3bfb7d791369e27c3b07a4bae9ae7b7a95168a78f141f0388e94ec79ea034bad

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-11_1de29e1b40e18031f34062bbb027a837_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 3.7MB
Sample261113-tp87psdv5w
SHA256 3bfb7d791369e27c3b07a4bae9ae7b7a95168a78f141f0388e94ec79ea034bad
MD5 1de29e1b40e18031f34062bbb027a837
SHA1 0d4d7614188389d6785f078841ecf764bcdace70
SHA512 a3ff935b263bfe4d4bbc94f13cdd9ad03ab3dafe733abe472aa99eba76047d8edbc39a2aac6d005bc0d619a4c97cba52eb95f20c49b77fc32382c0d6ab3d2937
SSDEEP 49152:mnxXHul7f31zTeQ2JuXJkGYYZTk+T1iH7efPjrCotzDAuC:4e7fFngu4M6efPjXe
TLSH
T13306BF4AFBC6A677D83E063684662314A3B4F4454B56C7AB6AD0BB3D1C323D06E253CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 7 IoCs

flow	pid	Process
16	2272	dfsvc.exe
16	2272	dfsvc.exe
16	2272	dfsvc.exe
16	2272	dfsvc.exe
16	2272	dfsvc.exe
16	2272	dfsvc.exe
16	2272	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
4992	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\CLPPNHVK.53Q\BKDJ3JX7.GWP\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-11_1de29e1b40e18031f34062bbb027a837_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-11_1de29e1b40e18031f34062bbb027a837_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.WindowsClient.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-11_1de29e1b40e18031f34062bbb027a837_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\lock!060000009fcf580ee0080000d40d00000000000000000000 = 30303030303865302c30316464373338613265323566623139	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_3da05c4de3687b7b	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf\lock!0e0000009fcf580ee0080000d40d00000000000000000000 = 30303030303865302c30316464373338613265323566623139	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d\lock!1400000068d3580e80130000c81200000000000000000000 = 30303030313338302c30316464373338613335336166613132	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_00000000000000 = 68747470733a2f2f6d696e7574656d616e68656c702e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e372e362e393738332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\Files\ScreenConnect.WindowsFileManager.exe.confi = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\scre..ient_420d02d3849b7992_001a.0007_none_98937f24dd	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2\SizeOfStronglyNamedComponent = 73e0140000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\scre..core_420d02d3849b7992_001a.0007_none_374ca600f5 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6\lock!0a0000009fcf580ee0080000d40d00000000000000000000 = 30303030303865302c30316464373338613265323566623139	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "PHGQ072JKE8Z6P40RC4OCYRK"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6\implication!scre..tion_0000000000000000_001a.0007_20d = 68747470733a2f2f6d696e7574656d616e68656c702e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e372e362e393738332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\implication!scre..tion_0000000000000000_001a.0007_20d = 68747470733a2f2f6d696e7574656d616e68656c702e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e372e362e393738332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\scre..core_420d02d3849b7992_001a.0007_none_374ca600f5	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2\lock!1c00000068d3580e80130000c81200000000000000000000 = 30303030313338302c30316464373338613335336166613132	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32362e372e362e393738332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\lock!0400000068d3580e80130000c81200000000000000000000 = 30303030313338302c30316464373338613335336166613132	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_00000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\Files\ScreenConnect.WindowsBackstageShell.exe.co = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32362e372e362e393738332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02\SizeOfStronglyNamedComponent = 7c281e0000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\PreparedForExecution = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0007_f4da863c93273aba	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32362e372e362e393738332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0007_none_0a65ab3dbb4427e4\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e372e362e393738332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\SubstructureCreated = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02\lock!0a00000068d3580e80130000c81200000000000000000000 = 30303030313338302c30316464373338613335336166613132	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0007_f4da863c93273aba	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\lock!010000009ccd580ee0080000d40d00000000000000000000 = 30303030303865302c30316464373338613265323566623139	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_none_0a65ab3dbb4427e4\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e372e362e393738332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_f4da863c93273aba	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498a = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d\Files\ScreenConnect.ClientService.dll_e781b1c636 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 680074007400700073003a002f002f006d0069006e007500740065006d0061006e00680065006c0070002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e003f0068003d00680065006c0070002e006d0070006900680071002e0063006f006d00260070003d0032003000350035003600260073003d00320062003300300030003300350062002d0030003500650066002d0034003800660033002d0062006500630036002d0035003900620066006100350036006600330038006300630026006b003d0042006700490041004100410043006b00410041004200530055003000450078004100410067004100410042004500410041004100420054006c0079007900380043007500470046007200440064004e006700390050006f00680072005300660037006800410077005a004d004f006b0055004b00670034006b0038006700480071007000300052004600700076006f00490039004c0051006a0037006700410076007800710036004f006900670068007900520059006c00620076006c0035005600340050004b00390076003600760058003800620049004f004a004f00770064004e0034004d0032005a007500520057004f004a00250032006600710025003200660057007400780043005400780051004a004e00760042006f0050006800250032006200470049006b0064003200530032002500320066004100530059007200670061005000610064003800550064006400740043003900660079007a006f003900540041003000510047005a0035004100430033004b00300054004100480046005800620075003000510058006f005800380067004c005200450033007a00630063005000420030003200670066004e00660053006b0069007200340025003200620041006400640065007500460079005700750071006100380043006b007900420055006b006c006600390043003100410030005600720044004300650031006e006c004c003800640068003200750048007800660039004e004b00530035007700300072007100380025003200620038004d00250032006600530069006f00770066004e0074005000390045005900390066004e006800410031004c0025003200660038005400320077002500320062006100770066005200540071004e0052004100370033006f004a0033003200740075007100470044003400370066004d004c00410041005500350063005100550079006200730055004a00700071002500320066004e00740051004200310049004200560059006a004c0053006b0045004c0036006800680043005700680039006c006e006d007900690056005a0069003800260072003d00260069003d0033003300370031000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32362e372e362e393738332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_none_0a65ab3dbb4427e4	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_20de1e6ba74b6119	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\scre..ient_420d02d3849b7992_001a.0007_none_cd6203d304 = 01	dfsvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\OnlineAppQuotaUsageEstimate = "6337393"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02\lock!0c0000009fcf580ee0080000d40d00000000000000000000 = 30303030303865302c30316464373338613265323566623139	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\CLPPNHVK.53Q\BKDJ3JX7.GWP\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2476	2026-11-11_1de29e1b40e18031f34062bbb027a837_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	2272	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2272	2476	2026-11-11_1de29e1b40e18031f34062bbb027a837_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	93
PID 2272 wrote to memory of 4992	2272	dfsvc.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-11-11_1de29e1b40e18031f34062bbb027a837_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-11_1de29e1b40e18031f34062bbb027a837_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Modifies registry class
    PID:4992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\manifests\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7.cdf-ms
Size 14KB
SHA256 e545a92e261c37cf72bba124af776a4be0a9f4e691f4de02dc8a68b44ccd1955
MD5 bf1ebea50a0c515c3e55e3a53b0a9f67
SHA1 ffb372311d7f20e76c5147ba96c5ea774a6f6b66
SHA512 01e8035cdd50ac22de37900be5d70a8239a5007637815f42d5e7159420a0dbb2be7317fa8ac4b2d233b9c7b7c12f8f83f14b291aa6bff9a74d50b1f425c73676
SSDEEP 192:LrEwHfSLaSMNDQrp9oSe1rpwv5FjTyKDaJf45qvJ0qYHvm/j2Whq5gMRYE94:L/IqUp93g9wveJqqYuzE94
TLSH
T1C462B422F758F033F2625B329CB7E7C167147EAA6EA1119BB081373D98711898F362D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\manifests\scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2.cdf-ms
Size 3KB
SHA256 e8e627f7d27870548d1f0f24f23d3c41190964f8c67712357a97433602b84754
MD5 24385cf99cf51fdf5f462d46dfacd96d
SHA1 1263fe680dbbef1ad4b3d473e3d38aad720f63fe
SHA512 aa365e95e58aa4e688728d95c4eb216a450ebe615e9e396e4c11d40ffc9c3ec1a5244361ffc34c3e3b19f76c15360649c5c5345b75e95fa9e8dc73d4be65f693
TLSH
T1EA614E027744CA13EA790732ACF6D2DA6FB83E83CE81810FB4C07B5F78364A556112A0
MD5 SHA1 SHA512 TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\manifests\scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2.manifest
Size 1KB
SHA256 ede66ce32d594547cde8019666ac28a765f0794ea6702374e7a54e1cb6405371
MD5 deee761ec1bb0649fe7030b219a8c6db
SHA1 8729fc42a89f5e8fde6e7bf58a5c14fb8f075db9
SHA512 82fe38b4473cfda697e4333b58dd086e30568cc430a28741a1ed56d574b0c1841200d4ff2bb2ab13adfea519ce9670e5b53d934e078ba02fa25fbd59fbd7fd67
TLSH
T10D21370181C8FA261F3302D2BEE7E42197AE5B33188D194B74A9699FCB2DAD64747173
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\manifests\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02.cdf-ms
Size 5KB
SHA256 5b67a82e9341f5b7db58a0769088f6751f91d073db88b18f4a2565b9d687591d
MD5 9c45c40eed83ebf48128dc5cd5e6af42
SHA1 1ccc0f40499c1a9e23644640894ba4fa1b33d7f3
SHA512 568bf8463c05b0bd36288786d1da28dc2f341c06dd67f27c0997d145fc07771738bad6cb345e37add355e89528368897179e90b72eab53c0ee5f30c436dff45b
SSDEEP 96:5iiqSl4PS3eV+Ww7OhiIn3UJoNt+xB0idMvEnRlGwiS9t:w+l4PdJN3nBSH3Mri
TLSH
T17BB1FE11B254DE17E5790633ACAAD3EC2B357E93DE02431B70C4BF2F79326E652212A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\manifests\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02.manifest
Size 1KB
SHA256 665bc6817a6d5f562b3dd6d0248536879a34c057a18ff78b9324a9e391a88775
MD5 e12934bad7831d66034f6de67506420f
SHA1 b6340514efd0d95e21ca952e4fb49e6fbb62c63c
SHA512 9657ee285be5852e3208dfd3669740e7e58b0a899516e1b9092ab5a3ec24cd1464c340aa94b017f79d072ae4ec93bf112aadde174d2be4c000fb41ce7910fa98
TLSH
T12B41D11181C8FA250F3302C2BEEBE431979E5723158E194B7499AD9BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\manifests\scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf.cdf-ms
Size 7KB
SHA256 d56baf24ffb01a957cbd7227f0836cafdea8bf07f556289d2d1bb0fd425762dc
MD5 3ce9e67b64cee15123e1bb40b7cfaf12
SHA1 961ecc465f4d4af52bba599236ac376f77e1aaed
SHA512 686399c3003603d47f63b3f5d19103f07a106a55615e95027655bbaa790c88860ff440b546d37a3e8a34dc493b4cccdff19973aae88c2281f780a34b2b800ac9
SSDEEP 96:QOOrPxnCTU748kFeV+WwwOh486QXMVWUs22/mhe1pja0itoOGfXx4SA1biVZHclj:BenAd8kaJccQuWUsH/l/5itg7lYj
TLSH
T16FF1F002B340D923D5B80A339CABC3DD2B787D97DE82570B70C4BB2FB57269657122A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\manifests\scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf.manifest
Size 2KB
SHA256 62d5e8e172a93812c7daa3380ad84a86da0addb558519924f45e339c4ce46f95
MD5 53ab26b64de452e7cfbe60143a0ba458
SHA1 57d52b8c27bb38944416bfeb9438e5023cd7a3b0
SHA512 87350008595ded29636eeb7b3fa4e5f775796750eba5c7ddda25cef132f3f9f59a5b73c7e9ad086263ec9dec771d73eeff6fb2f6374491e86dc77ee0cda8ca72
TLSH
T1D751C31591C4FA350F3302C2BEEBE4709B9E5B23158E190B7099A99FCF2DA97474B067
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\manifests\scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6.cdf-ms
Size 2KB
SHA256 f7d2fbf18ad58c1d6a47491d0c53b8c9d5fa5f303aeddcbd04754217089d7acf
MD5 3a7bb73f24149eb57887fc2ffb5d6fe4
SHA1 6db4864ef57cf537eaf79816df3f72dd66d14170
SHA512 726d1eb47ec978f541077aa4b70c776e380485e9300e893bad8e72c389628a02e2897017a6874cdd47efa95d4175d675459f985f7db916d14330e113c135fb25
TLSH
T1325186057784EA67D67A0633ECD6D2E932357E82EF07030BB180BB7F6A316C15612092
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\manifests\scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6.manifest
Size 1KB
SHA256 9a12c29d45de7e20c7e9ef65f0afae9df2baf63c2de5ab91d2b1ffa7e4fa45c8
MD5 7b9dbfb89d98df763d60034f803e979c
SHA1 6dcf85c57edb2deceff9eeed2f41f3f245fb9d69
SHA512 57fbaf8db2fc629fa9836cfd23be68442140cb688776c927bbd171c6aabf378dbb3e800ff64f2d3cbc57b83f38cd55284a3afe927e5331f9b176e72b84475998
TLSH
T166113B0191C4FA361F3341D1BEE7E461A76D5B3314CE194BB0A9685F8B2AAD747470B3
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0007_none_0a65ab3dbb4427e4.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\manifests\scre..tion_0000000000000000_001a.0007_none_0a65ab3dbb4427e4.cdf-ms
Size 4KB
SHA256 e0dfc730bd9729ab9294f0b96e7238eea0a0eb04076a0314a49a8bf255885941
MD5 7a85ab27b7abcf61b062f80c826b4936
SHA1 108557824e617d929a5af86c24fa2a71c0d8d753
SHA512 d9d87e00cb2a2f5270281c4fb62129f52479f335876507c880452a5744205462f0889519f19172466b6d5249421cb5e29baaae0a8620d843453d3f70c6baa715
SSDEEP 48:FP/mrIEAqzIvGggm0Ru9o0m5RD7lpU7gFUTUETkSif4sQgbmZFms4Ch+UQRcH:pOUSGT0EW0m5R/lpUmIkS0QPfmvVUQRi
TLSH
T18B913E80B780F823E61447729CE3D2D032357DA64FD6971B70987B2FAD367C596222A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\manifests\scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d.cdf-ms
Size 4KB
SHA256 228a574a545098d1c19dfa0b9c23da08d60da8915abd44ead13b1a27f9374d78
MD5 24f951921fa52a17b46662a953ea5d9c
SHA1 ef07682ddee4557c7415a3b1672c05c6ed3df97a
SHA512 6547e21b801d0d13fdd3b2faac5d8305461ff4a7cbc39e4c06c546784a29f0c998fdadf9be32ab4025eb5239d05ed677d685479f824159d429f54342ac1019b5
SSDEEP 96:jQADBUDqeV+Ww8Oh44cVGYHXRrI10j/c/QkZEZz:VBilJsiVXRC046z
TLSH
T1BBA110027344EA27E5A50633AC96C3ED3B797D83EE42020B71C47F2F75325E643261A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\manifests\scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d.manifest
Size 1KB
SHA256 e2cd552287be0e819f8691c834468bcf49023bf4f9598beb1fd4a42550e1dd01
MD5 219aa38b5278789dffbf782e507eda00
SHA1 8ac39ba1817be35c84b2ee0beeca1a69ca0610d7
SHA512 086c6adbb1bd71e979b6abc69ccb35d98983885046f168bbfa123a2bab5a5e11291ef7ad0003fce5217f9f87572b461c936d73f15039ae052653c56ce347fe73
TLSH
T13131F50191C4FA351F3302C1BEE7E4709B9E5B23158E190BB09A695FCF29A97434B073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\ScreenConnect.WindowsBackstageShell.exe
Size 136KB
SHA256 4a2671841e0bd23ba1218bb46ab8206a2431a0119dacfae892022256e11259d6
MD5 b4f8cd448c9e299e035a60bd8268b0b5
SHA1 74b932b5fb28794c9a1e0caa054cec305f69a2ae
SHA512 310705a667e673ced9330c0e1f5bf489c5897080e049130d05c3ae0d8321a7975e78c413ec120554bc8465622b32178731fe484d64f085f46610e2ee8345a22d
SSDEEP 3072:4XNerVwv+ra5s550jHPTAf0NvKKNm0DyB+k:4KfoqqMWK1D
TLSH
T1DBD39E50BB59D526C5AE0E3BA4B2B71106B1B083DAD3C74B6C9822BD7E1CFC16F542C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\ScreenConnect.WindowsFileManager.exe
Size 115KB
SHA256 25175b7a9f75772a6e1aaea428102d9d3ef0f18896b423f0465b8bf229763b9c
MD5 5c448e2743ef0c78052ebdd46c950c80
SHA1 9124b319950a3dd5cd63462a65555d943e3b0067
SHA512 1150ea2d29dc13c14de32136e479f24d6d9f7aad06179133b88713d078ca2aa21ab399204e95838d9f76c4b1d8fd5b955d56f0520b9d38e9fcf2c78696d146ca
SSDEEP 1536:BgnaeGOSYhevKypfuqvhUZI5BLP+VVVVVVVVVVVVVVVVVVVVVVVVVSg1Q7Tl:BgnaxrYhevKy1uNuBLNwQt
TLSH
T176B3295135266231DEC9C533A051DAB099337F6607FEC2BE2CA1BA3629F13943E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3zc2owcg.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\3zc2owcg.newcfg
Size 834B
SHA256 e215ca724ea0715922edb7bf80e147497defa1a3ca4487f6e18aa103c542446b
MD5 7ec4f5870dd64bdcf53fbb06e084a99e
SHA1 30eef4837392ae6ab0c168487644acbe4f66834d
SHA512 0d1010632f1f0a7cb94b58709e95129d0554feef49bcac2d457f92137509c4184647febd29c808154830673106c6f57610aadeb1924d4ab4dda899d569d730b2
TLSH
T130012D5971C1AE8A02732932C5314781ED71175B056660D834EE21379F704DB07E32EE
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\ScreenConnect.WindowsClient.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

brhk0fah.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\brhk0fah.newcfg
Size 660B
SHA256 0ce711da15e0a6d38e7c41cff2e8c1288991acaca5b01fb76ce289ae6bf05a12
MD5 600f14134e924deb4d3cd7bd9cd53891
SHA1 22189282e11bfa43a1ad446187892c7fc63a13af
SHA512 7d5d226b484b213b1c5b6b5f432f8eff924461d0e9ab8b05711cf45e2c316a7caa08d23245036756a5a2c32c679dbec8c501074cc4c4502ef2a96dc8b06d5b6b
TLSH
T1D701285971C0AE8B03B36A33C5228741EE715A9B016620D874AE217B9F304DF07E32DE
MD5 SHA1 SHA512 TLSH

Submit Download

cmkugdee.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\cmkugdee.newcfg
Size 834B
SHA256 97caf4f10995e63efb6fd0417562840fc0af9ece7a368c1e17b72a176e68ef36
MD5 c7b34ee13f62fffbc48eb602e9e8a77d
SHA1 2a280ffdc2a843c10020792c0a2f6e78de8a39ba
SHA512 69cfecd824d2ccb827326975da52ca64182d47d19f7953d2e9c6d62ca3ac9e57395875c5567085735876401f46ce14ff0a24bcbb52d80f072c9c884a19ff3431
TLSH
T171012D5971C4AE8A02736932C5314781ED71175B016A60E838AE61379F704DB07E32DD
MD5 SHA1 SHA512 TLSH

Submit Download

mimgigij.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\mimgigij.newcfg
Size 834B
SHA256 662c0e196d293726dc55da0ac6d6dade7dbcdfc1b32a69db3162572d9fd4e4ab
MD5 58927b28699cdc19f78ccb2afde7767e
SHA1 bdbb8f98d6a562448a711d6a8bb221b17bc01298
SHA512 c7ed3641b31e251a8c04ff07cb63996ef14695b554b69937fe3919943d5d2119219acd41dfd21158d47deb5ec54f70f70fbdf4a76dd8be4d70ac1c059884026c
TLSH
T1E8012D5971C0AE8A02732932C5314781ED71175B016660D874EE21379F704DF0BE32DE
MD5 SHA1 SHA512 TLSH

Submit Download

reit12gr.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\reit12gr.newcfg
Size 834B
SHA256 acd7357c23e7240550eb54e686d21a73c77b452380d19b6db82c283cfb5a5692
MD5 4c86fc04b255acb7510535fdd1c6a399
SHA1 9961f2353c33e1a13c1e149c1a94f3eea1739b41
SHA512 bd160d9f96a358362ca3e598881604b67c046c228013802c5fcff1902b01cf427e08e0a28933b9d4e6157392de84e42aa76ec8621c17470d738584f5ca0ba397
TLSH
T11A012D5971C0AE8A02736932C5314781ED711B5B016660D838AE21379F704DB07E32DD
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\user.config
Size 520B
SHA256 53dfb5384e9a6d94e914fa50c3c9e51d520a288a4dc9c2f98abfe09ad58aab2c
MD5 23f45a71784b000dbf7524177f6ade1b
SHA1 209479ca21e8ee165d1c3db1351cdc6d71ae7887
SHA512 61d6284e5e1e3c83a4a8236bfdef07a334f2c25aded029e82aac65a9aa61a25798fe28485929378c6b9dbf876bb811fb85501644abaed80ffd84f84ffa0f20b7
TLSH
T109F0E2A531806E4B07A36E23C5128741EE726A9B0561249874AF627A9F315DE03A32DE
MD5 SHA1 SHA512 TLSH

Submit Download

xc3pwnko.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\2ETRLNMY.17R\ODAR1MKB.B87\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\xc3pwnko.newcfg
Size 834B
SHA256 633bbc5da71262da523c951412d1c5d5a7664f26b3dab1d1bb1e0704955ea9c6
MD5 9d7047e7be1992a1e3a2746fbe3de32d
SHA1 b4766c0503d82ea24223c284f0fc854453e820ec
SHA512 2a9d40bb8090422983c5dcf6486333ee51e3c1d1cc00802d4e4eec64a8e4ce78c9f0c4b6dfd1bb7e3cff648990f7fc0b8439f410fefaf8d3081b58ff419325aa
TLSH
T11E012D5971C0AE8A02732933C6314781ED71175B016660E834EE21779F704DB07E32DE
MD5 SHA1 SHA512 TLSH

Submit Download

5VZR5KN7.B72.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\5GQTKO2E.HRE\5VZR5KN7.B72.application
Size 127KB
SHA256 14c78bfcfc4c35efa0c795f2e21133ec32a439e5e0a64a3ee42eff165c9fe18b
MD5 e97754b4ac5feb689141aa6ab4339cd7
SHA1 59537744e5c5759f188957201cd0bd15831afe08
SHA512 8c2e7deff38eaba5b15d26745cf598b38d6eaf09307499aa58f8821dffe4d063422015664ece8838d9863044b92b60bb2aedb4787f883412fc75acd7abb1b1a2
SSDEEP 1536:4zpjCtVfbzcCU5XxVNwWLVIRTLtjwpt0/K4EnIXh+3nJKQ/IuKE:8tVNtJIRTLKpt0/Gnu2nJX1
TLSH
T1AED3D63A8F30F4C0877DB021D1652D6B3DC11B979B731FACDA0A186A0E69756EF4A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\CLPPNHVK.53Q\BKDJ3JX7.GWP\ScreenConnect.Client.dll
Size 628KB
SHA256 8ed29767837e883bc9577cc4fb3705d60dedd7fe8d28515aa26646e0302bed24
MD5 4a35c09d240c685b085ce550f68d9252
SHA1 1b85f45bae4dda9836376963a901aacc4049feaf
SHA512 0ae85ae7e71038a39ce6400ddab38bb39e8f8d3ae1546c56ce4d1dd27c47919a01529f81d4539ff917e3565a81feb3bee706bd1ebb8e8f1e837373207c774650
SSDEEP 12288:6cZ7YfSLFwTE5Hzhmj5KazHTEavSW7OQniu3bsAuaq:6cWCwA5hERzEn8qu3bPuaq
TLSH
T1B0D4C04DE794AD29ED6E0B73B59127209AB0ACCA945BE30F1DA4737D4D723847E4C2C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\CLPPNHVK.53Q\BKDJ3JX7.GWP\ScreenConnect.ClientService.dll
Size 192KB
SHA256 2ccff7ba32fb18af838459307fd2bb9ed1e4cd1805cf0675eccdaad31827e1e9
MD5 616dbe982fa7cfcdf79b8bba3187833b
SHA1 3a30149340d6a9f94c8027916a8634c329ffbf94
SHA512 b4b26a064a8333afd9ad6da3ac3f361c307ca5c93f072672d53206974a92b4df1ac0f39d23c65b3fdac29c829ef951580806d293642a32c08b0eb4df88cdc0eb
SSDEEP 3072:lyuiZD7L1WbX2Ma+rYmh53mP8vQIMAw8yNgaYxlfQiVwKXorZc:uvL62sbe8PFyOxFO1u
TLSH
T1FB14AF48BB5AD416C99F0E3BE861B26002F1A443DDE7D78F6C8862DE1E563C51F543CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\CLPPNHVK.53Q\BKDJ3JX7.GWP\ScreenConnect.ClientService.exe
Size 93KB
SHA256 fa88997b02d98d2d2829b8d9f4aca92ef4ae55f0c21ed82db81ee86c423c9d46
MD5 8667c39f52f3fef8cc452e002c4a856b
SHA1 cecc186b75dc811800dc376a0eba6fe7c232ccdd
SHA512 11ce57245b224b53475c1c0b6b1763181c690dff1a0f8cedb4b9268f2a6b14207294fe08b6c335362cb25620ffe4ee99c1aebbfa1b1c37feec14c19e41fd062b
SSDEEP 1536:Mg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgkU0HMP7RekZg:1hbNDxZGXfdHrX7rAc6myJkgkU0Ha1e
TLSH
T12E935B13B5C28871D573093158E0DAB09A7FF9215E61DEAB3788022E4F742C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\CLPPNHVK.53Q\BKDJ3JX7.GWP\ScreenConnect.Core.dll
Size 1.3MB
SHA256 8e868637ac960e1c7c98cba86ee157a25a37aa560434ff2f1e4abdf81774d5d6
MD5 9bc65903fe3e5b080a89197e231827d9
SHA1 33c304d9dc24741e9c888725bf5f6f70b0f782bc
SHA512 b33123e4f772802ad2aab6d153b926586b5952239ac3cc066cd56e928c080395163154eb266ddcc04072b789851ff9c410140437b70655d378e3bb4cc6b9a06d
SSDEEP 24576:zBYjbswXly3xJCFuC5onhQ6tN7f3vtNk1KW2eQ2JL:unxXHul7f31zTeQ2JL
TLSH
T179558D8E7B89E627DA7D0A3784602214A7B0E0D25F67D70B69E0FB7D0C953A87E451CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\CLPPNHVK.53Q\BKDJ3JX7.GWP\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 91b1c12ab90387e29e1bc357cbf9c0edc829872e9a964d2538ea2f5ac1eece3f
MD5 3f4816cfcb143113bac5d7564f664fd4
SHA1 7a7fe42dfea511ab33cebb757acac38359628427
SHA512 7af0408163c1a4d73a6a9219825da1cf30b3ee97af10bc9af2142aaf8f39742a2ad0ea7adb1caf0ec20783dcb14b846de9e7259d4cc3f83346f00e39871f55b0
SSDEEP 24576:qZbsJXFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKPTsO:PXJkGYYZTk+T1iH7efPjre
TLSH
T1E295AD41E6C368FAD46B053888BE632AB7747C040355CBFB97D4AA392D337C09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\CLPPNHVK.53Q\BKDJ3JX7.GWP\ScreenConnect.WindowsClient.exe
Size 1.5MB
SHA256 dbf62f4d0d159245a18a55627ee1477214188e4973b4af9be3cd4977293bc845
MD5 3e998dcaa9f9531933fed9ddd51e57c0
SHA1 799cd91f67f0458ec9838ea08ca8be33f6ccd3be
SHA512 6d9a4dca64c98e8b71b88112f835265c56e79c444c93688a488f97bfb707857f87e51c0dd7b6c7e913c8c2566f05799f7e9c6034ba16b3722efb430596bd4623
SSDEEP 24576:hlzNWqSl6HT38IIT9zCrReOAu4vbBkZxcKAPH4PDA:hRNWqi6IIIBzCFMNBNz
TLSH
T14F759E89BE99EE3BC86F077780602114A7F08891CF63DB575894B77E1DC93C46D48A8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\CLPPNHVK.53Q\BKDJ3JX7.GWP\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 1b2decf03e1be09ce872495755fcd17b2eef7c2b760ebabdb9fc151eb910835d
MD5 7e57755b0dcc1669d7a40505cc5478b3
SHA1 4e56b2f8ea59cfa8266801d8b0df9ed8c192adfe
SHA512 2d91095b465ad3ff0ccec6e9f07c6856dc3175745805197ddbee1380cc26b8cecacf5e678853208938a0cc46fd9d3c62f3db5d3759b0f8ab4dc3b145a3049c51
SSDEEP 192:oRombespJpKppvp3+pDMD7H9UFUlQnKVUD:/mbespJp+pvpOpDcdaUQnqO
TLSH
T16BF1AC5688C07D21573381C4FEE39914BD157F2302AE148EBC8D19AF9FB65899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\CLPPNHVK.53Q\BKDJ3JX7.GWP\ScreenConnect.WindowsFileManager.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2272-52-0x0000020C688B0000-0x0000020C688C0000-memory.dmp

Download

memory/2272-15-0x0000020C4CFA0000-0x0000020C4CFA8000-memory.dmp

Download

memory/2272-56-0x0000020C6C090000-0x0000020C6C1E0000-memory.dmp

Download

memory/2272-62-0x0000020C6BEA0000-0x0000020C6BF42000-memory.dmp

Download

memory/2272-49-0x0000020C6C110000-0x0000020C6C2A0000-memory.dmp

Download

memory/2272-43-0x0000020C6BCF0000-0x0000020C6BD24000-memory.dmp

Download

memory/2272-37-0x0000020C6C1D0000-0x0000020C6C3B4000-memory.dmp

Download

memory/2272-27-0x0000020C6BA60000-0x0000020C6BAB0000-memory.dmp

Download

memory/2272-17-0x0000020C688B0000-0x0000020C688C0000-memory.dmp

Download

memory/2272-16-0x0000020C674C0000-0x0000020C67646000-memory.dmp

Download

memory/2476-12-0x0000000008CA0000-0x0000000008E84000-memory.dmp

Download

memory/2476-8-0x0000000006360000-0x0000000006904000-memory.dmp

Download

memory/2476-13-0x0000000005440000-0x0000000005450000-memory.dmp

Download

memory/2476-0-0x0000000005440000-0x0000000005450000-memory.dmp

Download

memory/2476-11-0x0000000005440000-0x0000000005450000-memory.dmp

Download

memory/2476-10-0x0000000005440000-0x0000000005450000-memory.dmp

Download

memory/2476-9-0x0000000005EB0000-0x0000000005F42000-memory.dmp

Download

memory/2476-14-0x0000000005440000-0x0000000005450000-memory.dmp

Download

memory/2476-1-0x0000000002E40000-0x0000000002E48000-memory.dmp

Download

memory/2476-7-0x0000000005AA0000-0x0000000005B0E000-memory.dmp

Download

memory/2476-6-0x00000000056C0000-0x0000000005810000-memory.dmp

Download

memory/2476-5-0x0000000005440000-0x0000000005450000-memory.dmp

Download

memory/2476-4-0x0000000005350000-0x0000000005360000-memory.dmp

Download

memory/2476-3-0x0000000005440000-0x0000000005450000-memory.dmp

Download

memory/2476-2-0x0000000005440000-0x0000000005450000-memory.dmp

Download

memory/4992-341-0x0000000000530000-0x00000000006C0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads