267cf6fcb7fa36ceb1972dc907050427eb60e516fb0f65c75134b5a0631c58c7

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 14:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_82818b20e7d508359d82fdda5034b71f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 3.7MB
Sample261110-rl11tabs6v
SHA256 267cf6fcb7fa36ceb1972dc907050427eb60e516fb0f65c75134b5a0631c58c7
MD5 82818b20e7d508359d82fdda5034b71f
SHA1 9277fe3e6908befdb682eeab77dcc442a9c0a46d
SHA512 3cbeb6455330a679c2f009ca84b1b779e0d20cdda3389b0ad55ab7208bac85becc43f3e675fe30a1db28069373c31fb9804ef8ba958d5ab1fc71a7a6ba771620
SSDEEP 49152:oAUrgszC/lMKByJ/Q0yHlJkGYYZTk+T1iH7efPcMwMLEeCKV:H2C/l6JieM6efPcMLoM
TLSH
T1DD06C04AFBC6A677C53F063584B57314A7B0B8454762C7AB6AD0BB3E1C323D06E25389
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2456	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\6KPCMBB3.TLC\4MDL2KV7.63Y\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-09_82818b20e7d508359d82fdda5034b71f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-09_82818b20e7d508359d82fdda5034b71f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_82818b20e7d508359d82fdda5034b71f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de23	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\lock!12000000c71b5a0e98090000780c0000000000000000000 = 30303030303939382c30316464373131653465373462313839	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0007_none_0a65ab3dbb4427e4\lock!10000000c71b5a0e98090000780c0000000000000000000 = 30303030303939382c30316464373131653465373462313839	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_3da05c4de3687b7b\LastRunVersion = 68747470733a2f2f6d696e7574656d616e68656c702e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e372e362e393738332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e372e362e393738332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d\lock!14000000c71b5a0e98090000780c0000000000000000000 = 30303030303939382c30316464373131653465373462313839	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e372e362e393738332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_20de1e6ba74b6119	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf\lock!1a000000c71b5a0e98090000780c0000000000000000000 = 30303030303939382c30316464373131653465373462313839	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0007_f4da863c93273aba	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6\lock!16000000c71b5a0e98090000780c0000000000000000000 = 30303030303939382c30316464373131653465373462313839	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_3da05c4de3687b7b	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\Files\ScreenConnect.WindowsBackstageShell.exe_8 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2\DigestValue = 33c304d9dc24741e9c888725bf5f6f70b0f782bc	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d\lock!080000008e1a5a0ef8120000040d0000000000000000000 = 30303030313266382c30316464373131653437313438386363	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0007_f4da863c93273aba	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0007_none_0a65ab3dbb4427e4\lock!02000000c71b5a0e98090000780c0000000000000000000 = 30303030303939382c30316464373131653465373462313839	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\NonCanonicalData	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\Files\ScreenConnect.WindowsFileManager.exe_0e21 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_f4da863c93273aba	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\scre..ient_420d02d3849b7992_001a.0007_none_cd6203d30 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6\implication!scre..tion_0000000000000000_001a.0007_20 = 68747470733a2f2f6d696e7574656d616e68656c702e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e372e362e393738332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02\DigestValue = 7a7fe42dfea511ab33cebb757acac38359628427	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02\Files\ScreenConnect.Windows.dll_fc0d83aff7df0b5 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_3da05c4de3687b7b	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_3da05c4de3687b7b	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 460061006c00730065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02\lock!0a000000c71b5a0e98090000780c0000000000000000000 = 30303030303939382c30316464373131653465373462313839	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_0000000000000000_57051d5779c6eb7e\LastRunVersion = 68747470733a2f2f6d696e7574656d616e68656c702e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e372e362e393738332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e372e362e393738332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0007_none_0a65ab3dbb4427e4	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\scre...exe_0000000000000000_001a.0007_none_5cdffd35b	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0007_f4da863c93273aba	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 680074007400700073003a002f002f006d0069006e007500740065006d0061006e00680065006c0070002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006d0061006e00690066006500730074000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\SizeOfStronglyNamedComponent = 09bf050000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\Files\ScreenConnect.WindowsBackstageShell.exe.c = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32362e372e362e393738332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_0000000000000000_57051d5779c6eb7e	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32362e372e362e393738332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de23 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2\lock!100000008e1a5a0ef8120000040d0000000000000000000 = 30303030313266382c30316464373131653437313438386363	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\6KPCMBB3.TLC\4MDL2KV7.63Y\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\QCNG796W.8N8\1CEO9OWX.5WB\scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3492	2026-11-09_82818b20e7d508359d82fdda5034b71f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	4856	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 4856	3492	2026-11-09_82818b20e7d508359d82fdda5034b71f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	88
PID 4856 wrote to memory of 2456	4856	dfsvc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-11-09_82818b20e7d508359d82fdda5034b71f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_82818b20e7d508359d82fdda5034b71f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Users\Admin\AppData\Local\Apps\2.0\QCNG796W.8N8\1CEO9OWX.5WB\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\QCNG796W.8N8\1CEO9OWX.5WB\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:2456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\QCNG796W.8N8\1CEO9OWX.5WB\manifests\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7.cdf-ms
Size 14KB
SHA256 5d1e86730e657e13bc8859a55694865d441d513b98f4b81c7a9640fe23ae0a77
MD5 e8293d0387cc4bbd1655ecc39f96bbc7
SHA1 a8fa15bf130a541e554d5b8935b364fc8a25e806
SHA512 463553e7eba70ffcc9cc877a316ec195a957948022fcbfbc4f445a31f953b6fd39bf1c9bbf435a671fe2ca0ba59f0b358cc3134e1650c65ee0a912ce7d79014d
SSDEEP 192:crEwHfSL+F1Tpkzarp9Ub2oR+8me25/j5Kc902rz47VPV6K0Zofq/e94:c/IYvXp9VeAXvtOym94
TLSH
T15362E721FB54F033E2625A739CB7E6D16728BDA60EA611877080373C997219ACF36395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\QCNG796W.8N8\1CEO9OWX.5WB\manifests\scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2.cdf-ms
Size 3KB
SHA256 b879aad60e7f2f07ad63ceba4b9545d150a4c8b5dd608775da51f23d5be70879
MD5 2d31b7306ed2675105f3c42357fb59b0
SHA1 09a60261f788060f6713073fd66466010bafd6ab
SHA512 09ec4b1fb31a48e8be7e2ffa200812e0729d990819ff60c09a8d71b67b1206ebba73a89d5e4310137179610ae9006cc932e0de31688f9ca5bd7604115491c09e
TLSH
T193610D027744DA13EAB90332ACF2D2DE6FA87E83CE81810FB4C47B5F79364A556112A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\QCNG796W.8N8\1CEO9OWX.5WB\manifests\scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2.manifest
Size 1KB
SHA256 ede66ce32d594547cde8019666ac28a765f0794ea6702374e7a54e1cb6405371
MD5 deee761ec1bb0649fe7030b219a8c6db
SHA1 8729fc42a89f5e8fde6e7bf58a5c14fb8f075db9
SHA512 82fe38b4473cfda697e4333b58dd086e30568cc430a28741a1ed56d574b0c1841200d4ff2bb2ab13adfea519ce9670e5b53d934e078ba02fa25fbd59fbd7fd67
TLSH
T10D21370181C8FA261F3302D2BEE7E42197AE5B33188D194B74A9699FCB2DAD64747173
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\QCNG796W.8N8\1CEO9OWX.5WB\manifests\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02.cdf-ms
Size 5KB
SHA256 e9281175de298d132c86b1977fb36a86e7fc6fc5eb9b1569bac7208524268f90
MD5 ae34798c24ee5dfc6f5a2009fc1c37a7
SHA1 7925b9f9a7e453db29980aabaf87cd43464557b0
SHA512 a5d9024b2ff9adb1a314258cb14342b31034084e03656d2ef59e1f72f04eb55b6ef857c103466a6ca4dd51deb6bee9b425504b3d1beef8a91a368796c8945131
SSDEEP 96:ciiqSl4PSheV+Ww7OhiIXEQwxPp+mrkvvc4xX37YowiS9t:1+l4PzJN3Xdwi3c0ti
TLSH
T13EB1CA017255DA17D4F906B3ACAAC3EC6B247E83DE82030B75C4FF1F79326E64261595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\QCNG796W.8N8\1CEO9OWX.5WB\manifests\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02.manifest
Size 1KB
SHA256 665bc6817a6d5f562b3dd6d0248536879a34c057a18ff78b9324a9e391a88775
MD5 e12934bad7831d66034f6de67506420f
SHA1 b6340514efd0d95e21ca952e4fb49e6fbb62c63c
SHA512 9657ee285be5852e3208dfd3669740e7e58b0a899516e1b9092ab5a3ec24cd1464c340aa94b017f79d072ae4ec93bf112aadde174d2be4c000fb41ce7910fa98
TLSH
T12B41D11181C8FA250F3302C2BEEBE431979E5723158E194B7499AD9BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\QCNG796W.8N8\1CEO9OWX.5WB\manifests\scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf.cdf-ms
Size 7KB
SHA256 61e7020540c4bc58ecb4756ba7d9033011374f3b2b14e264e7a597d01b3b3835
MD5 ea97c5d79437824da8d2948de279c77b
SHA1 319766991ce25763c485b79c24d26fc9df28755e
SHA512 ecefab54d8a122c1ea6c979f2a1baa6c66109a82aa39b1978c0d5fb918534fc82d0220e27f17ee754fb19459aaa66daefdd9566cea9b452677bf5671384118f5
SSDEEP 96:aOOrPxnCTU748kFeV+WwwOh4863OO2WDIgoSKjVdjGAv+bQHuu/iVZHclj:TenAd8kaJcc3A2mdSAGpYj
TLSH
T1DCF176127390E912D1B80A339CAAC3ED7B797D96DE43470B70C4BB2FB5326E65722095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\QCNG796W.8N8\1CEO9OWX.5WB\manifests\scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf.manifest
Size 2KB
SHA256 62d5e8e172a93812c7daa3380ad84a86da0addb558519924f45e339c4ce46f95
MD5 53ab26b64de452e7cfbe60143a0ba458
SHA1 57d52b8c27bb38944416bfeb9438e5023cd7a3b0
SHA512 87350008595ded29636eeb7b3fa4e5f775796750eba5c7ddda25cef132f3f9f59a5b73c7e9ad086263ec9dec771d73eeff6fb2f6374491e86dc77ee0cda8ca72
TLSH
T1D751C31591C4FA350F3302C2BEEBE4709B9E5B23158E190B7099A99FCF2DA97474B067
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\QCNG796W.8N8\1CEO9OWX.5WB\manifests\scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6.cdf-ms
Size 2KB
SHA256 90d50db370ca98a874ee52b214d915e7e00d3eebebb1eafd18d830200aa3d878
MD5 bb8ade192987c7d01d4a30b0e61513e5
SHA1 2d754e05ac16f8a9604e87bf34036ef2966df14b
SHA512 69e103fd65b58c551de56ba98b0b4d4fddfba663152fb71251cade2d7cc5375cef7373353aa715628e002561cd96eae68d72a03c847c21db7be368a5e746c362
TLSH
T1325178057684EA67D67A0233ECD6D3D932757E82EF47030BB1C0BB6F3A716C59612092
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\QCNG796W.8N8\1CEO9OWX.5WB\manifests\scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6.manifest
Size 1KB
SHA256 9a12c29d45de7e20c7e9ef65f0afae9df2baf63c2de5ab91d2b1ffa7e4fa45c8
MD5 7b9dbfb89d98df763d60034f803e979c
SHA1 6dcf85c57edb2deceff9eeed2f41f3f245fb9d69
SHA512 57fbaf8db2fc629fa9836cfd23be68442140cb688776c927bbd171c6aabf378dbb3e800ff64f2d3cbc57b83f38cd55284a3afe927e5331f9b176e72b84475998
TLSH
T166113B0191C4FA361F3341D1BEE7E461A76D5B3314CE194BB0A9685F8B2AAD747470B3
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0007_none_0a65ab3dbb4427e4.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\QCNG796W.8N8\1CEO9OWX.5WB\manifests\scre..tion_0000000000000000_001a.0007_none_0a65ab3dbb4427e4.cdf-ms
Size 4KB
SHA256 198b1e061bbd78c8bf5eaf5e2f5d84a4a2e1974b2a32148ea661f1298bdee7c6
MD5 05cef5c881489ce6d47ebb1f8ba175e8
SHA1 69175b636805f793e4cf2fa12985eb3a8821daf9
SHA512 6f281d546d6f00e9a96929232ed0776d29142c283c54ee8813286af163017d9b68f7b9c8b7bee73ffadc870a4e48585b947e36882d6f6dcafbeaf7db68aba7e3
SSDEEP 96:oOUSGaz0EW0m5R/lpUmIkS2CVv74GacgJ2TzGuVIi:o7azORp9tjVJ2TXVr
TLSH
T161916180B780F933E64447B2ACD2D3C033357DE68DE8830B7498B72FAD366869A61655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\QCNG796W.8N8\1CEO9OWX.5WB\manifests\scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d.cdf-ms
Size 4KB
SHA256 2ffcc66058e2eb6cc37f695f330a258411bff2f49caa3c4fad20f880f1ce9daf
MD5 28343f1800ea42aaf91e85970c8e25ee
SHA1 ebbd1811369c37f9c77fde8a605d5bd83a2fb4d1
SHA512 40178e05fa74b6adfb859637afbe8927588a5087691636fe348a7a47f2237baed6529832ea18a3e7120eaf52fa290288521bcee25fd31d258190df3d3ac4bfd8
SSDEEP 96:9QADBUDqeV+Ww8Oh44cVGYHXRrI10j/UKzEkZEZz:/BilJsiVXRC0b6z
TLSH
T1F9A110027340EA27E5A50633ACA2C3DD3B797C82DE42420B71C07F2F75726E653361A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\QCNG796W.8N8\1CEO9OWX.5WB\manifests\scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d.manifest
Size 1KB
SHA256 e2cd552287be0e819f8691c834468bcf49023bf4f9598beb1fd4a42550e1dd01
MD5 219aa38b5278789dffbf782e507eda00
SHA1 8ac39ba1817be35c84b2ee0beeca1a69ca0610d7
SHA512 086c6adbb1bd71e979b6abc69ccb35d98983885046f168bbfa123a2bab5a5e11291ef7ad0003fce5217f9f87572b461c936d73f15039ae052653c56ce347fe73
TLSH
T13131F50191C4FA351F3302C1BEE7E4709B9E5B23158E190BB09A695FCF29A97434B073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\QCNG796W.8N8\1CEO9OWX.5WB\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\ScreenConnect.ClientService.exe
Size 93KB
SHA256 fa88997b02d98d2d2829b8d9f4aca92ef4ae55f0c21ed82db81ee86c423c9d46
MD5 8667c39f52f3fef8cc452e002c4a856b
SHA1 cecc186b75dc811800dc376a0eba6fe7c232ccdd
SHA512 11ce57245b224b53475c1c0b6b1763181c690dff1a0f8cedb4b9268f2a6b14207294fe08b6c335362cb25620ffe4ee99c1aebbfa1b1c37feec14c19e41fd062b
SSDEEP 1536:Mg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgkU0HMP7RekZg:1hbNDxZGXfdHrX7rAc6myJkgkU0Ha1e
TLSH
T12E935B13B5C28871D573093158E0DAB09A7FF9215E61DEAB3788022E4F742C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\QCNG796W.8N8\1CEO9OWX.5WB\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\ScreenConnect.WindowsBackstageShell.exe
Size 136KB
SHA256 4a2671841e0bd23ba1218bb46ab8206a2431a0119dacfae892022256e11259d6
MD5 b4f8cd448c9e299e035a60bd8268b0b5
SHA1 74b932b5fb28794c9a1e0caa054cec305f69a2ae
SHA512 310705a667e673ced9330c0e1f5bf489c5897080e049130d05c3ae0d8321a7975e78c413ec120554bc8465622b32178731fe484d64f085f46610e2ee8345a22d
SSDEEP 3072:4XNerVwv+ra5s550jHPTAf0NvKKNm0DyB+k:4KfoqqMWK1D
TLSH
T1DBD39E50BB59D526C5AE0E3BA4B2B71106B1B083DAD3C74B6C9822BD7E1CFC16F542C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\QCNG796W.8N8\1CEO9OWX.5WB\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\ScreenConnect.WindowsFileManager.exe
Size 115KB
SHA256 25175b7a9f75772a6e1aaea428102d9d3ef0f18896b423f0465b8bf229763b9c
MD5 5c448e2743ef0c78052ebdd46c950c80
SHA1 9124b319950a3dd5cd63462a65555d943e3b0067
SHA512 1150ea2d29dc13c14de32136e479f24d6d9f7aad06179133b88713d078ca2aa21ab399204e95838d9f76c4b1d8fd5b955d56f0520b9d38e9fcf2c78696d146ca
SSDEEP 1536:BgnaeGOSYhevKypfuqvhUZI5BLP+VVVVVVVVVVVVVVVVVVVVVVVVVSg1Q7Tl:BgnaxrYhevKy1uNuBLNwQt
TLSH
T176B3295135266231DEC9C533A051DAB099337F6607FEC2BE2CA1BA3629F13943E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1xybv0ng.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\QCNG796W.8N8\1CEO9OWX.5WB\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\1xybv0ng.newcfg
Size 660B
SHA256 0ce711da15e0a6d38e7c41cff2e8c1288991acaca5b01fb76ce289ae6bf05a12
MD5 600f14134e924deb4d3cd7bd9cd53891
SHA1 22189282e11bfa43a1ad446187892c7fc63a13af
SHA512 7d5d226b484b213b1c5b6b5f432f8eff924461d0e9ab8b05711cf45e2c316a7caa08d23245036756a5a2c32c679dbec8c501074cc4c4502ef2a96dc8b06d5b6b
TLSH
T1D701285971C0AE8B03B36A33C5228741EE715A9B016620D874AE217B9F304DF07E32DE
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\QCNG796W.8N8\1CEO9OWX.5WB\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\ScreenConnect.WindowsClient.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\QCNG796W.8N8\1CEO9OWX.5WB\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\user.config
Size 520B
SHA256 53dfb5384e9a6d94e914fa50c3c9e51d520a288a4dc9c2f98abfe09ad58aab2c
MD5 23f45a71784b000dbf7524177f6ade1b
SHA1 209479ca21e8ee165d1c3db1351cdc6d71ae7887
SHA512 61d6284e5e1e3c83a4a8236bfdef07a334f2c25aded029e82aac65a9aa61a25798fe28485929378c6b9dbf876bb811fb85501644abaed80ffd84f84ffa0f20b7
TLSH
T109F0E2A531806E4B07A36E23C5128741EE726A9B0561249874AF627A9F315DE03A32DE
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6KPCMBB3.TLC\4MDL2KV7.63Y\ScreenConnect.Client.dll
Size 628KB
SHA256 8ed29767837e883bc9577cc4fb3705d60dedd7fe8d28515aa26646e0302bed24
MD5 4a35c09d240c685b085ce550f68d9252
SHA1 1b85f45bae4dda9836376963a901aacc4049feaf
SHA512 0ae85ae7e71038a39ce6400ddab38bb39e8f8d3ae1546c56ce4d1dd27c47919a01529f81d4539ff917e3565a81feb3bee706bd1ebb8e8f1e837373207c774650
SSDEEP 12288:6cZ7YfSLFwTE5Hzhmj5KazHTEavSW7OQniu3bsAuaq:6cWCwA5hERzEn8qu3bPuaq
TLSH
T1B0D4C04DE794AD29ED6E0B73B59127209AB0ACCA945BE30F1DA4737D4D723847E4C2C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6KPCMBB3.TLC\4MDL2KV7.63Y\ScreenConnect.ClientService.dll
Size 192KB
SHA256 2ccff7ba32fb18af838459307fd2bb9ed1e4cd1805cf0675eccdaad31827e1e9
MD5 616dbe982fa7cfcdf79b8bba3187833b
SHA1 3a30149340d6a9f94c8027916a8634c329ffbf94
SHA512 b4b26a064a8333afd9ad6da3ac3f361c307ca5c93f072672d53206974a92b4df1ac0f39d23c65b3fdac29c829ef951580806d293642a32c08b0eb4df88cdc0eb
SSDEEP 3072:lyuiZD7L1WbX2Ma+rYmh53mP8vQIMAw8yNgaYxlfQiVwKXorZc:uvL62sbe8PFyOxFO1u
TLSH
T1FB14AF48BB5AD416C99F0E3BE861B26002F1A443DDE7D78F6C8862DE1E563C51F543CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6KPCMBB3.TLC\4MDL2KV7.63Y\ScreenConnect.Core.dll
Size 1.3MB
SHA256 8e868637ac960e1c7c98cba86ee157a25a37aa560434ff2f1e4abdf81774d5d6
MD5 9bc65903fe3e5b080a89197e231827d9
SHA1 33c304d9dc24741e9c888725bf5f6f70b0f782bc
SHA512 b33123e4f772802ad2aab6d153b926586b5952239ac3cc066cd56e928c080395163154eb266ddcc04072b789851ff9c410140437b70655d378e3bb4cc6b9a06d
SSDEEP 24576:zBYjbswXly3xJCFuC5onhQ6tN7f3vtNk1KW2eQ2JL:unxXHul7f31zTeQ2JL
TLSH
T179558D8E7B89E627DA7D0A3784602214A7B0E0D25F67D70B69E0FB7D0C953A87E451CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6KPCMBB3.TLC\4MDL2KV7.63Y\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 91b1c12ab90387e29e1bc357cbf9c0edc829872e9a964d2538ea2f5ac1eece3f
MD5 3f4816cfcb143113bac5d7564f664fd4
SHA1 7a7fe42dfea511ab33cebb757acac38359628427
SHA512 7af0408163c1a4d73a6a9219825da1cf30b3ee97af10bc9af2142aaf8f39742a2ad0ea7adb1caf0ec20783dcb14b846de9e7259d4cc3f83346f00e39871f55b0
SSDEEP 24576:qZbsJXFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKPTsO:PXJkGYYZTk+T1iH7efPjre
TLSH
T1E295AD41E6C368FAD46B053888BE632AB7747C040355CBFB97D4AA392D337C09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6KPCMBB3.TLC\4MDL2KV7.63Y\ScreenConnect.WindowsClient.exe
Size 1.5MB
SHA256 dbf62f4d0d159245a18a55627ee1477214188e4973b4af9be3cd4977293bc845
MD5 3e998dcaa9f9531933fed9ddd51e57c0
SHA1 799cd91f67f0458ec9838ea08ca8be33f6ccd3be
SHA512 6d9a4dca64c98e8b71b88112f835265c56e79c444c93688a488f97bfb707857f87e51c0dd7b6c7e913c8c2566f05799f7e9c6034ba16b3722efb430596bd4623
SSDEEP 24576:hlzNWqSl6HT38IIT9zCrReOAu4vbBkZxcKAPH4PDA:hRNWqi6IIIBzCFMNBNz
TLSH
T14F759E89BE99EE3BC86F077780602114A7F08891CF63DB575894B77E1DC93C46D48A8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6KPCMBB3.TLC\4MDL2KV7.63Y\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 1b2decf03e1be09ce872495755fcd17b2eef7c2b760ebabdb9fc151eb910835d
MD5 7e57755b0dcc1669d7a40505cc5478b3
SHA1 4e56b2f8ea59cfa8266801d8b0df9ed8c192adfe
SHA512 2d91095b465ad3ff0ccec6e9f07c6856dc3175745805197ddbee1380cc26b8cecacf5e678853208938a0cc46fd9d3c62f3db5d3759b0f8ab4dc3b145a3049c51
SSDEEP 192:oRombespJpKppvp3+pDMD7H9UFUlQnKVUD:/mbespJp+pvpOpDcdaUQnqO
TLSH
T16BF1AC5688C07D21573381C4FEE39914BD157F2302AE148EBC8D19AF9FB65899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6KPCMBB3.TLC\4MDL2KV7.63Y\ScreenConnect.WindowsFileManager.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

1CZWVJXO.TVN.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\GGLM6B7B.HAJ\1CZWVJXO.TVN.application
Size 127KB
SHA256 14c78bfcfc4c35efa0c795f2e21133ec32a439e5e0a64a3ee42eff165c9fe18b
MD5 e97754b4ac5feb689141aa6ab4339cd7
SHA1 59537744e5c5759f188957201cd0bd15831afe08
SHA512 8c2e7deff38eaba5b15d26745cf598b38d6eaf09307499aa58f8821dffe4d063422015664ece8838d9863044b92b60bb2aedb4787f883412fc75acd7abb1b1a2
SSDEEP 1536:4zpjCtVfbzcCU5XxVNwWLVIRTLtjwpt0/K4EnIXh+3nJKQ/IuKE:8tVNtJIRTLKpt0/Gnu2nJX1
TLSH
T1AED3D63A8F30F4C0877DB021D1652D6B3DC11B979B731FACDA0A186A0E69756EF4A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2456-345-0x0000000000FA0000-0x0000000001130000-memory.dmp

Download

memory/3492-18-0x0000000075130000-0x00000000758EC000-memory.dmp

Download

memory/3492-16-0x0000000075130000-0x00000000758EC000-memory.dmp

Download

memory/3492-0-0x0000000075142000-0x0000000075143000-memory.dmp

Download

memory/3492-12-0x0000000075142000-0x0000000075143000-memory.dmp

Download

memory/3492-13-0x0000000075130000-0x00000000758EC000-memory.dmp

Download

memory/3492-11-0x0000000009B70000-0x0000000009D56000-memory.dmp

Download

memory/3492-10-0x0000000006380000-0x0000000006412000-memory.dmp

Download

memory/3492-9-0x0000000006850000-0x0000000006E0A000-memory.dmp

Download

memory/3492-8-0x0000000075130000-0x00000000758EC000-memory.dmp

Download

memory/3492-6-0x0000000005E60000-0x0000000005ECE000-memory.dmp

Download

memory/3492-7-0x0000000075130000-0x00000000758EC000-memory.dmp

Download

memory/3492-5-0x0000000075130000-0x00000000758EC000-memory.dmp

Download

memory/3492-4-0x0000000005C10000-0x0000000005D62000-memory.dmp

Download

memory/3492-3-0x0000000075130000-0x00000000758EC000-memory.dmp

Download

memory/3492-2-0x00000000019C0000-0x00000000019CE000-memory.dmp

Download

memory/3492-1-0x00000000019A0000-0x00000000019A8000-memory.dmp

Download

memory/4856-14-0x000001F813330000-0x000001F813338000-memory.dmp

Download

memory/4856-70-0x000001F8325D0000-0x000001F832672000-memory.dmp

Download

memory/4856-64-0x000001F8327C0000-0x000001F832910000-memory.dmp

Download

memory/4856-58-0x000001F832840000-0x000001F8329D0000-memory.dmp

Download

memory/4856-52-0x000001F8323E0000-0x000001F832414000-memory.dmp

Download

memory/4856-46-0x000001F832900000-0x000001F832AE4000-memory.dmp

Download

memory/4856-36-0x000001F832290000-0x000001F8322E0000-memory.dmp

Download

memory/4856-27-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp

Download

memory/4856-26-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp

Download

memory/4856-25-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp

Download

memory/4856-24-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp

Download

memory/4856-23-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp

Download

memory/4856-22-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp

Download

memory/4856-21-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp

Download

memory/4856-20-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp

Download

memory/4856-19-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp

Download

memory/4856-17-0x00007FFDBF02F000-0x00007FFDBF030000-memory.dmp

Download

memory/4856-15-0x000001F82D9C0000-0x000001F82DB48000-memory.dmp

Download

memory/4856-374-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads