d40fdd9ac6857a45424f98b0159ca6d995cbc7503e87fc7a2a09c1ae5d8c88d9

Analysis

max time kernel
149s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-13_217358385e33ed2a5b7ec8cc0c25eaf9_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 3.7MB
Sample261015-wqjpjsdf56
SHA256 d40fdd9ac6857a45424f98b0159ca6d995cbc7503e87fc7a2a09c1ae5d8c88d9
MD5 217358385e33ed2a5b7ec8cc0c25eaf9
SHA1 0ed1aff4913ae7ad2bb9baef14ca4a8ba6bfb2cf
SHA512 b13e808265b41c2fa00656d6d79c4f2388caf5c9efe512b23eaa254cb806c32e21d48d3ca10cb7d00329e47897bac8de04af2cfe0e73005ac980de1e7de6438c
SSDEEP 49152:J37WzvyUv6M/QLxuekbtJkGYYZTk+T1iH7efPoV8D7bC:B7SpSuSM6efPoGa
TLSH
T1A806C04AFBC6A677C47E053584666314A3B0B4464B63CBAF6AE07B3D1D323D06E253C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
11	4488	dfsvc.exe
11	4488	dfsvc.exe
11	4488	dfsvc.exe
11	4488	dfsvc.exe
11	4488	dfsvc.exe
11	4488	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
1264	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\L8KEBRZ2.ZDT\XQD9MLB5.PA0\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-13_217358385e33ed2a5b7ec8cc0c25eaf9_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-13_217358385e33ed2a5b7ec8cc0c25eaf9_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-13_217358385e33ed2a5b7ec8cc0c25eaf9_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b\implication!scre..tion_0000000000000000_001a.0006_6c = 68747470733a2f2f68656c702e6b656d70657274632e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_10af0fcf8a88c333\lock!110000007d785a0e88110000080a000000000000000000007202 = 30303030313138382c30316464356364303134333539636162	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_6c22f16920f8da7b\scre...exe_0000000000000000_001a.0006_none_5d04069fb	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\Files\ScreenConnect.WindowsClient.exe.config_f7 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\DigestValue = 5927d19820a40ddd05b8cbd80e1b3dab49d6cd49	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0006_10af0fcf8a88c333\identity = 68747470733a2f2f68656c702e6b656d70657274632e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_769cde8786b239b4\LastRunVersion = 68747470733a2f2f68656c702e6b656d70657274632e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\NonCanonicalData	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_10af0fcf8a88c333	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669\SizeOfStronglyNamedComponent = 73e0140000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\lock!0100000054775a0e88110000080a0000000000000000000 = 30303030313138382c30316464356364303134333539636162	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\implication!scre..tion_0000000000000000_001a.0006_6c = 68747470733a2f2f68656c702e6b656d70657274632e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\lock!04000000b5795a0ef0040000400b0000000000000000000 = 30303030303466302c30316464356364303162396661656366	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_0000000000000 = 68747470733a2f2f68656c702e6b656d70657274632e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_6c22f16920f8da7b	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_6c22f16920f8da7b\appid = 68747470733a2f2f68656c702e6b656d70657274632e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 54007200750065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\Files\ScreenConnect.WindowsBackstageShell.exe_8 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b\lock!040000005e785a0e88110000080a0000000000000000000 = 30303030313138382c30316464356364303134333539636162	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_0000000000000000_57051d5779c6eb7e	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_10af0fcf8a88c333\appid = 68747470733a2f2f68656c702e6b656d70657274632e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_10af0fcf8a88c333\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d\implication!scre..tion_0000000000000000_001a.0006_6c = 68747470733a2f2f68656c702e6b656d70657274632e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b\SizeOfStronglyNamedComponent = c82c020000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_10af0fcf8a88c333	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_10af0fcf8a88c333\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 68747470733a2f2f68656c702e6b656d70657274632e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669\Files\ScreenConnect.Core.dll_b96889d378047e27 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_10af0fcf8a88c333\implication!scre..tion_0000000000000000_001a.0006_6c22f16 = 68747470733a2f2f68656c702e6b656d70657274632e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\DigestValue = 814099c577c446e8a8121c2d30809d3f4aa73b15	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_10af0fcf8a88c333\scre..ient_420d02d3849b7992_001a.0006_none_98b7888ed	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\Files	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Apps\2.0\C0N459ZR.W7O\PO3KYC2Z.H39\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\L8KEBRZ2.ZDT\XQD9MLB5.PA0\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	252	2026-10-13_217358385e33ed2a5b7ec8cc0c25eaf9_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	4488	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 252 wrote to memory of 4488	252	2026-10-13_217358385e33ed2a5b7ec8cc0c25eaf9_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	91
PID 4488 wrote to memory of 1264	4488	dfsvc.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-10-13_217358385e33ed2a5b7ec8cc0c25eaf9_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-13_217358385e33ed2a5b7ec8cc0c25eaf9_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:252
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Users\Admin\AppData\Local\Apps\2.0\C0N459ZR.W7O\PO3KYC2Z.H39\scre..tion_0000000000000000_001a.0006_10af0fcf8a88c333\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\C0N459ZR.W7O\PO3KYC2Z.H39\scre..tion_0000000000000000_001a.0006_10af0fcf8a88c333\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\C0N459ZR.W7O\PO3KYC2Z.H39\manifests\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e.cdf-ms
Size 14KB
SHA256 a85d7fbb0b14f7f4c6728ad66da7bc7b6baf283ddf6c110dd5f919941995012d
MD5 385c016f5d6958fc61fce85fb461b267
SHA1 03d0b0c65209b845f2af3867d7cdba6b2b778cd9
SHA512 1a716219f60669408a16386830cc7fd1f3cd73d8464bb03398ccd4d818419988e3acce04d0fc45e0948a6627242a37c45ab7c537e55adc013ebd0ad213904476
SSDEEP 192:d33wHfSODyWV6ZyfNE0j1fPwoMzlY8LrF7vhmRf8dyHD+ryFtTz6NnonCXcP4:dQXVwZ2e0pPHM/75m1ntgj64
TLSH
T1EF62E522B758F433E1629B779CBAE6D167147EA91DA21187B0803B3D9C3109ACF353D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\C0N459ZR.W7O\PO3KYC2Z.H39\manifests\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669.cdf-ms
Size 3KB
SHA256 b11de4efa4d708576a4ca8d5e972ef39048d30188dfd71dd1a60fddaf91c9183
MD5 de12952dd12b031648b2055bdc311e94
SHA1 6b7fbf3f4d5fc540022b421ca8486d07787603fe
SHA512 c9fbc9c297467c4048b6d47b9ac2d35aa244be844824bac7dc97af75aedb4e38ab38a55a7a510565a670a1f2b597522733536f1e5851fcd3e3f641f615d9cbf7
TLSH
T16F61DA017644EA13D9690633ACD6C2ED33747E83DF42920B74C0BB2F7A722F596222A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\C0N459ZR.W7O\PO3KYC2Z.H39\manifests\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669.manifest
Size 1KB
SHA256 5bef6c316992b20a446529d90cf9eacd76882ae8c8ccbb5a48e082255a714589
MD5 f0d61fa6e938195134f7a6b8bcde1d0b
SHA1 9e9385362ebc6e63990b8b09742b12de51364550
SHA512 7d73511dc473509a01e816530d13425b2beb0e5f02caaa7310e8293fda5f7f88b4b76393d2251e10245e1a61bc4dd7ccc592835c905ef95b89e2055e18cd8eb6
TLSH
T189216A0181C8FA261F3302D2BDE7E42197AE5B33148D194B7069689FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\C0N459ZR.W7O\PO3KYC2Z.H39\manifests\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999.cdf-ms
Size 5KB
SHA256 deedf323a743d44957ccab1f685ee1d5b596dcda5f37db2a0cd4b6ca5e951d1e
MD5 8e032c17aae568c2d8a1f9b6cc4f54db
SHA1 5376d268bd445de1d71abb9acd727f716a919f66
SHA512 d7cdd8bffcc2dc490dec19cd0de225b642f5858c743f396f167ee6d03e4c7081620d854386d48d55101bfc2ad9c0270cf1713bc58e140a2e73271f14fb7b67a0
SSDEEP 96:RBW+RzgtheV+Ww7OLFIuOQlVXXezoZpvijwimdR:pRzgkJfauNB6/e
TLSH
T1E4B132117290DD1BD5B90633ACA6C3ED2B36BE92DE43030B70D4BB1FBA326D65222195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\C0N459ZR.W7O\PO3KYC2Z.H39\manifests\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999.manifest
Size 1KB
SHA256 69469980fdc8b3c31191ec79ab23efe0803f49bc3d27d73637ffed5beda29765
MD5 963bb2ae3f64f0fb46e388b361350539
SHA1 e6b47be9925bed2bb0f07a6b0e92e86fe7acd4e1
SHA512 da84be8c06310d47aa63b393076b1e124165782cf2488c9d668fd67d0e0289c3d50c4517d576c9d74ca53b8748193c7a0a121add3c679c6896bf89a6562f71b5
TLSH
T16041F11181C8FA250F3302D2BEEBE431979E5733158E194B7099AD8BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\C0N459ZR.W7O\PO3KYC2Z.H39\manifests\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976.cdf-ms
Size 7KB
SHA256 dc74fbd97f9c50a4dfb16f02247d26f220b94e86c5b289b1a150f22c3d21e883
MD5 fa9865999ff2ba0d7e3fd84ccfd75344
SHA1 f7466477ce3b217cf32a7356f2c36c8fcf9ba516
SHA512 eb886ff2894cf03e2bf42128583b9e7f15a35a75b6102abc0a5769d875ece8570b8070e83e8bc65614c04e7462788fca85e01b8884fd9b0ab410cd02bc966ff5
SSDEEP 96:LOONY6gnxfq4qFeV+WwwOL586b/Oyng4Zj9EUuAIWTicIyQnVDksVGvYy:avnJDqaJ4lb/Oyng6j4WTLIjQz
TLSH
T125F1EF127390DA23E1B94733ACA6C3DD6B687D96DE42420B70C47B2F75321E657212E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\C0N459ZR.W7O\PO3KYC2Z.H39\manifests\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976.manifest
Size 2KB
SHA256 996eb91b8f7546a582d532ad83a708588f609c816015ebd84c567c86ee558691
MD5 f1e58ca6c858d80aa38c823d6d018bbc
SHA1 5af4bc04d78609ec78207a909cb8bf703f6b82e9
SHA512 f9bcb306e12a165ed5d4b05f56b79e77934a04bbb6ef1e8fc795be2eca263623dee418703445bcdf4b54d08bd62c4f9b71d3ba5e1d256765908ce16d62d1eb19
TLSH
T12651071551C4FA310F7302D1BDEBE070979E4B32158E194B7099998FCF2DA97478B027
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\C0N459ZR.W7O\PO3KYC2Z.H39\manifests\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d.cdf-ms
Size 2KB
SHA256 4a142b14f9cef64ccca68cc3ba602e658f8c792f79b8e8b1be46c87593c6afd8
MD5 18dbc0e93f31e43cded401be63031950
SHA1 13b9eee2accaa09b434673e3e03ffa90c1b2377e
SHA512 d114c692a30f9f4fdbea5c098aaea5eb3d0c8d842bb34194a125e55e6811abaa0cb44463a29f77756643c6798c80ae1909e67bfb6bf13fbb3f995f28d6281306
TLSH
T1C2517C293344E9E7EF6A0332FC52D2DA32A57D82DF250607B2807B6F2B72B854617195
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\C0N459ZR.W7O\PO3KYC2Z.H39\manifests\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d.manifest
Size 1KB
SHA256 8929cfa8bbea4aa718881c3a63e629417df02a709acc8528bf7b8ba18c3ca06c
MD5 019356a9dbbfd64a3b4053b525c82b1b
SHA1 94c617d66698691ac8c48b91b16edf6c4f2a2500
SHA512 4bca960c60f45896defda926e0de61a7c944a0271f5d7587ed26be93f4ba0cbac970aeaf6e8102ba2cdff5a12c20445221de03a4d307f28d963a5c2ef51cde65
TLSH
T16B117B0191C8FA361F3341D1BEE7E420676D5B33058E194BB06A689F8B29AD743470B3
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\C0N459ZR.W7O\PO3KYC2Z.H39\manifests\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b.cdf-ms
Size 4KB
SHA256 f55c2c8fca9861448dde13db2a9f3068cf0e2f85d1f7b202447792697aa65ae0
MD5 de3be93030d441622a8a60bf8a794beb
SHA1 ac697b32ce75a21b278378843a122a26413930ed
SHA512 16b05aa8c3ceba1d79c764bdd473160744c6b139ec5684a8be277575330aaae28cc315fb61fb3db221720ecb05bcccbcef6777c48ed051e37ad8303f99432b81
SSDEEP 48:GGP/mrIIAqzIvrWJgERu9o0m5RD7J2U7gFUTUETkXhf4sQgbmZFms4Ch+UQRcy:GkOUWGOEW0m5R/cUmIkX9QPfmvVUQRr
TLSH
T1E2911F81B740E833E61447329CE3D2D03235BDA64FD7971770987B2FAD367C59622266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\C0N459ZR.W7O\PO3KYC2Z.H39\manifests\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4.cdf-ms
Size 4KB
SHA256 e01b7ac145e186fa3cd3832e37105add48d04987f11c6435780995da51ae10fb
MD5 8382deb471ba90a838bfaa6d1a380a26
SHA1 a75f5ed321596f95f147ddc726a2abc82990323b
SHA512 9e8c8587bc35412cb1bcd5d6581290754d5e06a25ec647db8bcccbcfdc90c8b9be91560034bf0231ec485dd1d52c53b00e031064ff28d091695eaa3aaef56e49
SSDEEP 96:oQItRqeV+Ww8OL54cSGYHXUrI10j/X+3QkyFc6C:wlJoTSXUC0CjV
TLSH
T15BA1F0027340EA27E5A50633AC96C3ED3B787D82DE42460BB1C47F2F75726E6532619A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\C0N459ZR.W7O\PO3KYC2Z.H39\manifests\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4.manifest
Size 1KB
SHA256 c39d1fc54f7937e8b62fc70bdaf42e165b1fe4a19c54f84e8cf9d922b2de6c48
MD5 a10c6c6900ef5832dfcf74c2b49f8d10
SHA1 df5de264304a3f83b9fbac0279743397dcb0ed72
SHA512 c70b3cb7f21a70a8d59b016e286a6670e23f3c9db9e3757ac687f679c15fa380b9a6ffa025035552f164c03925dbe2681a8fee006276ef99f750fce37b0648fe
TLSH
T1DE31261591C8FA350F7302D1BDE7E0305B9D5B32158E194BB05AA99FCF29A97434B073
MD5 SHA1 SHA512 TLSH

Submit Download

p3q04lhn.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\C0N459ZR.W7O\PO3KYC2Z.H39\scre..tion_0000000000000000_001a.0006_10af0fcf8a88c333\p3q04lhn.newcfg
Size 662B
SHA256 fe5429b5adc6b2e40ebdac7d9409fa7d160427c9ffb22a9b1629c08c04cef66f
MD5 8355c03b22bcf7b0fe224b386c18a201
SHA1 de39cdd27fd7887cbbab378ba43ca7e641e72e69
SHA512 f18847dda3b51c566bdc13558d7c111ac5f44bda2a1867a9119750f68c7c346e551aa3683a15d230eb9ba61a3affe7387ec01250a160e6fda104717e051fad19
TLSH
T10001286571C0AE4B03732E32C6228741EE711A9B016620D874AE223B6F305DF03E32DE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\C0N459ZR.W7O\PO3KYC2Z.H39\scre..tion_0000000000000000_001a.0006_10af0fcf8a88c333\user.config
Size 520B
SHA256 710585b09273ec0fb49becbfabeca4cfb9480cb79b5994373c71cf7acebb8b82
MD5 0971c6728bb608b70ebd27d79d4c8925
SHA1 da1125bf59c1976e619bec138a9ff55fc9481f42
SHA512 df0b754a2e477897e7312cc5a0bc5d478cc0974dcde5e662e3b03e68c00193db701bac1352b495a675ee4a40a982f9d0231580bf4e463eb7eb95a4d7bc7f5678
TLSH
T1D6F0E9A131806D4703635E23C9114745EE72579B0555209874AF223A5F315CF03E31CE
MD5 SHA1 SHA512 TLSH

Submit Download

T7TODE28.1L0.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6WAZZCWN.0M3\T7TODE28.1L0.application
Size 135KB
SHA256 89a8ffbdfa2af594358db36eeefd655298401d1834de0616a6eaf4e5df985f3c
MD5 49adbc08136548fa13fffec9ed9e2e92
SHA1 f81e801f75502ff9c328454c627526edebccd681
SHA512 761b4cd5816fcdfa021a563f6b99b0dabb358e5fd90d0f852bf0d09721d3fb6e58761c2ad411b051146d6563bf6af4070d1fa2738d8b12cc2adfd0711c7c8ffb
SSDEEP 1536:KK+zuLD4UABnjRnfduUW5Ab4KpSE5GP/uLTvooycuZHOcICt6H6srg2p/d73Svcn:IuuBn1nfdvg2XOcuAcICUP/5qcdcuX1
TLSH
T184D3D63ACE30F4C0477DB02191A52D673D811B93DB731BACD90A286B0E69796EF5E64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L8KEBRZ2.ZDT\XQD9MLB5.PA0\ScreenConnect.Client.dll
Size 636KB
SHA256 d36e154e3b5b677642c3fe051a549a5f46ede0110a10d0e74845e393373abddd
MD5 05798efabae3c98e61270ce204bb2ee9
SHA1 e8a1d752916eaa86f3d58a11b14e6d07de2c66f8
SHA512 922995f79a1a2f8323a0c79273d17ee9e51b053c7f780a4c1e3739c6d9be76169289016bfbaf38f7f378e40710aeab33c16ff0e310c82da24e759eea2d9c1d26
SSDEEP 12288:W4/aH/qxxC/zHTEavSW7OQniuyu8RHreg:v/c/q/izEn8qul8RR
TLSH
T115D4D08DEB94B92AD9AF0773F1613619AAF06CD6885BD30F1D28767C4D713843A5C2C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L8KEBRZ2.ZDT\XQD9MLB5.PA0\ScreenConnect.ClientService.dll
Size 188KB
SHA256 9a05b9925da7b29c6f24f806ae4cf2500d18d31a905b8e926622760e46e9c0f1
MD5 4df2863f5d14d2504ee3e1cb41f2e920
SHA1 4b3c74bb2c2b8e030612cc6b7952b5b63387b0b2
SHA512 7924fb651ead53a562e770140eb14f2f5e5aa4d38e6d01c92eb6f6a4801ccd635702084598c03f02f43bfa7da8fa97f7a1e11ecd11db42c7cf7d7151f8a1af8d
SSDEEP 3072:1as9p5nhzF7C9a+S6fg5ClMJEbPR1tV8NiMd+DHQvVHeDkVHE:vp5t+S6IUMEb51ui5HTwW
TLSH
T1D614AF48BB5AD936C59F0A3BA451B22006F1A443D9E3C78FACD872DE1E163D52F543CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L8KEBRZ2.ZDT\XQD9MLB5.PA0\ScreenConnect.ClientService.exe
Size 93KB
SHA256 943089436b7648644937dd53b4d1a6a0ad12a10585eda3241cbe524f7f544914
MD5 2575df30c19035276786163b4ad0ca1a
SHA1 3cc685d1fe1e726cb3fd585577f1afdb76dfc17b
SHA512 92b0624f7f4f7460427ddac84311ac240b94bfc9e58ed42ea6f99f3f409fe1a35018e22d2b38099b9187f88cc2fbf12b985ee51c98da9e44020d48936e6b7a6e
SSDEEP 1536:gg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoU0HMB7U:JhbNDxZGXfdHrX7rAc6myJkgoU0HkQ
TLSH
T1AC935B13B5C28871D473193158E0DAB09A7FF9215E21DEAB3788022E4F742C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L8KEBRZ2.ZDT\XQD9MLB5.PA0\ScreenConnect.Core.dll
Size 1.3MB
SHA256 041163eb04d9a392f2a7747da3b03ff83369876c43fbc8980ae5a1ccd4cbaad2
MD5 83baf842579d941db433905ff568eae4
SHA1 79034406fb413d6bbbf7d77fb7c0b2c37202fc3a
SHA512 a9da91485e46ca530407597ce15714087db6551e808fcff982c92c99abbc5dd5ebbe659915600927fbec94d63ae9415003a76dc9f14ac8c1cb3bd1509b6946ed
SSDEEP 24576:eRitn37WwOMxzCU/KbsQ/bjyUvPC1EV/QLuug:337WzvyUv6M/QLxg
TLSH
T1D6558D4FBB99AA27C9BD093340505204A3F0E0D75B67DB1B39F0AB3D5D593A86E482CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L8KEBRZ2.ZDT\XQD9MLB5.PA0\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 2992232db7e7272f7fbf971168ef8910bfabbe7a353e86311c6a18f9903e4a24
MD5 c5142af6023345e1df2883326f7d0b63
SHA1 5927d19820a40ddd05b8cbd80e1b3dab49d6cd49
SHA512 b0b59d3aa4064b565b22e54c820c11a7d8444a43aabf928a7e2964b7859c29bae217d98f4650794074d290233ddb317a634b012206c080132cbbdcd29bbb6596
SSDEEP 24576:/2f2beLbtFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfK0:uekbtJkGYYZTk+T1iH7efPoVU
TLSH
T17095AD45E6C365FAD46F043888BE632AA7743C040355CBFB97D4AA3A2D337C09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L8KEBRZ2.ZDT\XQD9MLB5.PA0\ScreenConnect.WindowsBackstageShell.exe
Size 136KB
SHA256 ee0f315664f3361ca8e8f202f910baea2895481506f3bb2659d17c8967db64b3
MD5 835a313bfd4abc9fa4aef1d281357f82
SHA1 d10fcd9047b094d048049dda07790c9e4feae3ac
SHA512 7c3b1211e47cc72aff5d62403765f07c4130afb72e3cca6b3ac8fcf3a35d3c536ded091c0e6293f60f596b15fbd92d35917515778df61a8f69cf1d8bb8899cb0
SSDEEP 3072:6+O/cywOnOQaioWtA6gZHVDLCKcJxfRzQN:0/wOza/WtAPZJCNjf4
TLSH
T122D3AE807798D925D9AF0E3BA4A1B32006F1F097CAE3C7476C98267E6F25BC16F542C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L8KEBRZ2.ZDT\XQD9MLB5.PA0\ScreenConnect.WindowsClient.exe
Size 1.6MB
SHA256 b88b3e3b57f2d0274e16fbb67cd6b77d5c8b32eedde39c47ebc9fa4ef160500e
MD5 2f493a04ccb0545b79875f15a9e6d2f9
SHA1 1f03c9fb4538a42a50cc555b849fbb7950b8b17d
SHA512 f61893acf63849833dda2f2bc806d7779730457f55be4313d146d5035b5f7b88ad7cb8b61d869c13b793573288190da5653c24f0707234ca40d85dcd08697685
SSDEEP 24576:Fp5otlId86KGiOy2cxo7ZepaqaL3d9GtnP9+/qr40DThuNoqqmF:FpO+8u+AkDaou
TLSH
T1F1759D8D7F95EF67C92E077794A12201A7F084948F63EB076890B73E1C893947E489DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L8KEBRZ2.ZDT\XQD9MLB5.PA0\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 56e63aa2b20df91140067ee5198f44308d4396a78970412c2f65e04686ea9311
MD5 190b3b98c72f43f5121c5e09a6d2efcb
SHA1 814099c577c446e8a8121c2d30809d3f4aa73b15
SHA512 288bd0e90cce82929af745dd7b8016776acb5bb9bb40acc2dfcac68fd6ea9bb45a5815b160f2a519579cb91a9d4d7f9c2b84e7608970333ace7863bc4a58a998
SSDEEP 96:xWLwOhoyTqUe2wvyfkskjNkL7akzk6qkiDykSJ4kOpQkOp/knAkOpD:oRpeT5jOL7zY8iD7o9UFUMnVUD
TLSH
T1A0F1BC9684C0BD21573281C0FEE39914BD157F2302AE148EBD4D19AF9FB25899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L8KEBRZ2.ZDT\XQD9MLB5.PA0\ScreenConnect.WindowsFileManager.exe
Size 120KB
SHA256 3e89c58b3a1c6ced8208602665cf0f85601c686c6d1d5bf95c3760648f02984c
MD5 603013abfe4f61722bdd0a7c95a7b52c
SHA1 9517c4c974bf64dea1130631c8b4db1dcf33f122
SHA512 b5ecba418ea266dd049e0d56d32a730424d2e87378d097dc7cde0334f63671b98327dddb2031d9987e58fd5fb4375b092fdfd3003400caa816b7bd7872aa3445
SSDEEP 1536:OsgYi2XAsTWmce3hMxHE/HMpLwEc3RI5BLP+VVVVVVVVVVVVVVVVVVVVVVVVVSgX:Osgswsoe32xHEPMpLuuBLNhx+
TLSH
T1BCC33A5135266135EE89C433A052E97199337F6607FEC6BE2CA1BA3A38F13543E89D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L8KEBRZ2.ZDT\XQD9MLB5.PA0\ScreenConnect.WindowsFileManager.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

memory/252-10-0x00000000745F0000-0x0000000074DAC000-memory.dmp

Download

memory/252-8-0x0000000006820000-0x0000000006DDA000-memory.dmp

Download

memory/252-1-0x00000000034A0000-0x00000000034A8000-memory.dmp

Download

memory/252-16-0x00000000745F0000-0x0000000074DAC000-memory.dmp

Download

memory/252-0-0x0000000074602000-0x0000000074603000-memory.dmp

Download

memory/252-13-0x00000000745F0000-0x0000000074DAC000-memory.dmp

Download

memory/252-12-0x0000000074602000-0x0000000074603000-memory.dmp

Download

memory/252-11-0x0000000009B40000-0x0000000009D26000-memory.dmp

Download

memory/252-9-0x00000000064A0000-0x0000000006532000-memory.dmp

Download

memory/252-18-0x00000000745F0000-0x0000000074DAC000-memory.dmp

Download

memory/252-6-0x00000000060B0000-0x000000000611A000-memory.dmp

Download

memory/252-7-0x00000000745F0000-0x0000000074DAC000-memory.dmp

Download

memory/252-4-0x0000000005B70000-0x0000000005CC0000-memory.dmp

Download

memory/252-5-0x00000000745F0000-0x0000000074DAC000-memory.dmp

Download

memory/252-3-0x00000000745F0000-0x0000000074DAC000-memory.dmp

Download

memory/252-2-0x00000000034C0000-0x00000000034D0000-memory.dmp

Download

memory/1264-291-0x0000000000A00000-0x0000000000B94000-memory.dmp

Download

memory/4488-14-0x000001F7D1390000-0x000001F7D1398000-memory.dmp

Download

memory/4488-71-0x000001F7F0390000-0x000001F7F04E0000-memory.dmp

Download

memory/4488-65-0x000001F7F00F0000-0x000001F7F0122000-memory.dmp

Download

memory/4488-59-0x000001F7F04D0000-0x000001F7F06B6000-memory.dmp

Download

memory/4488-53-0x000001F7F01A0000-0x000001F7F0242000-memory.dmp

Download

memory/4488-47-0x000001F7F0430000-0x000001F7F05C4000-memory.dmp

Download

memory/4488-37-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4488-36-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4488-35-0x000001F7EDC10000-0x000001F7EDC60000-memory.dmp

Download

memory/4488-26-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4488-25-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4488-24-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4488-23-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4488-22-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4488-21-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4488-20-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4488-19-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/4488-17-0x00007FFB8794F000-0x00007FFB87950000-memory.dmp

Download

memory/4488-15-0x000001F7EBA30000-0x000001F7EBBB8000-memory.dmp

Download

memory/4488-318-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads