0c5223d3e8b3d26abce4bbf40d10d1695cc11b2aeb8a849bf64c3e584bd5bb58

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 11:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_5b21ff2ea04c1da57535b6f39e7c23dd_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 2.4MB
Sample260803-n1bgxsysbx
SHA256 0c5223d3e8b3d26abce4bbf40d10d1695cc11b2aeb8a849bf64c3e584bd5bb58
MD5 5b21ff2ea04c1da57535b6f39e7c23dd
SHA1 10ad4974ff1ee05fabbeaad827fd09d96f6959bf
SHA512 6b472c220f22457b3cc5f849ef45243edf70a3367a47db2a58b96d880225b912238a0be0444bdc5ac6257e30e9119727fe21b7b00182943d854bca7eca3628a3
SSDEEP 24576:L8m88bg9/fJZp+Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiHn:gAbgHp+JkGYYpT0+TFiH7efPgQ9ZXO
TLSH
T1DCC5BD41F3D65AB5C4AF0538887A961AAA70BC041315CBFB67D4BA792D337C08E357A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
7	4836	dfsvc.exe
7	4836	dfsvc.exe
7	4836	dfsvc.exe
7	4836	dfsvc.exe
7	4836	dfsvc.exe
7	4836	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
2860	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\PP49CBNN.JZE\TZJ2WTCT.7R9\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_5b21ff2ea04c1da57535b6f39e7c23dd_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_5e61cdc0ca4994b3\scre..core_4b14c015c87c1ad8_0019.0008_none_420aef2f25	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0008_none_4682c71061834e2b\lock!0c0000005188590ee4120000d81600000000000000000000 = 30303030313265342c30316464323333653730666338363534	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff\lock!0a0000005188590ee4120000d81600000000000000000000 = 30303030313265342c30316464323333653730666338363534	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_0019.0008_5e61cdc0ca4994b3\identity = 68747470733a2f2f636f6e74726f6c2e7063736f6c7574696f6e736e6f772e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956\implication!scre..tion_0000000000000000_0019.0008_549 = 68747470733a2f2f636f6e74726f6c2e7063736f6c7574696f6e736e6f772e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956\Files\ScreenConnect.WindowsBackstageShell.exe_89 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08\Files\ScreenConnect.WindowsClient.exe_6492277df2 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08\lock!0c000000938a590e2c0b0000140400000000000000000000 = 30303030306232632c30316464323333653739336336636330	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "2B46BVOA0387A24KMQAV0BNL"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_00000000000000 = 68747470733a2f2f636f6e74726f6c2e7063736f6c7574696f6e736e6f772e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956\lock!010000001887590ee4120000d81600000000000000000000 = 30303030313265342c30316464323333653730666338363534	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_5e61cdc0ca4994b3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff\Files\ScreenConnect.Client.dll_fc1d7bd48553fcab = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0008_none_4682c71061834e2b\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_b6f4945ee3ec0134	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_none_1c8bee40926f0c53	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0008_none_4682c71061834e2b	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0008_none_f35e8777baf49e66\lock!14000000938a590e2c0b0000140400000000000000000000 = 30303030306232632c30316464323333653739336336636330	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0008_none_f35e8777baf49e66\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956\Files\ScreenConnect.WindowsBackstageShell.exe.co = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_5e61cdc0ca4994b3\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0008_none_f35e8777baf49e66\lock!06000000938a590e2c0b0000140400000000000000000000 = 30303030306232632c30316464323333653739336336636330	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 680074007400700073003a002f002f0063006f006e00740072006f006c002e007000630073006f006c007500740069006f006e0073006e006f0077002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320035002e0038002e0033002e0039003400360036002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320035002e0038002e0033002e0039003400360036002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e00330032000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff\SizeOfStronglyNamedComponent = 1f50060000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0008_none_f35e8777baf49e66\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0008_none_420aef2f25353afb	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0008_none_f35e8777baf49e66\DigestValue = 9f55f4b80515efcd9cf2c347ba86d8988228c266	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956\lock!04000000938a590e2c0b0000140400000000000000000000 = 30303030306232632c30316464323333653739336336636330	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_00000000000000 = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d002200680074007400700073003a002f002f0063006f006e00740072006f006c002e007000630073006f006c007500740069006f006e0073006e006f0077002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320035002e0038002e0033002e0039003400360036002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320035002e0038002e0033002e0039003400360036002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e00530065007400200063006c006100730073003d002200530079007300740065006d002e00530065006300750072006900740079002e005000650072006d0069007300730069006f006e0053006500740022000d000a00760065007200730069006f006e003d002200310022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d00220028006800740074007000730029003a002f002f0063006f006e00740072006f006c005c002e007000630073006f006c007500740069006f006e0073006e006f0077005c002e0063006f006d002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300030003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 54007200750065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0008_none_f35e8777baf49e66\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08\SizeOfStronglyNamedComponent = f98f090000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_none_1c8bee40926f0c53\lock!02000000938a590e2c0b0000140400000000000000000000 = 30303030306232632c30316464323333653739336336636330	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "CD0AOD0H6A926NJON0B9DD0V"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff\implication!scre..tion_0000000000000000_0019.0008_549 = 68747470733a2f2f636f6e74726f6c2e7063736f6c7574696f6e736e6f772e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0008_none_f35e8777baf49e66\Files\ScreenConnect.ClientService.dll_e781b1c636 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_5e61cdc0ca4994b3\scre...exe_0000000000000000_0019.0008_none_6f06403892	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0008_none_420aef2f25353afb\DigestValue = 1dd78514fc61884f21208dfb57d74df538aca43e	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_5e61cdc0ca4994b3\scre..core_4b14c015c87c1ad8_0019.0008_none_420aef2f25 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff\lock!08000000938a590e2c0b0000140400000000000000000000 = 30303030306232632c30316464323333653739336336636330	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\PP49CBNN.JZE\TZJ2WTCT.7R9\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\72AJPX5X.K6B\AGH6OQVH.019\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3316	2026-08-03_5b21ff2ea04c1da57535b6f39e7c23dd_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	4836	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 4836	3316	2026-08-03_5b21ff2ea04c1da57535b6f39e7c23dd_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	89
PID 4836 wrote to memory of 2860	4836	dfsvc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-03_5b21ff2ea04c1da57535b6f39e7c23dd_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_5b21ff2ea04c1da57535b6f39e7c23dd_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Users\Admin\AppData\Local\Apps\2.0\72AJPX5X.K6B\AGH6OQVH.019\scre..tion_0000000000000000_0019.0008_5e61cdc0ca4994b3\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\72AJPX5X.K6B\AGH6OQVH.019\scre..tion_0000000000000000_0019.0008_5e61cdc0ca4994b3\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:2860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\72AJPX5X.K6B\AGH6OQVH.019\manifests\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956.cdf-ms
Size 14KB
SHA256 3ccdf712f5b1f150d1ed6ff76bdf711eec7e6ddb092075d3206d1669de7defdb
MD5 fe858fed05b70f351129096c8e92ffa2
SHA1 7808f7fdc9702118e93eb0ecd4c262d8cf6f31df
SHA512 de049fad62053e0637cbd64bb4c613e383edda501c8772c07aa1b7d307b96177a2b28360215a0b71c733d004e4c75e7dc61c4f8093745fd8a63d2ccccea114f2
SSDEEP 192:vvEwHH/hkFDjieXVOmHrer2rerSrZIQGV67gqPud4:vLnZODeelJ+G+a9ud4
TLSH
T13A62A801B7D6E833E2515733DCD6C3E47632BDE51E9A134B70843B2EAD702DA8A23695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0008_none_420aef2f25353afb.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\72AJPX5X.K6B\AGH6OQVH.019\manifests\scre..core_4b14c015c87c1ad8_0019.0008_none_420aef2f25353afb.cdf-ms
Size 3KB
SHA256 19a7d1cf2a1fd1f66cd49295e6c60c85ae179878bff85b6d105b3e0dd78978a9
MD5 b10fc6ebd7c605d425a39fd03a546bd6
SHA1 e513ef62ce57f16393ad516896ea282f32d9c515
SHA512 0ea8c7d4a8865931585110eddc8b8111518118f97da05aee0c1c5920169876269f467679a05b3d0e4b0efe77517f46dfd6334e710e25a17e06d65eee08a2160c
TLSH
T1A761CB42B644EA13C9A90633ACD5D2EE37747E83DF42860B74C4BF2F7A316F556112A1
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0008_none_4682c71061834e2b.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\72AJPX5X.K6B\AGH6OQVH.019\manifests\scre..dows_4b14c015c87c1ad8_0019.0008_none_4682c71061834e2b.cdf-ms
Size 5KB
SHA256 71605259ed006899c34fc9014da81ef5b62f0a585a581ef7d02966df7000b148
MD5 9341ca2abace28fd7e1a36d24b3f129a
SHA1 6226ebb0ce6d8b7a1af747539fde19fa3686fd03
SHA512 3f7ddd85a379d23b09bd18eeb673b8195db46c37a0006cd04bd7d9416f12dfda02c27e53358dc54ab12bcdfa9a57e98567f3e1e213858efd6d684758340ee2fe
SSDEEP 96:pBqcl4FheV+Ww7gk/WGgyHmzSNp9QHAzVxQwnMqGO:dl48JeOMrvOAfz3d
TLSH
T1DAB1FF117304D957D5B90633ACA9C3EE2B687D52CE82470B70D8BF6F7A326FA8721254
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\72AJPX5X.K6B\AGH6OQVH.019\manifests\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08.cdf-ms
Size 6KB
SHA256 251ced8ebe542bcf57bb03e3a509da79f60021f3a2f681f08351260d6784423b
MD5 a12d22c993dabd22bd95442d0d4c6195
SHA1 9fac33c0b55eb350ef056af81419ed464f033941
SHA512 b6c25107f858a0a5613755d7260d36ae661ca042b233f684ff45526b4f0fbd7fc850f11498708a66011988501ce97e3929c0560c14d637191dba6501db017456
SSDEEP 96:whBPPv9CeV+WwwS8W5Or2WAvgoG1c+xa0oMYFqNVhA:mPPvTJG5latEt0A
TLSH
T14DD155127380ED17D5BD0A33AC9AD2ED32757E96DE43070B30C4BB6F7A322E61612041
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\72AJPX5X.K6B\AGH6OQVH.019\manifests\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff.cdf-ms
Size 2KB
SHA256 1384d46fbf92bee20e2afe8925f71ed68fb99b178f4a437a2b61154370673e15
MD5 30da8ee46ee30678a857be4c264f216b
SHA1 17f59bd3d7de533e867c396e3e1a42ab95e020ff
SHA512 0b9d0d5092f3ef0ac53bf802263fec1184dc274591ba85e42a8201e8b6a7591e289225f42b6c1ddcea42b93a738494dd963ca4d84a14c96c7ec3b5dbd521d8d1
TLSH
T17B517C033649E567D76A0631ACA1E2EA366F3F42DE55060FF1C4372F26F11AD4A350D1
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_0019.0008_none_1c8bee40926f0c53.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\72AJPX5X.K6B\AGH6OQVH.019\manifests\scre..tion_0000000000000000_0019.0008_none_1c8bee40926f0c53.cdf-ms
Size 4KB
SHA256 8c5b0c3d9d14af2e087aca888bd05e304f5482a2c854405ac9165e440ade6f17
MD5 12de7d1732a1d368cb84d5c4440aa209
SHA1 1ce266c92ffe82033cd60787d3a511614d84a738
SHA512 f55c1505e9b330c7cb5f8ef0835dae67e16a80fd6430a875946799709376cd04e97c2339042729dbe0a9022397a2fe483a10a31cd6ed04b4ea62ee135c770b9b
SSDEEP 48:VP/mrIBoAqzIv1dngf0Ru9o0m5RD70pU7gFUTUEekRHf4sQgbmZFms4Ch+UQRc0:5OUgGnEW0m5R/AUm9kRTQPfmvVUQRF
TLSH
T147912F81B780E823D6144B32ACE3D2D033397DA64FD6971770987B2FAD367C59622266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0008_none_f35e8777baf49e66.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\72AJPX5X.K6B\AGH6OQVH.019\manifests\scre..vice_4b14c015c87c1ad8_0019.0008_none_f35e8777baf49e66.cdf-ms
Size 4KB
SHA256 da2f5d1ad1fb75789a64423dc6206f9665ee116c08a5a8d66c626cea16659954
MD5 bf00d49087ef661eacdfc1fc56f7c4d6
SHA1 09cec3c93b2f66bfb73825f3982cd974bb425dff
SHA512 89630dff4b43c3a62e39918fa43b8e2a5ed45fe96be1b7715eac6920e527e85f2920c3a4bd81ac43ca04fe450fc6c6c9a48ee6242cfc4ccd03b4ca97a16c20ac
SSDEEP 48:x2CDEJrdgAqe6S+9ow87gw4W75uvsvJrV42WAvf1fTO58i3afU4+jf:x24eV+Ww8S45ueJG2WAvFTOeiO5Wf
TLSH
T1FD91771172C0ED66E5A90633ECD6C2DD3A367D82DE83070B70C4BB2F76716DA5B12192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B2P59X0W.3YK.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KK1XDBOR.DC5\B2P59X0W.3YK.application
Size 94KB
SHA256 712caa8d0a57f3cb92e35b8a10ec5b5292e37cc6decdb8b2b982da13eac5aa90
MD5 6d796c00021868721b120b51eb5d4a2c
SHA1 c74ecc2db64b5325da455a99c43bd740e9d0c6f6
SHA512 82b8d96fd6bcc36c2115cb898a0a2e2422576ebdcaadc88999faceb934aa41f140db55a6d8c4261bf271d7c72bdb42afa62fbc3591bc9ce8d714a1f5ec29249e
SSDEEP 1536:A/S7P/iBHhe2WCRSmQfn4/5EHSZ5GE/uLTvooycueQ:A/SL/YHhlWCRbW22XOcueQ
TLSH
T1DE93523A8E30F4C0477DB021D1A52D673D811B93DB730FACD91A286B0E69796EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\PP49CBNN.JZE\TZJ2WTCT.7R9\ScreenConnect.Client.dll
Size 400KB
SHA256 7dc1fdabef0f94f07991b0d1f689e1ca6be9c90c948696d21f95ad88dce20d2f
MD5 43c0447e963aaf660c2b366e807b604c
SHA1 209f363aca8f281f8ceb022c0c7f5829b8e9612c
SHA512 78e7895e47f74446b89fd42ee9b44ca36d127d15b0a32ecee74dc84d824e9752695ddeaaa4ed1fdc356e0329289b0b73708f39dd9db5bd76addf9a73127859d2
SSDEEP 6144:LMSiC+QXJN+ZvH8ETEavHy+vd7JPYIYyqQni65/PGh:wSF+X5HHTEavSW7OQni3h
TLSH
T11594CF85B3B44D2DFEAF0A37F46082258E739C456552F66D0E44B9F80AB37928644FE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\PP49CBNN.JZE\TZJ2WTCT.7R9\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 70cb25a58fb60b0a6b7c36bb9f42ef88c79e174063495f5934b3f6d85c387ae1
MD5 51c20d04cebecf60042b531acb39e66b
SHA1 2ef6f725a4de0815ea1492e153c1bb712f85128a
SHA512 1a5e8473a0e1f11c14dad5cea9d9df83f84b3f037a16fc2907eff013f15af56b9cbfc4a5a34d015e482dd297d7d06c8b6322cd411280b9996cfeeb169f504b79
TLSH
T1A1117B0181C8FA261F3345D1BEE7E021576E1B37048D194BB06968AF8B2DAE683471B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\PP49CBNN.JZE\TZJ2WTCT.7R9\ScreenConnect.ClientService.dll
Size 78KB
SHA256 9e045471fca438cbe7d3fa150eb48da09333e3ca72924fd89f2a18a9228b3af8
MD5 c93dc825a86cb06d074b2a757e1b4e81
SHA1 9f55f4b80515efcd9cf2c347ba86d8988228c266
SHA512 78c4f90e22c6386415009cc251893ab463b0f0a5501428e7c7ec15dbbbcf0a803cef6b52c69b72a2051cc58ebe0e72de8b201240136e7a2505725f209b8284c0
SSDEEP 1536:A7xQmiDqhpozTKpA9mH50ascXk/QQV3lTumkbPHg7M:A7xQmKCpST1O50G0QQVFudgg
TLSH
T1B8733C41A3AC9E26C9DF4E7874A5B0450F709A0294F7FBDD9D8DE4EA1E563C12A003DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\PP49CBNN.JZE\TZJ2WTCT.7R9\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 49e27a38d409fe5c0a43c6699a9cf59ea1217a3849bd0c960446419465491f19
MD5 1be7c70aa2028d663c6b309b2117d3e9
SHA1 bd66f87e63abef662d83f76387ff5c1cf86778bd
SHA512 7a8358786ff2da6b18b660906d7053c2fa532ece2c9f795e5956be9150f559510718e8f994db9c999a4752a964b8e04d91c4cf6f1b5878d6393b6b67ff94b7dc
TLSH
T1F031E90641C4FA251F3305C1BEE7E061975E1B33158E1947705969AB8F2DAA6434B173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\PP49CBNN.JZE\TZJ2WTCT.7R9\ScreenConnect.ClientService.exe
Size 93KB
SHA256 ba39787b65982eb2f8daf572a6f02780aaad54c23e5d2c9210b5b7aef4fbeb70
MD5 61fe268d8003536dae5f3c22ebfa9884
SHA1 9841b61a12c25edd6de06451eb4a32fc7e9dca98
SHA512 6e02378940f4146cce13de37fed6e8e35f85cf16510d567da39e432404f1e31390368d4a11bf987cd08b5402a54afe3a2d458a679dc8b8b789357b7448c7b0ee
SSDEEP 1536:Xg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg8U0HMG7q:QhbNDxZGXfdHrX7rAc6myJkg8U0Hn+
TLSH
T1E3935B13B5C28872D473193158E0DAB09A3FF9615E61DEAB3788022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\PP49CBNN.JZE\TZJ2WTCT.7R9\ScreenConnect.Core.dll
Size 553KB
SHA256 eee3b2aa4dedcc23503a4ac3a279bed0d67def1d3fa0e894acfe139af25450b5
MD5 cd98f1beafcafd7a4f32b85afd1787d5
SHA1 1dd78514fc61884f21208dfb57d74df538aca43e
SHA512 01f3ec1e62e5d2fcfa3d5d4a2167fb0675dc0f93339c45607d912e15babc297ebd12f42d3ff7d179dc4e0d8541df93973def15ed4e4521ec638f995fe804d75b
SSDEEP 12288:Ixzn3KCeQqm1mHw3TFvG5qm7ab26X/fjJ:mm88bg9/fl
TLSH
T1BEC48E9133988B2AC5EF4B3BE470D5542A71E524B00EE35B2A99F5E51E8234B4E0C7F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\PP49CBNN.JZE\TZJ2WTCT.7R9\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 9f7309be4a882407e28f72e88dbe231a61d7f3053dafdca0fd09635db7a8aa3e
MD5 fe3a1e0fded1c37a24639eced8ad375d
SHA1 1eea9a8178ff7cd427e39b6064f83a4f1b411939
SHA512 3c799aa4fa1d162b6a60beb29983e79255578fa515aa41a2044a63109ed5af304c430b1c0594d355fc5ba4cf75451a49d7649c6ad93c8b5928a0034fccde9dc7
TLSH
T13921370181C8FA261F3302D2BEE7E421979E5B33188D194B7469699FCB2DAD64747173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\PP49CBNN.JZE\TZJ2WTCT.7R9\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 3af6ea2cd302e5e6f497d82801bf3ddcec24a30217ab103bbdcd34ce8e1e27e7
MD5 c88da6b352751638377ea41a470f5e56
SHA1 7dd832ea90d814c74a6e790b55066e7fdf939f47
SHA512 f32f459299a4970fd39c680a266f09f00304a36df9318e7a4ef6eec78fcd5dbd5c30c2dea8cca286dd363a7f7c4575722b5e190d1d186b768ed803da57e965bd
SSDEEP 24576:vZp+Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTT:xp+JkGYYpT0+TFiH7efPO
TLSH
T1A085AD41E2C369F5D46B047888BF572AAA743C080325CAFB97D4BE356D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\PP49CBNN.JZE\TZJ2WTCT.7R9\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 fb227967fdc274033f30658ef676b0d52046ad0651e25b8d2e91fd9eeed0e20b
MD5 22616b43f27ee1726717b1807bc8cb31
SHA1 3d2626f66fdaa8fbe961f4be1a6d5cde9ed4cc7f
SHA512 9cb1a995328d6fb087246debf130b082af4584ce5922522f862f6f7dfbd72ab0ae6e51c03911209da6b85eb62b48406c8063f1899e95db7a42fffdaefffcce2e
TLSH
T1DE41D31281C8FA250F3301C27EEBE431979E5733158E194B7499A99BCF29AE74747137
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\PP49CBNN.JZE\TZJ2WTCT.7R9\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 18df9b4e6e217691eedefa904f84a991c79ec7a02e193279b63352f93da59c0e
MD5 317247486103537842ba34ca13ccee68
SHA1 f64b9a448fa0ddec196c35d91eb3c89407d410c9
SHA512 3d97887079d70df21d72ff274bc38fa86364009d31aa10c7c1a0a5d92a04610f2bb30a6be3145bffe41d55d26c30e6f21c7de946c83cfda79f61d3dd8cdf91e9
SSDEEP 1536:SoSOs/MRZFe9aL6DvmDTyQX5E+TC7dh2syGbci7QW:SoTsCZFe9BmyQOtgikW
TLSH
T1D8538E5163E84629C9FF2E3CB8F2A1141EB1AA439441EBAD0DCD65EA1E537815F303E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\PP49CBNN.JZE\TZJ2WTCT.7R9\ScreenConnect.WindowsClient.exe
Size 603KB
SHA256 ee0fd474de7eb1b844ec8359a4453bfb56263191643c03919bd05f439761c722
MD5 6288afe5545bfed1d5995ca38312dd0e
SHA1 a8d57917127b273530b843af29a9bc25a88523f7
SHA512 dde81e1dc6b786da764aee5f9ed142b4324aedb7dc474b8c679b4ff6cb00f60339a121cf891fd18c78c6e4d740c85c942ac2273b4e313fe580c782912506de3e
SSDEEP 12288:JJdIARli93cAz7QWG+xNXe9siyT3zf9muw:pli9bBlTzouw
TLSH
T1ABD46C2173BCDA3BC8BF0779B0E118645FB0F8156685E78E8904A9D90FD739A49443EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\PP49CBNN.JZE\TZJ2WTCT.7R9\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\PP49CBNN.JZE\TZJ2WTCT.7R9\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 a214ad73f8ffec66c5016378b49bb8420f2981b6cfc3e85615bec7a98f6a1ce6
MD5 d09d1f06de79e0e5b5d8eebeb335a0aa
SHA1 5ce0444fb3ff752f7dbd49f44b7231623e916054
SHA512 714a145fec28ab5ae0ed807e94487dce2e21e20610033ab546721fe15c34092857d2a1d2c9af248b8aba62e12de7519b8254bf808f4ccee4616598d602d43b1a
TLSH
T1D851B40641C8FA210F3305C1BEEBE471979E5B32158E19477099A99FCF2DAA7474B137
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\PP49CBNN.JZE\TZJ2WTCT.7R9\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 db336ab59c71657fd39cba6b0c61393166342d4a743995d98684de86f8e1e89f
MD5 285293b6aa0c45ef12ebad912fc54aaf
SHA1 ebf0af180db1afa9f00a3abf40f6f43caaa05780
SHA512 4f43e29005a558094e96dd8c34e75db509f22da6a2da8d145fb41449db0ec01b9861e53c98f5bdf96d4443eef406e50bca06e93b3c24fd914e5d046e4642931e
SSDEEP 96:xWLwOhoyTuYe2wvyukKkVrkQRklkooAqkM9kC4kOpQkOprkeAkOpD:oR5e0DCQ6WoFMeC9UFUAeVUD
TLSH
T1A2F1AA9684C07D21573291C0FEE39924BE157F3302AE148ABC4D19BF9F765899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\PP49CBNN.JZE\TZJ2WTCT.7R9\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 df1285e835774021ab526031a9f3cdcaaef4ced1bceb3de686aa658dad9a1983
MD5 40c62d98998e96559852b019fcbbec06
SHA1 d1b06f3b24955a17cd3c07ba1c5e8cc7fc527d77
SHA512 eed22fca42606ee8637fd2ea40a41f884bfd3e3bc45e0091a3bacb87a10440f48fb8d43ccd1cb6750236d77918135a1f59b94953fd80ff193f97b847325dcd18
SSDEEP 1536:jtyrl44qzblI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7qO7rS8:QJWukLd+OPF
TLSH
T1AB83E68235762631DF85C4379492C9B59C366F22133DC5BD2DA2FE7A65F03443A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2860-301-0x000000001BDB0000-0x000000001BDC8000-memory.dmp

Download

memory/2860-286-0x0000000000E90000-0x0000000000F2A000-memory.dmp

Download

memory/3316-2-0x00000000030E0000-0x00000000030E8000-memory.dmp

Download

memory/3316-3-0x0000000005830000-0x00000000058BE000-memory.dmp

Download

memory/3316-4-0x0000000074C00000-0x00000000753BC000-memory.dmp

Download

memory/3316-5-0x0000000003260000-0x0000000003284000-memory.dmp

Download

memory/3316-7-0x0000000005F00000-0x00000000064BA000-memory.dmp

Download

memory/3316-6-0x0000000074C00000-0x00000000753BC000-memory.dmp

Download

memory/3316-8-0x00000000059E0000-0x0000000005A72000-memory.dmp

Download

memory/3316-9-0x0000000074C00000-0x00000000753BC000-memory.dmp

Download

memory/3316-13-0x0000000074C00000-0x00000000753BC000-memory.dmp

Download

memory/3316-0-0x0000000074C12000-0x0000000074C13000-memory.dmp

Download

memory/3316-10-0x0000000005BC0000-0x0000000005D6E000-memory.dmp

Download

memory/3316-1-0x00000000018D0000-0x00000000018D8000-memory.dmp

Download

memory/3316-16-0x0000000074C00000-0x00000000753BC000-memory.dmp

Download

memory/4836-51-0x00000169FEB30000-0x00000169FEB48000-memory.dmp

Download

memory/4836-19-0x00007FFD17200000-0x00007FFD17BA4000-memory.dmp

Download

memory/4836-69-0x00000169FEE50000-0x00000169FEEDE000-memory.dmp

Download

memory/4836-14-0x00007FFD1738F000-0x00007FFD17390000-memory.dmp

Download

memory/4836-12-0x00000169FA010000-0x00000169FA198000-memory.dmp

Download

memory/4836-11-0x00000169DF9D0000-0x00000169DF9D8000-memory.dmp

Download

memory/4836-63-0x00000169FEE60000-0x00000169FEEFA000-memory.dmp

Download

memory/4836-17-0x00007FFD17200000-0x00007FFD17BA4000-memory.dmp

Download

memory/4836-18-0x00007FFD17200000-0x00007FFD17BA4000-memory.dmp

Download

memory/4836-57-0x00000169FF120000-0x00000169FF2CE000-memory.dmp

Download

memory/4836-21-0x00007FFD17200000-0x00007FFD17BA4000-memory.dmp

Download

memory/4836-15-0x00007FFD17200000-0x00007FFD17BA4000-memory.dmp

Download

memory/4836-20-0x00007FFD17200000-0x00007FFD17BA4000-memory.dmp

Download

memory/4836-45-0x00000169FEE30000-0x00000169FEE98000-memory.dmp

Download

memory/4836-35-0x00007FFD17200000-0x00007FFD17BA4000-memory.dmp

Download

memory/4836-34-0x00007FFD17200000-0x00007FFD17BA4000-memory.dmp

Download

memory/4836-33-0x00007FFD17200000-0x00007FFD17BA4000-memory.dmp

Download

memory/4836-32-0x00007FFD17200000-0x00007FFD17BA4000-memory.dmp

Download

memory/4836-31-0x00000169FC470000-0x00000169FC4C0000-memory.dmp

Download

memory/4836-22-0x00007FFD17200000-0x00007FFD17BA4000-memory.dmp

Download

memory/4836-302-0x00007FFD17200000-0x00007FFD17BA4000-memory.dmp

Download

memory/4836-303-0x00007FFD17200000-0x00007FFD17BA4000-memory.dmp

Download

memory/4836-304-0x00007FFD17200000-0x00007FFD17BA4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads