4da5bcaf472a406023aa48c8964434f8584ba1e63405b3ba1c2d6702c082e8ef

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 11:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_47b4bca43b09e9b2fdf79b6d4c41ad5a_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 2.4MB
Sample260802-nw4ynshr7w
SHA256 4da5bcaf472a406023aa48c8964434f8584ba1e63405b3ba1c2d6702c082e8ef
MD5 47b4bca43b09e9b2fdf79b6d4c41ad5a
SHA1 0c9d1a855a7fc47ff5731ed58f9b24d258a2572f
SHA512 d6c3d60be2c42f0e848c8856f44d1cf3583d7c3f974a33a2dd8b4d54046cc2727b036225628946bad94a95e264b35d0d919c9580356f53edd3591cb3789bddee
SSDEEP 24576:EjhXBJF/sEEznSRpiFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTr:4hRDO4piJkGYYpT0+TFiH7efP1Q9O2W9
TLSH
T134C5BD02B3D656B5C47F0678987A961AAB70BC040316CBFB57D4AAB92D337C04E357A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
4	2448	dfsvc.exe
4	2448	dfsvc.exe
4	2448	dfsvc.exe
4	2448	dfsvc.exe
4	2448	dfsvc.exe
4	2448	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
4320	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\YZJB6ON5.PEX\MXJ4TTP7.4GH\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_47b4bca43b09e9b2fdf79b6d4c41ad5a_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d\lock!0100000027a9590e90090000000e00000000000000000000 = 30303030303939302c30316464323237343763333830623634	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 54007200750065000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_9f3d02aee44150c6\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0008_none_427709ff2441fec2\lock!0e00000021aa590e90090000000e00000000000000000000 = 30303030303939302c30316464323237343763333830623634	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_0019.0008_9f3d02aee44150c6\identity = 68747470733a2f2f617574682e6175747a3732342e72752f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_d802e177f8ea89ef\appid = 68747470733a2f2f617574682e6175747a3732342e72752f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d1339154c6	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0008_none_f3caa247ba01622d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0008_none_f3caa247ba01622d\lock!1000000021aa590e90090000000e00000000000000000000 = 30303030303939302c30316464323237343763333830623634	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_9f3d02aee44150c6\lock!1100000030aa590e90090000000e00000000000000000000f38be = 30303030303939302c30316464323237343763333830623634	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0008_none_f3caa247ba01622d\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0008_none_f3caa247ba01622d	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0008_none_427709ff2441fec2	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_9f3d02aee44150c6\scre..core_4b14c015c87c1ad8_0019.0008_none_427709ff24	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d1339154c6\lock!0600000079ab590ee0100000600400000000000000000000 = 30303030313065302c30316464323237343832666532616432	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0008_none_46eee1e0609011f2\lock!1600000098ab590ee0100000600400000000000000000000 = 30303030313065302c30316464323237343832666532616432	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_9f3d02aee44150c6	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_04ed323fd51f3f07\LastRunVersion = 68747470733a2f2f617574682e6175747a3732342e72752f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 460061006c00730065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d1339154c6	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_9f3d02aee44150c6\scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d133	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf\lock!1800000098ab590ee0100000600400000000000000000000 = 30303030313065302c30316464323237343832666532616432	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d1339154c6\lock!1400000098ab590ee0100000600400000000000000000000 = 30303030313065302c30316464323237343832666532616432	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_0000000000000000_57051d5779c6eb7e	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 680074007400700073003a002f002f0061007500740068002e006100750074007a003700320034002e00720075002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320035002e0038002e0030002e0039003400340030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320035002e0038002e0030002e0039003400340030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e00330032000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0008_none_427709ff2441fec2\lock!1a00000098ab590ee0100000600400000000000000000000 = 30303030313065302c30316464323237343832666532616432	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0008_none_46eee1e0609011f2	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0008_none_427709ff2441fec2\SizeOfStronglyNamedComponent = 73b8080000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_none_1cf80910917bd01a\lock!0400000021aa590e90090000000e00000000000000000000 = 30303030303939302c30316464323237343763333830623634	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0008_none_f3caa247ba01622d\lock!1c00000098ab590ee0100000600400000000000000000000 = 30303030313065302c30316464323237343832666532616432	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 30000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0008_none_427709ff2441fec2	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0008_none_427709ff2441fec2\implication!scre..tion_0000000000000000_0019.0008_d80 = 68747470733a2f2f617574682e6175747a3732342e72752f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d\Files\ScreenConnect.WindowsFileManager.exe.confi = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d\Files\ScreenConnect.WindowsBackstageShell.exe.co = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d1339154c6\SizeOfStronglyNamedComponent = 1f50060000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_0019.0008_9f3d02aee44150c6\PreparedForExecution = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0008_none_427709ff2441fec2\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_9f3d02aee44150c6\scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d133 = 01	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\YZJB6ON5.PEX\MXJ4TTP7.4GH\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\PJQA1VQG.Z5W\1C9VH9EW.O6T\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5836	2026-08-02_47b4bca43b09e9b2fdf79b6d4c41ad5a_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	2448	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5836 wrote to memory of 2448	5836	2026-08-02_47b4bca43b09e9b2fdf79b6d4c41ad5a_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	89
PID 2448 wrote to memory of 4320	2448	dfsvc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-02_47b4bca43b09e9b2fdf79b6d4c41ad5a_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_47b4bca43b09e9b2fdf79b6d4c41ad5a_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5836
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Users\Admin\AppData\Local\Apps\2.0\PJQA1VQG.Z5W\1C9VH9EW.O6T\scre..tion_0000000000000000_0019.0008_9f3d02aee44150c6\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\PJQA1VQG.Z5W\1C9VH9EW.O6T\scre..tion_0000000000000000_0019.0008_9f3d02aee44150c6\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:4320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\PJQA1VQG.Z5W\1C9VH9EW.O6T\manifests\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d.cdf-ms
Size 14KB
SHA256 c206b166a241d66fc3d589d7fc9c84f55ad263c14965722c59f3750b78caf854
MD5 b24325014592689bead6f40be9eb6972
SHA1 cbebf258743af02604a47711b3a043e1d6199248
SHA512 0235394d7909076fc19b4ccae9ff74b88cba9de9ba78a4003dccae35fb19bd4f7fae4e102f45106f0767437633353bedd8c3dec75a747b8b7e3aa0cae1c3c604
SSDEEP 192:vdzwHH/JaDDl9eTVHpWtCF/YnNf7kE7O7h+lITmGZITsGyeiH4:vinhaDZ9ertejbC8lZhiH4
TLSH
T186625F12B6C5E4FBD2504E329EFAE6B4E7647C6D0F6510277080373D6B3E65A8F21288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0008_none_427709ff2441fec2.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\PJQA1VQG.Z5W\1C9VH9EW.O6T\manifests\scre..core_4b14c015c87c1ad8_0019.0008_none_427709ff2441fec2.cdf-ms
Size 3KB
SHA256 ce7b3a5289ff75ab84b7911c69788ad09a9041d8be6c313116efc827dc4bbaa9
MD5 b71967287eaa1c052a040be77085370b
SHA1 edebd123026940728b536fcfb6427ddc9d22db6c
SHA512 46be12dec2b79c0d49facdbf395772f22443b12308e6d03cbd83ee45e8b9dee65ec682e18b3ceeb9c17a3e8191547bd41a1578eb0852276a6eeca0c853f6c7d8
TLSH
T10F61B9017244DA47D9690673ACD9E1EE77B83E83DF41460B74C0BF2F7A361F686211A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0008_none_46eee1e0609011f2.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\PJQA1VQG.Z5W\1C9VH9EW.O6T\manifests\scre..dows_4b14c015c87c1ad8_0019.0008_none_46eee1e0609011f2.cdf-ms
Size 5KB
SHA256 11d155ec02199604c8a5a7726efdeead8618fa55dcd56a7597bb00ead2aeece4
MD5 e2b6f15188a303a7edd6aa99da0bf594
SHA1 f3e6b4549ee080fb47143d691a5a4bf32ce0bca5
SHA512 ada7aaee2a356c543ff2a9ec2505d3ddec77a8bb2a29b884e1a0f6818190cbc792a234b6492bf26b2e68c8a4d0c793337500af9d62b761a301a631297c0bc730
SSDEEP 96:oqP+RxlQheV+Ww7SWk/WGgyH6zSNp9QHAzWoM9BngnsR6O:0RxlxJDvOM3vOAS9NQzO
TLSH
T1FDB1FE117304D917D9B90633ACA9C3EE2B78BD53CE82460B70D4BF6F76326E64722264
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\PJQA1VQG.Z5W\1C9VH9EW.O6T\manifests\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf.cdf-ms
Size 6KB
SHA256 b3888e63a98a8efda938dd4526a1e5c1e9292dce4bd9c0e4cc022ae65dc81625
MD5 360608d813664fed3a99bb16b9461c69
SHA1 777c1b67a8ae5e25d0cf3fc3c70c2757c3548be1
SHA512 0fea9a3771a572817a513aac9fb563f79db8ea076b4718737a463abc2061f10a6cf4af42c0e98db79e2977185d177fa20880a2ba6592c4fce010f5700ba20fc3
SSDEEP 96:kMWhDMPP/p/eV+WwwSE8Wm2TOt0O6gG56OL6rsrHFrlzAnsVoeb:uZMPP/+JK4mZ0QG56OOMFhcsT
TLSH
T1B3D1DE127304EE17D5B90A33AC9AD3DE27687D56DE42470B70C4BF2F76322A61722191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d1339154c6.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\PJQA1VQG.Z5W\1C9VH9EW.O6T\manifests\scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d1339154c6.cdf-ms
Size 2KB
SHA256 4e655da7157fc49088fb47d01b2f65696794cf3d73e7eb0fffed29f3dd8abc92
MD5 6b9dda05c78640b47e368a988e48c58b
SHA1 7d25df288c16675dcd55bfe778c5d18a2bc8a68d
SHA512 37875f9261992e3a527f3458a1318ab99f9a85cef72974a17602c391449d8e093f54596aa9be29c982025b52084ae65174bcc9fd37b5b49308746b4bfae473fc
TLSH
T185518B053684EA67D66A0633EC95D2D932717D82DF470317B0D0BB7F3A716D64A120A2
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_0019.0008_none_1cf80910917bd01a.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\PJQA1VQG.Z5W\1C9VH9EW.O6T\manifests\scre..tion_0000000000000000_0019.0008_none_1cf80910917bd01a.cdf-ms
Size 4KB
SHA256 4506a6d7c79aa0a6ecd606009f12f8325e191098fbe9d4e3dd719e600d2a10bb
MD5 2b85c4fd76aefe7fc7c2d57865fbc0b6
SHA1 33c1c1b35aa1069beb6834510819a5defe60eef9
SHA512 c7cda76a8ef5eb83cc65c679c02c7d44dd431042b11ec70d541287d55872cc29f9a6fdd940223c0c70c03fcc1f51c65ebfe5d5ef2df872bf0c4c158163292d23
SSDEEP 48:1P/mrIgAqzIvgTgRRu9o0m5RD7L9U7gFUTUEekKf4sQgbmZFms4Ch+UQlcchd:ZOUOGbEW0m5R/L9Um9ksQPfmvVUQltL
TLSH
T15F912D81B780E833E61447329CD3D2D032357DE60FD6871770887B2FAD3638696226A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0008_none_f3caa247ba01622d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\PJQA1VQG.Z5W\1C9VH9EW.O6T\manifests\scre..vice_4b14c015c87c1ad8_0019.0008_none_f3caa247ba01622d.cdf-ms
Size 4KB
SHA256 30951e0e97e9626394361b0b077f198dd0de509a3f18af2a549d74db5739e83a
MD5 e9f08cd69b5e2b92bd00826f031abf72
SHA1 9d6af4ed12cd7979727de5f395cc4078f8c8a18c
SHA512 f4cc3a4218f59bd990fe2889b6861a8a432dcc07382f1834cae8c88aff78da67a798c4994fe46702ea747f814e986f4a879c5263d4868bb1565466ec38e0a970
SSDEEP 96:BodUeV+Ww8SE45uZH18oc9o8bLh5hnDvuf:ByJ6LuZVYu855tDm
TLSH
T1CC91DF157240E96AE5690633EC96C2DD3779BC82DF420707B0C07F2F76716FA4B21196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AGMQM8CP.TPG.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q3XVYPCV.ZMK\AGMQM8CP.TPG.application
Size 99KB
SHA256 e0f9f259bc4c87536387843bb5b626781e0cb8aacacda1a017349e8a3e01d7cd
MD5 dde0fb76c074a4d1c1420d0cb8337baa
SHA1 15646327c97bd5f73030b8a7124e7d4e873c901f
SHA512 e76acb3dd7373beadf5eb140a01e54340fa861de372fb3ab9d22437ca85faaffc6a6abe528b430ad6960678cab9bd6f65ee9c6480a318a9982632219967c632e
SSDEEP 1536:I4Bp875Amki10M5n76+8rJsZckAGSZNVNzWJJ29ymgoUbyV:I975AiqM5n76+syMVN6K9ymD
TLSH
T186A3423A8F30F5C0477DB021D1A52D673D811B93DB730BACDA0A186A0E69796EF5E64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZJB6ON5.PEX\MXJ4TTP7.4GH\ScreenConnect.Client.dll
Size 400KB
SHA256 c8901f627cb7a5502d6726792c56aff9a94d2c2be0411ac53c8a5b75cbe37dcc
MD5 a3c43d75e1b611e607ebe91fbe5cd7ed
SHA1 3eae8d3f27f5f2f5fab3d015b8ed6d3a45b9fd6e
SHA512 087ada3a0207ce88757d35a3ab563a26d42cedba021be44c7d550266039e2be33d7f8c296958f610acea6b77c51c55ea9b188e2c97fbb5576d216904d982f43f
SSDEEP 6144:7MSiC+YXJN9ZvH8ETEavHy+vd7JPYIYyqQni65/PG+:gSF+45HHTEavSW7OQni3+
TLSH
T1F594CF85B3B44D2DFEAF0A37F46081258E739C456552F66D0E44B9F80AB37A28644FE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZJB6ON5.PEX\MXJ4TTP7.4GH\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 88fd90d366adc732fb776a8840ef28bacdf70724c9513ff21605c6c0c7509e6f
MD5 2059b0cb6c221a1a6ea9341b27af954f
SHA1 699865a6e5a53e3622f8beed2bc1d06f829176ef
SHA512 6414c1c24db740c7db12ab0b1914992d4b28d11aec640a2393cf16d7b165d243db33c2d05c0957b5c38487ca2648a12e6a537671bf59b77aab29921318b6fd12
TLSH
T1A0115C0181C8F9261F3301D1BEE7E021A76D1B33048D1547B069686F8B29AD74347173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZJB6ON5.PEX\MXJ4TTP7.4GH\ScreenConnect.ClientService.dll
Size 78KB
SHA256 badd627ff97136084e9c811a5400d32e9584eaebc9209a65333aea7f5153d480
MD5 3aded48ac715aee952d445a81b051843
SHA1 1485daaae9b3ec2dc1e03c1229cd156b70b34ccd
SHA512 0528999dbca8e1636f384d8eaa015ba1b1a3b0e9e3e46008f5d754d607eb166748583e00385ede1b2dd99513da228529cbb126265fd1bd922137c37818de414b
SSDEEP 1536:r7nnFxZ5/ZSXj+LFOPB8PrHwEkRQXV3lTH2obPFw7NI:r7nZ5/ZSXjgFqKPrL+QXVFHFwu
TLSH
T128734C42E3BC4E26C9DF4F38B465B0450FB09A0294A2F7E99DCDA4F61B467C12A143DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZJB6ON5.PEX\MXJ4TTP7.4GH\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 8147e5d137a6684ff7114ce382eb5fa23125882b04ea497d2e9f3192b688571c
MD5 2859234383f70894445dd360faa6b3cd
SHA1 523af10a8e3f1841bf91d5b1ce3f08ee8298c6f4
SHA512 2ed4f41ace3bf12d5dbe2aa068f855bc30d7dd1ba4b6120d31cd9e072ef66d362ab92e8d4aabb1d13b6440d5fc9c57b776d413a644151469663b9ed148c9d09c
TLSH
T10931E90641C4FA251F3301C1BEE7E061976D1B33158E19477059599B8F2DAA7438B177
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZJB6ON5.PEX\MXJ4TTP7.4GH\ScreenConnect.ClientService.exe
Size 93KB
SHA256 63ae8c708ab99e4795298c68e3fc57a414f929f5914abd8c57232ca37f8c88e6
MD5 9f78d93eceb6287ec6556a55cb7637d1
SHA1 543f355e12862711931184e1c77a47883e40be39
SHA512 a0da5bf1014ec9fc03af6d19e5e9d850740bad03858bb30cb6673b97e8f5c9891e4debef1acc10fe1cd5e264b40cb1597afff17924461390546f5a6dc4a7993b
SSDEEP 1536:bg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg8U0HMG7Xxd:UhbNDxZGXfdHrX7rAc6myJkg8U0HHVd
TLSH
T163935B13B5C28872D573093158E0DAB09A3FF9215E61DEAB3788022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZJB6ON5.PEX\MXJ4TTP7.4GH\ScreenConnect.Core.dll
Size 553KB
SHA256 4dc65c2ec967f80c61d98fe5734869c6e9debaa99c063cf56086740aa4a072c9
MD5 be19cbe04549a8cf605a5aa37dd3b2da
SHA1 de7b86e45f09d1d5ae0d55e3cc6dcc07ad09d8a6
SHA512 8ae256df5b4878ae0bf76ea29119cdcc3e9a1b84ba3b3386f75b0810f7b16bb1ae9c102f20bb5076e2c6b5ab996307e737f472c17eec605d0a11ad5059e8316e
SSDEEP 12288:tx6Uvha0XYZB2N/R6qIs22VF/sbbGHEznIX:FhXBJF/sEEznk
TLSH
T12FC46C1333E8873AC67F0BBAF120D9154A71E911B30AE75B1A99F4E52D823894D4C7E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZJB6ON5.PEX\MXJ4TTP7.4GH\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 d25ba6b9e5247ed772b247f70c1df44070d7de2a2d81d495c590fd9fbd8d6f4c
MD5 0141148aba6e1e515e2e898902a87535
SHA1 3577b62bb9439b6a7931c15fae11e05b42aac677
SHA512 3d22666adfe978f9d0a94b7912a6dd5acbe811e6b953d229f9a0a1a5e81c27a590e4a4206571a91c5dc5625beb53e4826819856c75d84ac224713b8eb601a4f4
TLSH
T11721670181C8FA261F3302D2BEE7E42197AE5B33188D194B7469689FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZJB6ON5.PEX\MXJ4TTP7.4GH\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 4913381885979aed0233ac2a3401eb597b8c0ef37ac3f96b497901f95f251d26
MD5 9a3d026f2549ad04bb14102ccc94d633
SHA1 38c137f1584e4797e39a85439f3ece01a192bd39
SHA512 3cf1c7b5b095473ded49edf4aa646a17f06fee480fcd1a3c2334cf5d98925f4c79e61193466434a33585b57121066853d3a1c319265995a98904bef86859f734
SSDEEP 24576:9RpiFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUT8:DpiJkGYYpT0+TFiH7efPt
TLSH
T17185AD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE356D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZJB6ON5.PEX\MXJ4TTP7.4GH\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 de921e4e98c8fc3d976a482dbcf0f2a3df270b27cb4942026958c453d88de1e9
MD5 a0dda458757bc089901f40b07b1c6549
SHA1 f6f97d3c71df1873fa06b066628c422cff1d14af
SHA512 fb24e22c6e0d1020a5871d76e570fbd459cb3c4872f41c5cb095c21fa1a331ee47d9508fe0c9606ad38ba686e1a503b5f3d71d9bc6e3a560962b3ea8bb4d2595
TLSH
T19B41D31281C8FA250F3301C27EEBE431979E5733158E194B7499A99BCF29AD74787037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZJB6ON5.PEX\MXJ4TTP7.4GH\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 0dd3250f1e179a89ce0b8ed3eac64c7513ac5cfbba2f6d43fb9aa98887086f3d
MD5 664718a968e0f697cdfeb600baecd10f
SHA1 aa7f417852ee1471a4e751046face0d4571c808f
SHA512 c94016d328584a82f137b2693cf55955ab14c7650da0b43a2e88a132a89e0df86788f8025aac078c1259344f95a3c18ed118bb76282732e85ed1a351c304ce83
SSDEEP 1536:6oSOs/MRZFe9aSNDvmDTyQX5E+TC7Eh2syGbYK7wC:6oTsCZFe9NmyQOOcK7
TLSH
T10C538E4163E84615C9FF2E7CB8F2A1141EB1AA439441EBAE0DCD65EA1E537816F203F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZJB6ON5.PEX\MXJ4TTP7.4GH\ScreenConnect.WindowsClient.exe
Size 603KB
SHA256 57dfe3b0a64a84102d4113d3b21fa49d961d55cdaba5be263dcd850f6c31fa47
MD5 906624dc96dd029a7d16fddc0cb7f56d
SHA1 5ba95918731df980a71a036b1d5a38a60291070f
SHA512 ae24c5b1770c891db3057c9389446bee8856712577beea2c9b4d342681bb286ff151bb6138c07f2f7c0c4518ee31ef640f26d2ccb713b32cb7fe21d6853910c7
SSDEEP 12288:UmREZ5mKf2cQF7t590iglIUGrpDk+n0zT5gSTX:imKfo2StDj03iSTX
TLSH
T157D46C22737CDA3BC8BF07B8B0F3182457B4EC056685E79E4940A5EA0DD73899A543E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZJB6ON5.PEX\MXJ4TTP7.4GH\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZJB6ON5.PEX\MXJ4TTP7.4GH\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 259d2e52d727b7154b29f598e6437b9e51fe47fffd92de3af22bc497e7244339
MD5 caa9ac16ace0682a0c702aa321c25ee9
SHA1 1063153e85f2c5da89d10a2f4efba9a2db2dd5c7
SHA512 1cea0465e44442e9be9ebb3ebb498352908816b646b449a1817a75eb59ce51430928115b909f488c36c84d262e6f7698634fad9d457bef327f9cf281843ee8fa
TLSH
T19251B40641C8FA210F3301C1BEEBE471979E5B32158E19477099999FCF2DAA7478B137
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZJB6ON5.PEX\MXJ4TTP7.4GH\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 646c8a503886dec81c74db3c0365aa116a8548ad38564d4063ae037b9d3dcc9b
MD5 532579d5fbed70f6a29447ba291ae8cb
SHA1 e9d36ea53aa9fae3b88de24694b04bc0516b94e5
SHA512 d81165d53a41095836ec8364b2acf87fc3d327e961dc2c3d0223589cf452a6cdc313704d58eba1fb2421810d5cc2a098f6ef0da631dfe9b9288299f85888d654
SSDEEP 96:xWLwOhoyTjHe2wvyDk/rkvkK8k4kaqkh9kW4kOpQkOprkOAkOpD:oRreP/AcKp9cheW9UFUAOVUD
TLSH
T1D4F19B9684C0BD21573291C0FEE3D924BE157F3302AE148ABC4D19AF9F765499B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YZJB6ON5.PEX\MXJ4TTP7.4GH\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 794fe19e18b99187b3a6c69f5c11e6f977304363f07028d4a498f647ddc7c497
MD5 b73f9c75e19ef9778eac3235b35299a9
SHA1 737e5a024bc4ece16c96518b037c88aa0538be81
SHA512 5bd6165ef6ca6b5ddbc8aa0492adbcf768d62aee7a0631ec70b30c0e9a45c037bb757569d027b0538e002b628c2d1b47a73f4c8ab04ad41c3310293d3c366bef
SSDEEP 1536:HtyGl44DzbmI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7bZ72:EA2ukLdnZa
TLSH
T10583E58235762231DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03443A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2448-16-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2448-19-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2448-42-0x000001DCE3410000-0x000001DCE3428000-memory.dmp

Download

memory/2448-14-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2448-48-0x000001DCE7F50000-0x000001DCE80FE000-memory.dmp

Download

memory/2448-300-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2448-299-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2448-31-0x000001DCE3460000-0x000001DCE34B0000-memory.dmp

Download

memory/2448-297-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2448-13-0x00007FFC6D72F000-0x00007FFC6D730000-memory.dmp

Download

memory/2448-66-0x000001DCE7C60000-0x000001DCE7CC8000-memory.dmp

Download

memory/2448-60-0x000001DCE7C80000-0x000001DCE7D0E000-memory.dmp

Download

memory/2448-22-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2448-54-0x000001DCE7C90000-0x000001DCE7D2A000-memory.dmp

Download

memory/2448-21-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2448-10-0x000001DCC89D0000-0x000001DCC89D8000-memory.dmp

Download

memory/2448-11-0x000001DCE3180000-0x000001DCE3308000-memory.dmp

Download

memory/2448-17-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2448-18-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2448-32-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2448-20-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4320-284-0x0000000000A60000-0x0000000000AFA000-memory.dmp

Download

memory/4320-298-0x0000000002BF0000-0x0000000002C08000-memory.dmp

Download

memory/5836-3-0x0000000074FF0000-0x00000000757AC000-memory.dmp

Download

memory/5836-5-0x0000000002960000-0x0000000002984000-memory.dmp

Download

memory/5836-7-0x0000000005000000-0x0000000005092000-memory.dmp

Download

memory/5836-6-0x00000000055C0000-0x0000000005B7A000-memory.dmp

Download

memory/5836-9-0x0000000005280000-0x000000000542E000-memory.dmp

Download

memory/5836-2-0x00000000028D0000-0x00000000028D8000-memory.dmp

Download

memory/5836-1-0x0000000000B60000-0x0000000000B68000-memory.dmp

Download

memory/5836-8-0x0000000074FF0000-0x00000000757AC000-memory.dmp

Download

memory/5836-12-0x0000000074FF0000-0x00000000757AC000-memory.dmp

Download

memory/5836-4-0x0000000004E70000-0x0000000004EFE000-memory.dmp

Download

memory/5836-15-0x0000000074FF0000-0x00000000757AC000-memory.dmp

Download

memory/5836-0-0x0000000075002000-0x0000000075003000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads