195134f7a6b8bcde1d0b
SHA1 9e9385362ebc6e63990b8b09742b12de51364550
SHA512 7d73511dc473509a01e816530d13425b2beb0e5f02caaa7310e8293fda5f7f88b4b76393d2251e10245e1a61bc4dd7ccc592835c905ef95b89e2055e18cd8eb6
TLSH
T189216A0181C8FA261F3302D2BDE7E42197AE5B33148D194B7069689FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\0YZPKD4K.C1R\6L98M3OC.XHL\manifests\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999.cdf-ms
Size 5KB
SHA256 6a9d93653253d5fdf54b5e7c60e13ca4d7c490ad78fc50f6e551ef3c512cf505
MD5 43c3d196196e3221731ec9806d529dbd
SHA1 3d61452247205d2144af555fe761e42db084b31d
SHA512 a8b419730d304d21eb43fc3b2cb4f4c3d0323d9701ccffb1f948104cc6ac7b9a0e145c8d2c29112fcf325f3c5a00ff1e457587a9831bb6de2744286c64343ea1
SSDEEP 96:UBW+RzgtheV+Ww7OLFIiJ7m2kFAmJJ/8bdr2wimdR:URzgkJfaiJXxYoGe
TLSH
T15EB1AA11B294DA17D5B802339C9AC3EC2B75BD82DE43070B70D4BF2FBA336D65222195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\0YZPKD4K.C1R\6L98M3OC.XHL\manifests\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999.manifest
Size 1KB
SHA256 69469980fdc8b3c31191ec79ab23efe0803f49bc3d27d73637ffed5beda29765
MD5 963bb2ae3f64f0fb46e388b361350539
SHA1 e6b47be9925bed2bb0f07a6b0e92e86fe7acd4e1
SHA512 da84be8c06310d47aa63b393076b1e124165782cf2488c9d668fd67d0e0289c3d50c4517d576c9d74ca53b8748193c7a0a121add3c679c6896bf89a6562f71b5
TLSH
T16041F11181C8FA250F3302D2BEEBE431979E5733158E194B7099AD8BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\0YZPKD4K.C1R\6L98M3OC.XHL\manifests\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976.cdf-ms
Size 7KB
SHA256 43d7dd3761b44f2e5f2097d7440853033aae04c5e2fdf739390ba6c1a19754c8
MD5 021d81581061d772ccc3800151ac7724
SHA1 7bbeadbfa2552b5a57688b63aab3ee569ec05c75
SHA512 2739fd19adda29b63356ccffd52b67c758d0b49235d7431800aaa2ef9f75e4bfd3f971ce1f8ccce472f0bbd1fa59f05a5749e57a207c5ad848d08db9e18d1b41
SSDEEP 96:5OONY6gnxfq4qFeV+WwwOL5868Tz8WUM+eKXQ6n9vl2wlumSlksVGvYy:YvnJDqaJ4l8TzQM+eKXB2Viz
TLSH
T1F1F1CC02B281E967D5B80A339C96C3ED76747E86DE43160B70C4BF2F7A762E62312195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\0YZPKD4K.C1R\6L98M3OC.XHL\manifests\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976.manifest
Size 2KB
SHA256 996eb91b8f7546a582d532ad83a708588f609c816015ebd84c567c86ee558691
MD5 f1e58ca6c858d80aa38c823d6d018bbc
SHA1 5af4bc04d78609ec78207a909cb8bf703f6b82e9
SHA512 f9bcb306e12a165ed5d4b05f56b79e77934a04bbb6ef1e8fc795be2eca263623dee418703445bcdf4b54d08bd62c4f9b71d3ba5e1d256765908ce16d62d1eb19
TLSH
T12651071551C4FA310F7302D1BDEBE070979E4B32158E194B7099998FCF2DA97478B027
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\0YZPKD4K.C1R\6L98M3OC.XHL\manifests\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d.cdf-ms
Size 2KB
SHA256 c28e6efac8e5fb437f62967b5cff174006e60896d98ff86cbd4c7d7c0da0efb0
MD5 990daedd69059077e821dd453efcbb21
SHA1 c34271335266116e5dce09e5fcacc70eeda444cb
SHA512 a7fdac71f43017a169c32e2bc5061a615268f6e7768a7405c08acbfd4e0eb94760d9690f7073472e4469c07d81fb26dc50f437d02901f059f8f6dfb955a5edcc
TLSH
T1555179057684EA67E57A0233EC92D2D932757E82EF470317B1C0BB7F3A726C55612096
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\0YZPKD4K.C1R\6L98M3OC.XHL\manifests\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d.manifest
Size 1KB
SHA256 8929cfa8bbea4aa718881c3a63e629417df02a709acc8528bf7b8ba18c3ca06c
MD5 019356a9dbbfd64a3b4053b525c82b1b
SHA1 94c617d66698691ac8c48b91b16edf6c4f2a2500
SHA512 4bca960c60f45896defda926e0de61a7c944a0271f5d7587ed26be93f4ba0cbac970aeaf6e8102ba2cdff5a12c20445221de03a4d307f28d963a5c2ef51cde65
TLSH
T16B117B0191C8FA361F3341D1BEE7E420676D5B33058E194BB06A689F8B29AD743470B3
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\0YZPKD4K.C1R\6L98M3OC.XHL\manifests\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b.cdf-ms
Size 4KB
SHA256 935bb0feed444e4d5e5a7841025b3b3c5045e6be2c5dd179e9d7c51cbbc34913
MD5 9ac70a22efee80254943592ebd9e0abe
SHA1 120a49bfb7df6438ac1ed092470e25c00f9c21e7
SHA512 3c0aa575ad1326e8862441646ae73ab45f996e5038682dba7eaae0a9363facd59dfa02a751af93e6f8b601e962b26a56f7a9adaaa7cba62d683b41a00f968b60
SSDEEP 48:XDP/mrIIAqzIvrHXgERu9o0m5RD7J2U7gFUTUETkXhf4sQgbmZFms4Ch+UQRcy:X7OUWGnEW0m5R/cUmIkX9QPfmvVUQRr
TLSH
T1B3912E81B740E833E61447329CE3D2D03235BDA64FD7971B70987B2FAE367C59622266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\0YZPKD4K.C1R\6L98M3OC.XHL\manifests\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4.cdf-ms
Size 4KB
SHA256 556c2d09a1cc62a3f0d637f389e157cb58521e24208975c723911fd0dc8b7481
MD5 1c6eb97a531f8f139b6a9fc5ed8424bf
SHA1 ed15f07d218578af696d8af5d78dd6c0c0328642
SHA512 9ea18f78e26cff1a866665ddf1a8b99319927887fa84eaaa76486b8578e22462d0272e265859dd94b73c799a66b36ba2caf30190d22c9006f55a2282dac0a580
SSDEEP 96:BQItRqeV+Ww8OL54coOJQyZBGjiKFkyFc6C:7lJoToOBtV
TLSH
T175A19701B280ED67D6A90633EC96C3DD2A727D82DE03070B71C4BF2F7A726D65326096
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\0YZPKD4K.C1R\6L98M3OC.XHL\manifests\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4.manifest
Size 1KB
SHA256 c39d1fc54f7937e8b62fc70bdaf42e165b1fe4a19c54f84e8cf9d922b2de6c48
MD5 a10c6c6900ef5832dfcf74c2b49f8d10
SHA1 df5de264304a3f83b9fbac0279743397dcb0ed72
SHA512 c70b3cb7f21a70a8d59b016e286a6670e23f3c9db9e3757ac687f679c15fa380b9a6ffa025035552f164c03925dbe2681a8fee006276ef99f750fce37b0648fe
TLSH
T1DE31261591C8FA350F7302D1BDE7E0305B9D5B32158E194BB05AA99FCF29A97434B073
MD5 SHA1 SHA512 TLSH

Submit Download

1od4lpkj.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\0YZPKD4K.C1R\6L98M3OC.XHL\scre..tion_0000000000000000_001a.0006_2ea1bc8fddfd7b85\1od4lpkj.newcfg
Size 667B
SHA256 742afef55b9ab73057a5628008b9488d921d74632f2e0efb23d5165d84e1df9c
MD5 504a4cdffd4eeeaa32e5cd52e3d62b18
SHA1 f44642065e223952aa88bfbc79289c0eb9b04288
SHA512 0fea5975ba63ba1be6c06fc22fcbf3e95846bbf4fdf83723757c85181048d889c314a65294c18f0d40fd9ce8efdf82479996d2d5a2a5ee9a72f1a119bc8951b0
TLSH
T13A01286571C4BE9B02736E32D6228781EE715A5B05A160D874AE223B9F305DF07A32DA
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\0YZPKD4K.C1R\6L98M3OC.XHL\scre..tion_0000000000000000_001a.0006_2ea1bc8fddfd7b85\app.config
Size 1KB
SHA256 01bbfc6c3123b2a408602d7c12fbaba90fc92731135455c257e8b0e58da21204
MD5 59099b7c84c7405d2e07c9f499f9981d
SHA1 fb133a43298c0716929773be3fb897a260be6ff8
SHA512 6547d6e6cb8c193343fc4e1ad54a0787310673f20d06710f159ff370eeeb2679986ad85bf0b01623440d895c6212f3bde66126de32e205a2026aeae375853031
TLSH
T18F31E70D71D4AFA982A65672F6317681EC70792300E6A0E534EE31231F70ED70AB76A6
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\0YZPKD4K.C1R\6L98M3OC.XHL\scre..tion_0000000000000000_001a.0006_2ea1bc8fddfd7b85\user.config
Size 520B
SHA256 a63431efae430c392210eeccf6b4785cdca8f6b5d3e93a0b7a98d9202785b842
MD5 f5b7e450d88b99e1045c204fb54081d4
SHA1 028dc91ae6d9bb59906b069073ace76d96f8b25d
SHA512 3b8016ccfdb3824e4775a82e212837d65af1e7afd3c5a1d1e7d54becfc2d7e3bbe8ad5c25e44f44cd5e45d91eb584bd4ced7945e6373f2ee7a8ddb01537bb21d
TLSH
T1B8F0E9A131807D5707635E23C5124741EE72569B0551209874AF623A5F315CE03A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\K78Z20KA.1ZM\73Q4YX7M.T4L\ScreenConnect.Client.dll
Size 636KB
SHA256 d36e154e3b5b677642c3fe051a549a5f46ede0110a10d0e74845e393373abddd
MD5 05798efabae3c98e61270ce204bb2ee9
SHA1 e8a1d752916eaa86f3d58a11b14e6d07de2c66f8
SHA512 922995f79a1a2f8323a0c79273d17ee9e51b053c7f780a4c1e3739c6d9be76169289016bfbaf38f7f378e40710aeab33c16ff0e310c82da24e759eea2d9c1d26
SSDEEP 12288:W4/aH/qxxC/zHTEavSW7OQniuyu8RHreg:v/c/q/izEn8qul8RR
TLSH
T115D4D08DEB94B92AD9AF0773F1613619AAF06CD6885BD30F1D28767C4D713843A5C2C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\K78Z20KA.1ZM\73Q4YX7M.T4L\ScreenConnect.ClientService.dll
Size 188KB
SHA256 9a05b9925da7b29c6f24f806ae4cf2500d18d31a905b8e926622760e46e9c0f1
MD5 4df2863f5d14d2504ee3e1cb41f2e920
SHA1 4b3c74bb2c2b8e030612cc6b7952b5b63387b0b2
SHA512 7924fb651ead53a562e770140eb14f2f5e5aa4d38e6d01c92eb6f6a4801ccd635702084598c03f02f43bfa7da8fa97f7a1e11ecd11db42c7cf7d7151f8a1af8d
SSDEEP 3072:1as9p5nhzF7C9a+S6fg5ClMJEbPR1tV8NiMd+DHQvVHeDkVHE:vp5t+S6IUMEb51ui5HTwW
TLSH
T1D614AF48BB5AD936C59F0A3BA451B22006F1A443D9E3C78FACD872DE1E163D52F543CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\K78Z20KA.1ZM\73Q4YX7M.T4L\ScreenConnect.ClientService.exe
Size 93KB
SHA256 943089436b7648644937dd53b4d1a6a0ad12a10585eda3241cbe524f7f544914
MD5 2575df30c19035276786163b4ad0ca1a
SHA1 3cc685d1fe1e726cb3fd585577f1afdb76dfc17b
SHA512 92b0624f7f4f7460427ddac84311ac240b94bfc9e58ed42ea6f99f3f409fe1a35018e22d2b38099b9187f88cc2fbf12b985ee51c98da9e44020d48936e6b7a6e
SSDEEP 1536:gg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoU0HMB7U:JhbNDxZGXfdHrX7rAc6myJkgoU0HkQ
TLSH
T1AC935B13B5C28871D473193158E0DAB09A7FF9215E21DEAB3788022E4F742C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\K78Z20KA.1ZM\73Q4YX7M.T4L\ScreenConnect.Core.dll
Size 1.3MB
SHA256 041163eb04d9a392f2a7747da3b03ff83369876c43fbc8980ae5a1ccd4cbaad2
MD5 83baf842579d941db433905ff568eae4
SHA1 79034406fb413d6bbbf7d77fb7c0b2c37202fc3a
SHA512 a9da91485e46ca530407597ce15714087db6551e808fcff982c92c99abbc5dd5ebbe659915600927fbec94d63ae9415003a76dc9f14ac8c1cb3bd1509b6946ed
SSDEEP 24576:eRitn37WwOMxzCU/KbsQ/bjyUvPC1EV/QLuug:337WzvyUv6M/QLxg
TLSH
T1D6558D4FBB99AA27C9BD093340505204A3F0E0D75B67DB1B39F0AB3D5D593A86E482CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\K78Z20KA.1ZM\73Q4YX7M.T4L\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 2992232db7e7272f7fbf971168ef8910bfabbe7a353e86311c6a18f9903e4a24
MD5 c5142af6023345e1df2883326f7d0b63
SHA1 5927d19820a40ddd05b8cbd80e1b3dab49d6cd49
SHA512 b0b59d3aa4064b565b22e54c820c11a7d8444a43aabf928a7e2964b7859c29bae217d98f4650794074d290233ddb317a634b012206c080132cbbdcd29bbb6596
SSDEEP 24576:/2f2beLbtFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfK0:uekbtJkGYYZTk+T1iH7efPoVU
TLSH
T17095AD45E6C365FAD46F043888BE632AA7743C040355CBFB97D4AA3A2D337C09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\K78Z20KA.1ZM\73Q4YX7M.T4L\ScreenConnect.WindowsBackstageShell.exe
Size 136KB
SHA256 ee0f315664f3361ca8e8f202f910baea2895481506f3bb2659d17c8967db64b3
MD5 835a313bfd4abc9fa4aef1d281357f82
SHA1 d10fcd9047b094d048049dda07790c9e4feae3ac
SHA512 7c3b1211e47cc72aff5d62403765f07c4130afb72e3cca6b3ac8fcf3a35d3c536ded091c0e6293f60f596b15fbd92d35917515778df61a8f69cf1d8bb8899cb0
SSDEEP 3072:6+O/cywOnOQaioWtA6gZHVDLCKcJxfRzQN:0/wOza/WtAPZJCNjf4
TLSH
T122D3AE807798D925D9AF0E3BA4A1B32006F1F097CAE3C7476C98267E6F25BC16F542C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\K78Z20KA.1ZM\73Q4YX7M.T4L\ScreenConnect.WindowsClient.exe
Size 1.6MB
SHA256 b88b3e3b57f2d0274e16fbb67cd6b77d5c8b32eedde39c47ebc9fa4ef160500e
MD5 2f493a04ccb0545b79875f15a9e6d2f9
SHA1 1f03c9fb4538a42a50cc555b849fbb7950b8b17d
SHA512 f61893acf63849833dda2f2bc806d7779730457f55be4313d146d5035b5f7b88ad7cb8b61d869c13b793573288190da5653c24f0707234ca40d85dcd08697685
SSDEEP 24576:Fp5otlId86KGiOy2cxo7ZepaqaL3d9GtnP9+/qr40DThuNoqqmF:FpO+8u+AkDaou
TLSH
T1F1759D8D7F95EF67C92E077794A12201A7F084948F63EB076890B73E1C893947E489DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\K78Z20KA.1ZM\73Q4YX7M.T4L\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 56e63aa2b20df91140067ee5198f44308d4396a78970412c2f65e04686ea9311
MD5 190b3b98c72f43f5121c5e09a6d2efcb
SHA1 814099c577c446e8a8121c2d30809d3f4aa73b15
SHA512 288bd0e90cce82929af745dd7b8016776acb5bb9bb40acc2dfcac68fd6ea9bb45a5815b160f2a519579cb91a9d4d7f9c2b84e7608970333ace7863bc4a58a998
SSDEEP 96:xWLwOhoyTqUe2wvyfkskjNkL7akzk6qkiDykSJ4kOpQkOp/knAkOpD:oRpeT5jOL7zY8iD7o9UFUMnVUD
TLSH
T1A0F1BC9684C0BD21573281C0FEE39914BD157F2302AE148EBD4D19AF9FB25899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\K78Z20KA.1ZM\73Q4YX7M.T4L\ScreenConnect.WindowsFileManager.exe
Size 120KB
SHA256 3e89c58b3a1c6ced8208602665cf0f85601c686c6d1d5bf95c3760648f02984c
MD5 603013abfe4f61722bdd0a7c95a7b52c
SHA1 9517c4c974bf64dea1130631c8b4db1dcf33f122
SHA512 b5ecba418ea266dd049e0d56d32a730424d2e87378d097dc7cde0334f63671b98327dddb2031d9987e58fd5fb4375b092fdfd3003400caa816b7bd7872aa3445
SSDEEP 1536:OsgYi2XAsTWmce3hMxHE/HMpLwEc3RI5BLP+VVVVVVVVVVVVVVVVVVVVVVVVVSgX:Osgswsoe32xHEPMpLuuBLNhx+
TLSH
T1BCC33A5135266135EE89C433A052E97199337F6607FEC6BE2CA1BA3A38F13543E89D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\K78Z20KA.1ZM\73Q4YX7M.T4L\ScreenConnect.WindowsFileManager.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

NZZL9DYO.C2P.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YX1EQ3GY.GVJ\NZZL9DYO.C2P.application
Size 98KB
SHA256 0c21a420d6af0401b958d20f464b97b3fbe06a9008c47d9593d688dc2355456e
MD5 df19cbdaee513c4ebc7b1f2549139a5b
SHA1 c79ac53c6a860f78a82a06f8c908ad19fa549e1f
SHA512 ef042a4aa4ffbf0d0dfc1a8ee57a7d7dfb1fe1ebddb5cb095929fa73d4dc6132925da4c321ea0dbd036518d6a0d2dfc6959f9aceaf9da45a26f84ee1bcb4a1d5
SSDEEP 1536:N/mK+zuLD4UABnjRnfduUW5Ab4KpSE5GP/uLTvooycupKQ/IuKE:N/UuuBn1nfdvg2XOcupX1
TLSH
T143A3613ACE30F4C0477DB021D1A92D673D811B93DB730BACD90A196B0E69796EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/484-6-0x0000000074C20000-0x00000000753DC000-memory.dmp

Download

memory/484-9-0x00000000060D0000-0x000000000668A000-memory.dmp

Download

memory/484-3-0x0000000002C20000-0x0000000002C30000-memory.dmp

Download

memory/484-0-0x0000000074C32000-0x0000000074C33000-memory.dmp

Download

memory/484-4-0x0000000074C20000-0x00000000753DC000-memory.dmp

Download

memory/484-5-0x0000000005430000-0x0000000005580000-memory.dmp

Download

memory/484-7-0x0000000005810000-0x000000000587A000-memory.dmp

Download

memory/484-16-0x0000000074C20000-0x00000000753DC000-memory.dmp

Download

memory/484-8-0x0000000074C20000-0x00000000753DC000-memory.dmp

Download

memory/484-1-0x0000000002C00000-0x0000000002C08000-memory.dmp

Download

memory/484-10-0x0000000005C10000-0x0000000005CA2000-memory.dmp

Download

memory/484-20-0x0000000074C20000-0x00000000753DC000-memory.dmp

Download

memory/484-11-0x0000000074C20000-0x00000000753DC000-memory.dmp

Download

memory/484-2-0x0000000074C20000-0x00000000753DC000-memory.dmp

Download

memory/484-12-0x0000000074C32000-0x0000000074C33000-memory.dmp

Download

memory/484-13-0x00000000093F0000-0x00000000095D6000-memory.dmp

Download

memory/4652-290-0x0000000000F80000-0x0000000001114000-memory.dmp

Download

memory/4672-21-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/4672-15-0x0000020540880000-0x0000020540A08000-memory.dmp

Download

memory/4672-17-0x00007FFDE1C8F000-0x00007FFDE1C90000-memory.dmp

Download

memory/4672-14-0x00000205261A0000-0x00000205261A8000-memory.dmp

Download

memory/4672-70-0x0000020545260000-0x00000205453B0000-memory.dmp

Download

memory/4672-18-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/4672-64-0x0000020542C10000-0x0000020542C42000-memory.dmp

Download

memory/4672-19-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/4672-58-0x00000205453A0000-0x0000020545586000-memory.dmp

Download

memory/4672-52-0x0000020545070000-0x0000020545112000-memory.dmp

Download

memory/4672-23-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/4672-46-0x0000020545300000-0x0000020545494000-memory.dmp

Download

memory/4672-22-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/4672-36-0x0000020542A80000-0x0000020542AD0000-memory.dmp

Download

memory/4672-27-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/4672-26-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/4672-25-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/4672-24-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/4672-320-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

memory/4672-321-0x00007FFDE1B00000-0x00007FFDE24A4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads