00b071140b66d767b35bada579fa65b754cddec1f2938a31ebc784e94072a896

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-30_7e1ba53cafe584736c9085ae89e85e8f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 2.4MB
Sample261030-3teckahs3n
SHA256 00b071140b66d767b35bada579fa65b754cddec1f2938a31ebc784e94072a896
MD5 7e1ba53cafe584736c9085ae89e85e8f
SHA1 53aa2ffec7ce2321f68084e78dab284b51e063cc
SHA512 6c14b12ced3f4e149bc3c8d89fb7a61280fbec60e62d9dabfad8721bee9106eb975c3a6fe5383b7176a2d9ca3f59baf526909f20d831f7631fe9da108636e8da
SSDEEP 24576:wDubA9DS2XINpgFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiHk:CDupgJkGYYpT0+TFiH7efP0Q975l
TLSH
T152C5AD01F3D265F5C46F0A3884BA421AA774BC081315DBFB56D4A9A93E337C05E36BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
7	5920	dfsvc.exe
7	5920	dfsvc.exe
7	5920	dfsvc.exe
7	5920	dfsvc.exe
7	5920	dfsvc.exe
7	5920	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
3400	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\O0TQNGZP.AAL\V9CXOQWV.OWV\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-30_7e1ba53cafe584736c9085ae89e85e8f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "2EK38N9E9PMWWYJ532HY95PG"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\Files\ScreenConnect.WindowsBackstageShell.exe.co = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_38093a48b84e8830\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d\lock!0c000000339a590e20170000601700000000000000000000 = 30303030313732302c30316464363863393233303833346331	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0004_0870d141063e72db	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_38093a48b84e8830\scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0004_38093a48b84e8830\lock!11000000429a590e20170000601700000000000000000000671b5 = 30303030313732302c30316464363863393233303833346331	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\DigestValue = 8aaf1107de02e0190a4ea0dd4e4ed05808e3df85	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_38093a48b84e8830\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_38093a48b84e8830\SubstructureCreated = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_48101f2051ddf5f1	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_48101f2051ddf5f1	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a843f70\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244\Files\ScreenConnect.Client.dll_fc1d7bd48553fcab = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\lock!06000000339a590e20170000601700000000000000000000 = 30303030313732302c30316464363863393233303833346331	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows	ScreenConnect.WindowsClient.exe
Key deleted	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 30000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab\Files\ScreenConnect.ClientService.dll_e781b1c636 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40\lock!0e000000339a590e20170000601700000000000000000000 = 30303030313732302c30316464363863393233303833346331	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 54007200750065000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0004_38093a48b84e8830	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0004_none_1cbe04a2ab6ffd98	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d\Files\ScreenConnect.WindowsClient.exe_6492277df2 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_0000000000000000_57051d5779c6eb7e\LastRunVersion = 68747470733a2f2f636f6e6e6563742e63616c6974736f2e636c6f75642f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 680074007400700073003a002f002f0063006f006e006e006500630074002e00630061006c006900740073006f002e0063006c006f00750064002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e003f0065003d0053007500700070006f0072007400260079003d0047007500650073007400260068003d0063006f006e006e006500630074002e00630061006c006900740073006f002e0063006c006f0075006400260070003d003800300034003100260073003d00370036006300390061003200380039002d0030003800330030002d0034003000630030002d0062003000340030002d0064006400640066006300340039003300300062003300660026006b003d0042006700490041004100410043006b0041004100420053005500300045007800410041006700410041004100450041004100510041007400760067004f0068004b0050006a0030003500780063006e0049005100410046002500320066003200380039004e00570032004100310070006900630043007800310074006b0033007700520041005900760034004300480035004500650051006b003800690078005000660032005600530030004a006f0030006c00710031006a006f006200610045006a0049006a006a0055006600630053005400790059006a0076006700460071004e006e006900610043005400440062004700750044004300570059004e004c0078003500610077004b0038006300610065004b007500520053006b00690078006900670059007500250032006200370032005800490061004d002500320066006f003000650058006a006a00530069004d007a00730032006f0045006f00590038004d0072004a0059006f0032006b0058006500480041006100710054005200470078003500440074004e0032005700680072004c004b004e00390051005a0067004a003100450047004e006a00530077006e007a00750041006c003600770051005a00700076004a0033005900300030004c0064004c004a0030004a0043003100310066006d007100770038005200710070004d004500630038004f0051003300710056006200330051004c00540045004600630036006200470046003500610059004d0071002500320062006d0047007a006b002500320062004f00770059006f004c0052006c00650065004a0068006b006800440072005200350079005800570025003200620068007500790037004e007a006700740068004a00300043007a0076005300440049003000500048005900790050005700490051004e006200760057004e006b007900320049003700480057007700710034004300340049005100620078004900760031005800320041003300430074004e0036005000570048004d0077005500710050006c00690054005700260072003d00260069003d0043007500730074006f006d0025003200300045006c00650063007400720069006300250032003000250037006300250032003000440061007600690064000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0004_38093a48b84e8830\appid = 68747470733a2f2f636f6e6e6563742e63616c6974736f2e636c6f75642f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d\DigestValue = 4b7f3832da8745d35314d29405637e0eefb88994	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40\lock!0c0000005c9b590e480d0000101300000000000000000000 = 30303030306434382c30316464363863393261373039356231	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a843f70	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_0019.0004_38093a48b84e8830\HasRunBefore = 01	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_38093a48b84e8830\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d\SizeOfStronglyNamedComponent = e17f090000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_38093a48b84e8830\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb527	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0004_none_1cbe04a2ab6ffd98\lock!04000000339a590e20170000601700000000000000000000 = 30303030313732302c30316464363863393233303833346331	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\lock!010000006899590e20170000601700000000000000000000 = 30303030313732302c30316464363863393233303833346331	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244\DigestValue = ef1aa54cd6a09f178eb0fe006908099bde860f86	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_38093a48b84e8830\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_38093a48b84e8830\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb527 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_00000000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_none_1cbe04a2ab6ffd98	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\Transform = 01	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Apps\2.0\2EK38N9E.9PM\WWYJ532H.Y95\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\O0TQNGZP.AAL\V9CXOQWV.OWV\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4632	2026-10-30_7e1ba53cafe584736c9085ae89e85e8f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	5920	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 5920	4632	2026-10-30_7e1ba53cafe584736c9085ae89e85e8f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	89
PID 5920 wrote to memory of 3400	5920	dfsvc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-30_7e1ba53cafe584736c9085ae89e85e8f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-30_7e1ba53cafe584736c9085ae89e85e8f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5920
- - C:\Users\Admin\AppData\Local\Apps\2.0\2EK38N9E.9PM\WWYJ532H.Y95\scre..tion_0000000000000000_0019.0004_38093a48b84e8830\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\2EK38N9E.9PM\WWYJ532H.Y95\scre..tion_0000000000000000_0019.0004_38093a48b84e8830\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:3400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\2EK38N9E.9PM\WWYJ532H.Y95\manifests\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b.cdf-ms
Size 14KB
SHA256 5b3f4eb1f518bbb8083a14f1e9c083b272d7657f54bf5ffdd1ac30496ce630d1
MD5 d0e8f04dde905c6e2174a2f981bb598e
SHA1 338d3227ac3d6d711bf960aa21bbd92451902065
SHA512 4df9a205f225a499cd1c87c8fff1b50e5e9d1534e6cca2a5ab07a7c69c04ddf7db9ffc4be20f2b605bc9081ac3b20de49186284ede8886966444746ed816ec5e
SSDEEP 192:svgwHXpAk9CTgGZD6XXyCrer8SCVDZGdaHE0EmViG4:sHCk9CTFZTK+EdVF4
TLSH
T14C62AA11B791E833E2419B738CA6E7D47232BEA55F97135B30443B2E9E702C94F226E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\2EK38N9E.9PM\WWYJ532H.Y95\manifests\scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40.cdf-ms
Size 3KB
SHA256 9e21de11342b2b80e650c13eb8770edbed5957f6c709bc1684a6fea43306efd0
MD5 79988753e0e2a76cb446243949230d8e
SHA1 926b443a3ddfe084eee4666923290fd1432c6471
SHA512 b91beaa528163f11c2853afe307d478dd58c1782d3c799b3e028bd0c6b0490fe1ff5e7de6906f5c92a76847be712312a2bff2426d5a8e8029f47fcfa6c4ba82f
TLSH
T10661DB027704DA17D9A946339CE1E2EE27743E83CF82860F74C47F2F76322B652112A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\2EK38N9E.9PM\WWYJ532H.Y95\manifests\scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40.manifest
Size 1KB
SHA256 701043b60905f164f8c7eacbe72a8738948409475263bc331711895950a4edc0
MD5 dfc5114133b3b1356aed7daeb3386c6a
SHA1 ac875bebb46228d56ca4f48e64a165229e0d8aea
SHA512 6d76465e8a60678f5e4cdfc7141aa00a46f63b1384aa447d6b0350c3632f920c6b70966da3d02dcf5a073893a1edf876e1d7aec550d11bd5782f6d3d90561f03
TLSH
T10121670181C8FA261F3302D2BEE7E421979E5B33188D194B7469689FCB2DAD64747173
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a843f70.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\2EK38N9E.9PM\WWYJ532H.Y95\manifests\scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a843f70.cdf-ms
Size 5KB
SHA256 3cb2214d8cb6c1eba72fa68fedcd5fd1bb505420d833277d23df051c4d31d9af
MD5 5681f94f8c500e86de8065987aa40d60
SHA1 b02e55f9bbb2a8551255323ea5d72b1ab1bc9ab8
SHA512 7dc9eaa5d3ffada006eb2683c66d09be406410661fa549e0748dc1102b8240b9e1fc1378b9a7973f962ebf9f66f54b01eba5d56d128975c52a13549a57c93107
SSDEEP 96:+6fP+RxU9LTeV+Ww7mkknSBWgCQodDeongnsRgu:ARxUNUJi6IUQW1Qdu
TLSH
T1FCB166117254DA17D5B80A33AC95D3ED2735BE82CE43530B70D4BF2F7A322E64B251A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a843f70.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\2EK38N9E.9PM\WWYJ532H.Y95\manifests\scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a843f70.manifest
Size 1KB
SHA256 22a7184049b2294a26e2ae97f1e52a45dae7e375bd40bcef82d28afb76628549
MD5 e7e3aeee640f9090fbf05eddbd147a95
SHA1 4ee7cb637008e348d72f8adc46a86893eb715b2e
SHA512 3f911ff1fab3935405ded38be4b7570e7e495f7595b2196013df2957a42f57065606fe74bde96256cdd3fa32f1a074c701fd044568de2ad33415402d2328b1e9
TLSH
T18F41F31281C8FA250F3301C27EEBE431879E5733158E190B74A9A99BCF29AD74747177
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\2EK38N9E.9PM\WWYJ532H.Y95\manifests\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d.cdf-ms
Size 6KB
SHA256 acf890806f0b30e8daa3e8393a9abf52a1df47bab9a0acd31c907058e157ec1e
MD5 075de03a6f13bfae2e136088fa0b91e3
SHA1 680335ab6c93dc554867c749ac1ec86e1d301aa9
SHA512 6c61fb7e9a18d823a9f673ad3a1aab60e89d292f995e6defd61c0efd0450bfa73fff73806cb863585b25e1bd16bcd42e4d9d2a77c17f5c2f0d30cb78e16e6c51
SSDEEP 96:vjkhWhDM5leV+WwwU8WbOE9WQvgoGHi++NOocnsVoeiw:wAZMMJwbxedyEs6w
TLSH
T147D125127390EE16D1A90633ACDAD2DD32767E96DE43430B70C4BB2F7B322E65722095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\2EK38N9E.9PM\WWYJ532H.Y95\manifests\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d.manifest
Size 2KB
SHA256 aface8e8210443e62021751699279663bed2007af7a86d905f2ec7ba5dfc6ffe
MD5 54e4e4a218ca37ef40fe7a66eff9169c
SHA1 6356b3e9a4b105b93fdb0f26ca6992149ceeba1d
SHA512 9060ed3ed281f8eb08efdf7fbceebf6b5e6b03c3328c8336b67185a6dece723eefba3f969341be014682fb728aabc2e7199d9cc8259c0bebef6a7be71fda6cfa
TLSH
T1CD51D41641C8FA210F3301C1BEEBE471979E5B32158E190B7099999FCF2DAA7474B177
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\2EK38N9E.9PM\WWYJ532H.Y95\manifests\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244.cdf-ms
Size 2KB
SHA256 d7859d5273e98d8a2c5c78a82299f9d442d6e22fc9003f1f565ba36b1cf5f03f
MD5 72e097361726f593abb1fda3adb78500
SHA1 fd036bf58cb408aeb843a916ea32b2ba47ea5d4f
SHA512 5317b7f6ecc21da587653f25e64384dcf453782edc84fedc7e966fa9c280a0133ac9c7ac0403d7f4a19d884f1b9b71b9d003cff5391b01b5d104530bbece5bc6
TLSH
T189519B013784EA67D66A4633ACA1C1DD36753E42DF47030BB0D0BF7F3A316E54A221A2
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\2EK38N9E.9PM\WWYJ532H.Y95\manifests\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244.manifest
Size 1KB
SHA256 abedad01322bc77aaecf0e58331298f62daff9937666265931efc7995e7aa890
MD5 cb59fbfe2c4b0db2feab82b39bb41d4e
SHA1 4144d072fbd1495b70d2412d6cee9c7010bfcefd
SHA512 f1775552d4b3eb070d226db4b7e6ca17def881bc5b78dd44817426454156ad874d4efafa3cb39e9b81353efe87942c0d41b00980e33fecc80cb993ecb2acf9ae
TLSH
T108117B0181C8FA261F3341D1BEE7E021976D5B33048D194BB06968AF8F3DAE683471B3
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_0019.0004_none_1cbe04a2ab6ffd98.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\2EK38N9E.9PM\WWYJ532H.Y95\manifests\scre..tion_0000000000000000_0019.0004_none_1cbe04a2ab6ffd98.cdf-ms
Size 4KB
SHA256 f2fe5b01ce3ec1f68fac2ecf25ba178b348920ec11ee2680777b0674caa7fc0b
MD5 c40c235cf88b551b67104642d768f864
SHA1 953a22c0f61debbe5c6f85a8cd9acf432b91a8a8
SHA512 45225cfe318ad0b0de6b832b965b4e1a2de818602cc0fbbbd099eddd47cb95d2daba03db580052dbc69500ba76d29dd3b563367b1879e227e1a096cf199f2c91
SSDEEP 96:B+a+PAtEW0m5R/8UmPk+VYVhmxXcRWfxb/s:AqVA9874MgQ
TLSH
T1BB814240B740F823D6145732ACE3E2D073397DA14EE7534B3094772EED326C99722261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\2EK38N9E.9PM\WWYJ532H.Y95\manifests\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab.cdf-ms
Size 4KB
SHA256 216fb5b270fa6104bceb8b258346c6313754a92625ef74583eb08dee84bb1230
MD5 5abf4add9b7a1180cbf3a380f4d3b074
SHA1 6e0b0ea7194ce98784c669dc8ae24696bc3458e4
SHA512 fc43b834c1c759323b9d291facbc09dae0fe496e9c121909fa0612a4038d4d8f59281c8fb64df223b680ee8317d905a8eb1b22c8792560434db3a6da425e256e
SSDEEP 48:QGLCDVxldg7e6S+9ow87glW75uvW/vTbV42Q1heJf1fTRV3nwAvUgA9f:QGLteV+Ww8U45u0T22iheJFTRVnDvUf
TLSH
T1A59167127280ED66D5A90633DC96C2DD3A367D82DE83070BB0C0BB7F7A716DA5B12196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\2EK38N9E.9PM\WWYJ532H.Y95\manifests\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab.manifest
Size 1KB
SHA256 97a3af25bfd040d4b7c09d39137024e3054db3e3ffc6d70c48c8e037bc7d28de
MD5 adc9c617ac3026a6947fdf12027f9144
SHA1 6c4c468e7457e446cb9ede02348342d07df41eb8
SHA512 809c19fb85b74764cd0e6d50e6ee5620e170e24b3340c30c463dd81ae2ab69a4e85949dcd5ccdcb845112359ee9efe53a049aa62f78c95bd8148cd1e2809e106
TLSH
T15A31E90641C4FA251F3301C1BEE7E061975D5B33158E194B706959AB8F3DAA6434B173
MD5 SHA1 SHA512 TLSH

Submit Download

L8RAXHR6.A8X.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NBV5ZYZL.ZNL\L8RAXHR6.A8X.application
Size 90KB
SHA256 f52d090242b939dda9d8bb8c471fa050aab5dcf2547cd8cc5f9cbe2be763decc
MD5 dafc06c10080afbd9c30a8bc42c3d366
SHA1 caea0f1aba117f16963c040542ad798ae62d6ba8
SHA512 207788573aa224298ec4d90d6460dcc5e9fb6239acdc7b5af59e886896021c8f717e70ffeb4d2c06ed60b5f30dd7d65a2e06a0e3612853181720c5d4c4f67928
SSDEEP 1536:zAmki10M5n76+8rJsZckAGSZNVNzWJJ29ymM:zAiqM5n76+syMVN6K9ymM
TLSH
T1F493313A8E30F4C0477DB021D1A52D673D812B93DB731BACDA06186B0E69796EF5E64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O0TQNGZP.AAL\V9CXOQWV.OWV\ScreenConnect.Client.dll
Size 228KB
SHA256 9507c29ca92f850426ba5a05647214f3f6e408853a2baef97892db5f7e974a55
MD5 db64c607261db6c29852fbb235df5d44
SHA1 ef1aa54cd6a09f178eb0fe006908099bde860f86
SHA512 6710ab02207e5abc9f6f9a343894dfe654fa00aedf879759997528582011bfe7c1135896fd4f86584063913e33704c54d020b451b08616bbbb56112919fb7ac5
SSDEEP 3072:xNYrrhDXQePbEIG2hsNVFJRCcyzv5qnn44O9BexzNzn42zDvJXYd/HT:wrtD1bsI4Jjeqnng+Zz42GZ
TLSH
T1C8347F4633A64C65FBEF0AFBB49091248A72ED056153E76E8D0479FA1DB378283507E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O0TQNGZP.AAL\V9CXOQWV.OWV\ScreenConnect.ClientService.dll
Size 78KB
SHA256 81d06d6f5c4dcca630d5001425566ab976e222082612f96dfc99078f585139ed
MD5 4aaa3056c5af955a0a8c233869d7291f
SHA1 b373544d77580000e73dd09c7ef3c53a65d747de
SHA512 f0ae365f3ee4cae565dfbbbbdbe66631c12a1e381ef642bf29420366e58f7819cafc3c580a4dd7bb2e465fad7234c715927cee621cf88bcafcbb57145a770e2f
SSDEEP 1536:sOZLd94e+JBm+Xfi/N7t2DEPVQXV3lk9OIb5M7rbm:sEgtxPantQXV2hMHi
TLSH
T18E736D12A3BC8A26CDDF4E7874A1B0450F719A41D4A6FBD89DC9A4EE5F523C13A043DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O0TQNGZP.AAL\V9CXOQWV.OWV\ScreenConnect.ClientService.exe
Size 93KB
SHA256 bc0b03a340d46c23a4a2f91ebd7ed4d0fcf92fc7c4323f522c86369ad483f68a
MD5 01670513447f464926e6d2c74f529162
SHA1 22627141ffec9b9317b49ca95ac9b27aa5b79ee2
SHA512 e6747fb124f5e8e3361d723cce10a1626572682b19d713278e6081611e2f55c4ee5a0680cf96cd4cfd31759fef676c242bc133677222ccd682c6d04085291388
SSDEEP 1536:jg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg0T0HMa7r/Q:MhbNDxZGXfdHrX7rAc6myJkg0T0HhHo
TLSH
T1C1935A13B5C28872D473093158E0DAB49A3FF9615E21DEAB3798022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O0TQNGZP.AAL\V9CXOQWV.OWV\ScreenConnect.Core.dll
Size 552KB
SHA256 dc3168bfff8b8bffb36f4374da4dfce8a96786a632eb6bdb666099fc0cf16a54
MD5 d7c08ace02be7766ca7c7cd2db3f092c
SHA1 c458f768008fcf3cea1f683665a14f049aaf0da1
SHA512 e7370785050c9cb4772fd0e15f9af11b00b90b812226689603c2f44f93af220bd9a638e440935e284739220e1232993de07f264d5b2505bce8b35345168fca1b
SSDEEP 6144:ZTc03YqaaDUy3dX19jcjxrvm7zh7LZP8UllEDOb6E9GI7Ar1nb2q/QSeDTax4k4J:ZTeqafoFYkPJuolEDOuE9GWKb2IiXh/
TLSH
T164C48F11B394B66AC6BF0B37E0A084151730ED08710AE76759A4D4E83F6278F6E49EF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O0TQNGZP.AAL\V9CXOQWV.OWV\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 ff82ff2c60cebea3eb57b9d50e5ac1653009ff781d288f4b4b0c3578b2aefd30
MD5 70c1afe03b8e1787c55301c4e40a4524
SHA1 6d4f89426b36cba739ac87a116308a133ab4343f
SHA512 71f50772c6ef48fa01bbdb1c6272ab087664f77c1ae2805c30c55a9100c9de09c4b6ac00fd77bacb14b8ef3f48dc8a5d959ce3537de488e60afa99cba3fedc78
SSDEEP 24576:B5phFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTE:nphJkGYYpT0+TFiH7efPJ
TLSH
T11D85AD41E2C369F5D46B047888BF572AAA747C080324CAFB97D4BE356D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O0TQNGZP.AAL\V9CXOQWV.OWV\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 6cb34f11581e157628118bf39adc1effdc92ef81043632ad9f6b7952b85fb1eb
MD5 5291b601616078582e4448dd8f0dd03d
SHA1 734146fafa922d6fdf9adebe76b05d8747c71784
SHA512 b663aa83b020ecf0990dc2e6c28bdde5ae88f0e7fba93bbbb87420ce8add29ebb8e4845ae2bb9d5b4009edbc7de97bd4c71cdd9495a585e1496548a6a20836aa
SSDEEP 1536:hoSOs/MRZFe9aGhDvmDTyQX5E+TC7tih2syGbXe7rN:hoTsCZFe99myQOKDeH
TLSH
T1EC537D4163E84619C9FF2E7DB9F2A1141EB0AA438441DBAE0DCD65EA1E537816F203F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O0TQNGZP.AAL\V9CXOQWV.OWV\ScreenConnect.WindowsClient.exe
Size 599KB
SHA256 0fcf040e7c627085146cbe9ca77bc61d2dec0eacc500651fd2b02f76387a0c2e
MD5 b35a60a49d6b334ab27104e72d011661
SHA1 4b7f3832da8745d35314d29405637e0eefb88994
SHA512 f4512a1e06bed58f324640d160940118df72be916e7deae095084122d2f374126dcda438e6078aafab8347df4dca6d21dd88a6c50ae862fbed57fdb08171f297
SSDEEP 12288:tdqgkJ1ws1YGO711SxLBr+b/SCNv9h+si:61Yd1ExLQb/NtSsi
TLSH
T12BD45C22737CDE7BC8AF0779A0B118245FB0F819A285E35E4954A5E90F8738A5E443F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O0TQNGZP.AAL\V9CXOQWV.OWV\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 360f2c32f1675fd92ea4895693de10e849cf36b21f7c9952d6af4e7090cd8421
MD5 283b73cc24c8b64544a19a0212f12f0c
SHA1 8aaf1107de02e0190a4ea0dd4e4ed05808e3df85
SHA512 54fda7d41a7ce92ee47d12ba99e6a1f43e27b6165105cf77e9d31743cc0a2f708f3d474fd13d1f42167353c4c5a7a2ebe9325f1e172f9a0f1a67df8a2ce4f370
SSDEEP 96:xWLwOhoyTvJe2wvyAkodkYkFk8kwvkpdykG4kOpQkOpXyk2AkOpD:oRReYo+d2pbpd7G9UFUX72VUD
TLSH
T192F1BC9684C0BD21573291C0FEE39924BD057F2302BE148ABC4D19BF9F765899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O0TQNGZP.AAL\V9CXOQWV.OWV\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 14525dd6476e98c5746aefc3386768c2320d3ed802e638ad1ff49dabb983229b
MD5 fef4bfd6bdb04cbe2e2a860be8485a90
SHA1 0bbed282196b5d8dd22e327ee1c4c593b3d9f064
SHA512 f38e6cdadca4b57584c450d4662489a5fa4fbd9b612e2305c19cc7a9f3c5b9228a6b50340a03fcc6ca7f35daf61e478c2daca4032cfa40990d332c99429e9553
SSDEEP 1536:Ntyil44BzbRCI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC70t7re:OcSukLdwtH
TLSH
T17483F68235762631DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O0TQNGZP.AAL\V9CXOQWV.OWV\ScreenConnect.WindowsFileManager.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3400-296-0x000000001B830000-0x000000001B848000-memory.dmp

Download

memory/3400-287-0x0000000000740000-0x00000000007DA000-memory.dmp

Download

memory/4632-2-0x0000000003320000-0x0000000003328000-memory.dmp

Download

memory/4632-12-0x0000000074F62000-0x0000000074F63000-memory.dmp

Download

memory/4632-19-0x0000000074F50000-0x000000007570C000-memory.dmp

Download

memory/4632-1-0x0000000003300000-0x0000000003308000-memory.dmp

Download

memory/4632-3-0x0000000074F50000-0x000000007570C000-memory.dmp

Download

memory/4632-4-0x00000000058A0000-0x000000000592E000-memory.dmp

Download

memory/4632-0-0x0000000074F62000-0x0000000074F63000-memory.dmp

Download

memory/4632-5-0x0000000003350000-0x0000000003374000-memory.dmp

Download

memory/4632-6-0x0000000074F50000-0x000000007570C000-memory.dmp

Download

memory/4632-9-0x0000000074F50000-0x000000007570C000-memory.dmp

Download

memory/4632-8-0x00000000059D0000-0x0000000005A62000-memory.dmp

Download

memory/4632-7-0x0000000005EF0000-0x00000000064AA000-memory.dmp

Download

memory/4632-14-0x0000000074F50000-0x000000007570C000-memory.dmp

Download

memory/4632-10-0x0000000005C80000-0x0000000005E2E000-memory.dmp

Download

memory/5920-63-0x000001F5FC630000-0x000001F5FC6BE000-memory.dmp

Download

memory/5920-45-0x000001F5FC900000-0x000001F5FCAAE000-memory.dmp

Download

memory/5920-13-0x000001F5F7F50000-0x000001F5F80D8000-memory.dmp

Download

memory/5920-22-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/5920-21-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/5920-15-0x00007FFD6AFFF000-0x00007FFD6B000000-memory.dmp

Download

memory/5920-11-0x000001F5DD7D0000-0x000001F5DD7D8000-memory.dmp

Download

memory/5920-69-0x000001F5F94D0000-0x000001F5F94E8000-memory.dmp

Download

memory/5920-17-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/5920-24-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/5920-57-0x000001F5FC640000-0x000001F5FC6DA000-memory.dmp

Download

memory/5920-51-0x000001F5FC4A0000-0x000001F5FC4DE000-memory.dmp

Download

memory/5920-16-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/5920-23-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/5920-35-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/5920-18-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/5920-25-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/5920-20-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/5920-293-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/5920-294-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/5920-295-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/5920-297-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/5920-34-0x000001F5FC410000-0x000001F5FC460000-memory.dmp

Download

memory/5920-298-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/5920-299-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/5920-300-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/5920-301-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

memory/5920-302-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads