090d55a238cded9ae9218b1e253ccddafb652bfa49b47fcb6357a56614184e35

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_d0558388875c6dfcaf928211e0bbe35f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 2.5MB
Sample260804-ref23abh69
SHA256 090d55a238cded9ae9218b1e253ccddafb652bfa49b47fcb6357a56614184e35
MD5 d0558388875c6dfcaf928211e0bbe35f
SHA1 84b50904fe1450bc8c075fbfae77cae7a68d4e99
SHA512 3e77361bbe8e07ac1b2c1f9d66a39bfc13960ca66773761bf93d9e032b3e7360f55d62f053b16d27dbd679765058386aea11dbfa95800e78f0036c06ba28ac8f
SSDEEP 24576:2sId9BbVER68MYBjf5QN9Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT09:MC3QN9JkGYYpT0+TFiH7efP8cA
TLSH
T174C5BD01F3D695B6C4AF0538D47A925A6A70BC0403A6CBFB67C4B9762D337C08E357A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 7 IoCs

flow	pid	Process
36	2760	dfsvc.exe
36	2760	dfsvc.exe
36	2760	dfsvc.exe
36	2760	dfsvc.exe
36	2760	dfsvc.exe
36	2760	dfsvc.exe
36	2760	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
4044	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\LO6TDYCK.9WA\0K24GX7Q.4AK\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_d0558388875c6dfcaf928211e0bbe35f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad32815 = 68747470733a2f2f636f736c63616e616461312e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad32815 = 54007200750065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb\implication!scre..tion_27fa83f1ad328157_001a.0005_e21878aac = 68747470733a2f2f636f736c63616e616461312e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f\SizeOfStronglyNamedComponent = 02ed040000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb\scre..dows_420d02d3849b7992_001a.0005_none_3c309668306 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0005_none_e90c56cf89d4262e	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_27fa83f1ad32815 = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d002200680074007400700073003a002f002f0063006f0073006c00630061006e0061006400610031002e00730063007200650065006e0063006f006e006e006500630074002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320036002e0035002e0033002e0039003600390031002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003700660061003800330066003100610064003300320038003100350037002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320036002e0035002e0033002e0039003600390031002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003700660061003800330066003100610064003300320038003100350037002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e00530065007400200063006c006100730073003d002200530079007300740065006d002e00530065006300750072006900740079002e005000650072006d0069007300730069006f006e0053006500740022000d000a00760065007200730069006f006e003d002200310022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d00220028006800740074007000730029003a002f002f0063006f0073006c00630061006e0061006400610031005c002e00730063007200650065006e0063006f006e006e006500630074005c002e0063006f006d002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300030003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f\implication!scre..tion_27fa83f1ad328157_001a.0005_e218 = 68747470733a2f2f636f736c63616e616461312e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0005_none_7eb8c5776d0b1316\lock!0400000060e4580ec80a0000840d000000000000000000001 = 30303030306163382c30316464323431613735363236613465	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_27fa83f1ad328157_a61738684e8fb74b	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_442d9093522db512	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\OnlineAppQuotaUsageEstimate = "4057169"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f\lock!0600000060e4580ec80a0000840d000000000000000000001 = 30303030306163382c30316464323431613735363236613465	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_442d9093522db512\LastRunVersion = 68747470733a2f2f636f736c63616e616461312e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0005_none_cdce1c59036418c7\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0005_none_cdce1c59036418c7\lock!0a00000060e4580ec80a0000840d000000000000000000001 = 30303030306163382c30316464323431613735363236613465	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0005_none_37b8be86f414c2c3	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_27fa83f1ad32815	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0005_e21878aac1367bfe\appid = 68747470733a2f2f636f736c63616e616461312e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0005_none_cdce1c59036418c7\lock!080000003ee7580ecc0f0000340800000000000000000000f = 30303030306663632c30316464323431613932653138306362	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0005_none_37b8be86f414c2c3\lock!1c0000004ee7580ecc0f00003408000000000000000000000 = 30303030306663632c30316464323431613932653138306362	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0\lock!1a0000004ee7580ecc0f00003408000000000000000000000 = 30303030306663632c30316464323431613932653138306362	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0005_none_e90c56cf89d4262e	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad32815 = 460061006c00730065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f\Files\ScreenConnect.WindowsClient.exe.config_f7f1 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0005_none_cdce1c59036418c7\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad32815 = 680074007400700073003a002f002f0063006f0073006c00630061006e0061006400610031002e00730063007200650065006e0063006f006e006e006500630074002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006d0061006e00690066006500730074000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0005_none_3c3096683062d5f3\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0005_none_7eb8c5776d0b1316\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0005_none_7eb8c5776d0b1316\implication!scre..tion_27fa83f1ad328157_001a.0005_e218 = 68747470733a2f2f636f736c63616e616461312e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0005_none_cdce1c59036418c7\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb\scre..core_420d02d3849b7992_001a.0005_none_37b8be86f41 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0005_none_3c3096683062d5f3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb\scre..vice_420d02d3849b7992_001a.0005_none_e90c56cf89d = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_27fa83f1ad328157_a61738684e8fb74b	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0005_none_cdce1c59036418c7	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0005_none_3c3096683062d5f3\implication!scre..tion_27fa83f1ad328157_001a.0005_e218 = 68747470733a2f2f636f736c63616e616461312e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb\scre..dows_420d02d3849b7992_001a.0005_none_3c309668306	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Software\Microsoft\Windows	ScreenConnect.WindowsClient.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\LO6TDYCK.9WA\0K24GX7Q.4AK\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\NP2JW1CT.M72\BRXREKEJ.431\scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1416	2026-08-04_d0558388875c6dfcaf928211e0bbe35f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	2760	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 2760	1416	2026-08-04_d0558388875c6dfcaf928211e0bbe35f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	85
PID 2760 wrote to memory of 4044	2760	dfsvc.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-04_d0558388875c6dfcaf928211e0bbe35f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_d0558388875c6dfcaf928211e0bbe35f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Users\Admin\AppData\Local\Apps\2.0\NP2JW1CT.M72\BRXREKEJ.431\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\NP2JW1CT.M72\BRXREKEJ.431\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:4044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\NP2JW1CT.M72\BRXREKEJ.431\manifests\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f.cdf-ms
Size 32KB
SHA256 d558889071030405ba3bc2565b20f2c2d54af00ab05507d161ec27e4ccaa26d5
MD5 aa9108dcc23d930f46178a3e73ba608f
SHA1 162846167639516d81d135a788e9d7e5b9f07bb3
SHA512 d87f7593edec7d5dd0c293f195c5a845778ffb0051474c3da7f66ba38d7c6c08169bfad1cd1be3e55666e3ab59d00d1ee2f3e8ebd48ffcdebc0ff7d3292f8715
SSDEEP 768:LI8GoaVAPL10HfgP2am6Yc2bS4VRf4X3ltSQGBviyhurj:1GDWi1PLfvaH4T8rj
TLSH
T192E27C65BB45F933D3239A32ECB2DB6566143EE34DE0119BB480333D8434A9A6F31AC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0005_none_37b8be86f414c2c3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\NP2JW1CT.M72\BRXREKEJ.431\manifests\scre..core_420d02d3849b7992_001a.0005_none_37b8be86f414c2c3.cdf-ms
Size 3KB
SHA256 5085df5c33e108350a0475a20c4f88577788ff1e50fd26d4db15ea79704aa120
MD5 242e15a621f9066c9412784045d57e6f
SHA1 44fb872dd7e53d8bb52e8a9a68f7276751390d92
SHA512 c6b9d405e96c24bbaddc539253ee17041d1740d2b5d6b0b8d64a433bb49cdeb02851ae30685f3b9148ab477b752fe1430937101e8f891ea24231d49862823583
TLSH
T18A6150027744CA53DA790332ACF2D6DE6FB83D83DE82810FB4C07B5F79324A555152A4
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0005_none_3c3096683062d5f3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\NP2JW1CT.M72\BRXREKEJ.431\manifests\scre..dows_420d02d3849b7992_001a.0005_none_3c3096683062d5f3.cdf-ms
Size 5KB
SHA256 bd6552fa52f33281d6455e3a490f0828bfe78a2d11544bf747ee773c0779aa26
MD5 eae78b6e54e0a48ef8007535ee2d0c59
SHA1 2129ccc296860756f799c6ba3f5a6525bed154a0
SHA512 eb8ee6f22fe615b7062c288053389dbb21725d933a38cf47f824d7c65481015b04991a9d7aed60fc7c686f373c6cd97d5687825f2f8f47fcaa8153db5dae458e
SSDEEP 96:7LA+RxlrheV+Ww7OHIacrorAzxSaS4MKC4St9IgnPsP:vRxlaJ0acrorA24Mt4SL6
TLSH
T1A8B11C127280DA27D5B907336CA6D3ED6F787D53CE42420B70C4BF5FB5726A60225295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\NP2JW1CT.M72\BRXREKEJ.431\manifests\scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0.cdf-ms
Size 7KB
SHA256 e38977f5afe6457ef38adb19438295963b2ccaa65e6a56f99dc66d1e90966fe0
MD5 14cf93a442394b8e7990ed8a4dae2fa1
SHA1 d9cc7fe6e44fec266db0399739447ce078c097a8
SHA512 c95e576d892d4d00b9e38519e2ba4f787e9585f4f39a99058aa967c74d1fde024f0c3c933eeb90723877483a3d8909a09e4a3f922ba2eba978bf01e9bb6dcc1e
SSDEEP 96:+OONr8nebEf4lFeV+WwwOf86rxk/ilpoVuYtT91OLE4FeUNRsasgfBH6q8THwgE:fwQneblaJ8rxk/apyuxbNDAC
TLSH
T190F11002B394EE17D0B84A339C9AD7DC2B347D96DE02460B71C0BF2FB9325E61726195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0005_none_cdce1c59036418c7.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\NP2JW1CT.M72\BRXREKEJ.431\manifests\scre..ient_420d02d3849b7992_001a.0005_none_cdce1c59036418c7.cdf-ms
Size 2KB
SHA256 abb0070fbd014ddaed84dfa8c1a977a69d0ec0dd63f6773975b94de388c0f2b3
MD5 cca5bb111f7bf93fe6c5f1ddd12e856f
SHA1 e93bff0bbfbbd60d06ea63b4efdfc7c35be17445
SHA512 f26a4ec4150a510986beab081ac243330c7fd0fbba02a04888edebffc3eb24c9df0f3edffcb43cf2b7585fb458120906cc2787e800aa56bc26d22dc520f5f286
TLSH
T1095189057684EEA7D67A0233EC92D6D933767E82EF07030BB180BB7F7A716C55616092
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_27fa83f1ad328157_001a.0005_none_7eb8c5776d0b1316.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\NP2JW1CT.M72\BRXREKEJ.431\manifests\scre..tion_27fa83f1ad328157_001a.0005_none_7eb8c5776d0b1316.cdf-ms
Size 22KB
SHA256 de1ea2886f157e3fac96b60443b5a6669db6e5b2e0dca9fb249f6054de202209
MD5 4a11e118f4ca3983acb2f5c62b0e0a36
SHA1 b25c4c60dbfffe5df9036b0ac2e38c67323219c7
SHA512 bec5d229dd38bf14b079316f215f66aa26156b6e38a9091102eb2fb9ab54949fce631bd8412279bb76ba42ada04d50db1e21fcfd1038513b704f825db5999786
SSDEEP 384:+RUg9OXaowdQEezGf1EeznljP2psgM7Y6GQhiEtcAQI7wTkaOs1sL3+tpbv:AXQa39fRPL10VQhiEtHJ7wTkf6sL3oxv
TLSH
T1D7A25B843B51E917C2135632DDC2CBE83639BED78EC2875B38013B1EAA74F49A6319C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0005_none_e90c56cf89d4262e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\NP2JW1CT.M72\BRXREKEJ.431\manifests\scre..vice_420d02d3849b7992_001a.0005_none_e90c56cf89d4262e.cdf-ms
Size 4KB
SHA256 0e7112bceeb68a7263b00f2eed974d82ad11bba2f8f0338795182f159fddcbeb
MD5 20ebc99f3c4027d54642dada41b75d9d
SHA1 33ebc6782fdc905afe48802cfca277fdc2be89bc
SHA512 9a04e4f57932152dc7be345ed5455fca3a3cc7f90e51267989a76cb40f9bc69c30e5d6bdf95ebc3456299ed8389d941f8b8a3f89f04332d1ae1acfbecec07df8
SSDEEP 96:+QcnOweV+Ww8Of4wLsht1NENRpF4HEDPuWiV:pJeLsFAjFn+V
TLSH
T1FFA101017380DA27E1A506339C96D2DD3B753C82EE43460B70C07F2F75726D6432A196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\NP2JW1CT.M72\BRXREKEJ.431\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f\ScreenConnect.ClientService.exe
Size 93KB
SHA256 16b4c273a25526e7262716ebe9d46480962347191a034595f18be740d9ce1e17
MD5 e1f2d75dd49355496a2e147cef862ede
SHA1 c7deaed84f074f4618c41132c89017a1d66191c1
SHA512 beed34147f64f740fadff9dbd7537183f4f9effa33a28e7adc7b12240e2e66ae46149f39c17adc0564a4487fbfca75f22d88556e4b3969779459018f80a5045b
SSDEEP 1536:dg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgcU0HME75:uhbNDxZGXfdHrX7rAc6myJkgcU0HxV
TLSH
T102935B13B5C28872D473093158E0DAB09A3FF9615E61DEAB3798022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\NP2JW1CT.M72\BRXREKEJ.431\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb\ScreenConnect.WindowsClient.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\NP2JW1CT.M72\BRXREKEJ.431\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb\user.config
Size 520B
SHA256 24a625a49d3e17065ac0104841e224a44d7e59bc1c4da5cb7b0cc3288f429a95
MD5 01e948960e2decfaaa734c6d26912437
SHA1 587df2f4f53db32a02ea4914702128166bef5a27
SHA512 d232aa7b3fa2264dfe018a7366163ff3802f9d1f5601d718fdbdd387cddcd718241a179c945ee7ddb6ee7452a086a2f606f248de09048f733f5af753eb4b4b6b
TLSH
T122F0E9A131846D4703A35E33C5124745EE72679B0566209874AF213A5F315DE03A31DF
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\NP2JW1CT.M72\BRXREKEJ.431\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb\user.config
Size 683B
SHA256 4a3b4b2c2d003e6c514ed2696d982fcbc3c28ffbd752ba46dcff3ddfc430e66a
MD5 de28c3c6e45d8fef0f85131f820c3cec
SHA1 ce38988070b2f1e04e81b18b192c7d01fe2ce449
SHA512 bc6ed703dfe403939ca4c9d7787bf6c8a26c37133cf72f0b258915969920d81c1ed1b05df8e58fe65053e466610dfa3a23d144b7cbd7ee481ba0b3dfd6a8694f
TLSH
T1E50144A571C0AE4602A72E33D6224745FE32165B02A620D834AE213B5F305DF07E32DF
MD5 SHA1 SHA512 TLSH

Submit Download

TCTXBMXP.7OP.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\5ZXNYHXZ.KKL\TCTXBMXP.7OP.application
Size 114KB
SHA256 2505ec5e02dfccd9659bc26e66fc3661566d8099f7171b121f6569725e92cbc4
MD5 d5bc080b2f33bbf06e9ea8334f7134c0
SHA1 906353264ceabd2115839f018da8d538d02033b8
SHA512 9bfdbd6112882cfa2330a3570c5d2c9f12b59dfd7721e2747f57f34b97b3b4ab17b9b20e1e99219158f8c4e265476926cb27740e0dfe9b52d37ded6b89240e83
SSDEEP 1536:df7vKQXWsEPK+zuLD4UABnjRnfduUW5Ab4KpSE5GP/uLTvooycupKQ/IuKE:dzyQXWsYuuBn1nfdvg2XOcupX1
TLSH
T19AB3A63ACE30F4C0477DB021D1A52D673D811B93DBB31BACD90A186B0E69796EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LO6TDYCK.9WA\0K24GX7Q.4AK\ScreenConnect.Client.dll
Size 412KB
SHA256 8e5531c2b302f9c95ed32ac7481d3535b6d51147257d317686c07ea1a9cb8362
MD5 a86960060335629b7a4b061360c18ea1
SHA1 b7ae51d426631f73c70f6ff3d82a39cf592fb047
SHA512 57663335082fb7fa90d8039ffa8f65964379b75741cdc58b61d16119951f4b1567bca200e2a9eaec023e6cc243b136426705396559cbac918582633f2bf87249
SSDEEP 6144:uS59LDc+cn1vp42Y5sD8ETEavHy+vd7JPYIYyqQni65/PTG:1pcM2xDHTEavSW7OQniOG
TLSH
T18894CF8163E85D6EE9AF1F73F0A1A1344E76BC056182F2EE0D0475F41A7B7828B546E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LO6TDYCK.9WA\0K24GX7Q.4AK\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 f4f96f09fadd8c91ba8e5cdfedea6e330d5efb0514804f2d811feeb4aac9b757
MD5 b8d02f114f47cb2d6b944e2bbeb88181
SHA1 6f721ca6225b51bf275519e8a0607fcec3effb8e
SHA512 480eee982952f8d99a7e0c9fb4d10ea2a4def1e3ddf68a6b4f862032a197e29044c4764502b69808ab763f17517387dda43c2c64b5b3627db4a4c0b5b78249e5
TLSH
T15D117B0191C4FA3A1F3341D1BEE7E46067AD5B73158E194BB069689F8B29AD7434B0B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LO6TDYCK.9WA\0K24GX7Q.4AK\ScreenConnect.ClientService.dll
Size 92KB
SHA256 ed32fe0d924959020cbef0534a7ba612e94263ccc74837475f3b5a6a726acad0
MD5 29e07dd26e1a322bc49505d0239c78ed
SHA1 bc45a3738ed666f2b6b94f22bc7fe22ffedd01e5
SHA512 3639a2889f6187144364ca73d3c13eec2bfa31964bbbe148d26352ea52f6fb7e1010d92a83e362092ab3a47f206a5849972b84b72389367e7aceb96d84d98464
SSDEEP 1536:Yz0NVwxLGDPpGiIVzLU49GWZaiQOV+eD/0nUazxDa91g0Bp7A:Yz2Lj8FFPA0QOVx/IUazxDa91gEpc
TLSH
T123935C4293BCA92ACDDF1E34B461F1610AB1B913D8E6EBD46DC860DA1F523D21F4439B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LO6TDYCK.9WA\0K24GX7Q.4AK\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 0584d36dea99da050f42b3b5ea17d6983632c2b1a8e5ca201b3c00a47998737d
MD5 0ea927442992cdeb93b6182a0159b146
SHA1 4c0d7667559eb4494df34e55da9ff2f66cda8c99
SHA512 2b8e6deb4dd222663842e95d4e36a2326412a4578f633c70de9b2e583aa4726aa6306896a336c730bef58f986de6764a9677f3a76a35a4e0ddc4a921c7b531c9
TLSH
T10F31080191C4FA751F3302C1BDE7E4609B9D5763158E290BB059A99FCF29AD7434B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LO6TDYCK.9WA\0K24GX7Q.4AK\ScreenConnect.Core.dll
Size 579KB
SHA256 f64cb7ab5f105c22348a22e02dd506ff45456884639fee0f322862112860af24
MD5 f2577cb81a640ef1219dac5e98e72a30
SHA1 a7507898469487eb7c7fed613194cf97273a5fc6
SHA512 424ce0322428eee6ab0ac3ebbe5cebdcd48247a4e0f805ae77ea6fb115e12e20f0ac80749a65f4bf5de57622111e65933f8bbe1929d052fa91b57970b8eae901
SSDEEP 6144:X3IGbCeeMkZBRqj1xcvWlEfu37PtJp71A/J7ysZVFeEjIfR9BwnNXJyS/chwDTaT:npbCeMmxnFrtyFQEq+NXJyLAO
TLSH
T122C47D1273D8B767C5BE1B7BE0B061144270E40A7CBBE79B1994F4A9ACA73854E413B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LO6TDYCK.9WA\0K24GX7Q.4AK\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 fb74391d810e4056258197589dd397313c3de41d245d738b5a9f1b68d1f6f9ec
MD5 e82556b925f08d8bb7dce616c437c65b
SHA1 307dde221b1ec99e4d2a5e009c4899edcd8a5fe0
SHA512 646144bdc29ace38bff7d860ab976e1cffec909cf6b4441c8f748a6025cc5726a78cc105008f8c0d882b3cb8df3e76e33e30a6e02e16a11451e9a852301dd641
TLSH
T1F9217C0181C8FA261F3302D2BDE7E42197AE5733158D194B74696C9FCB2DAD24747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LO6TDYCK.9WA\0K24GX7Q.4AK\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 c50d6e8d93ed197dd0cfb647743b42a2a6a9289f6db04092f56cefd6d569663e
MD5 9ec7c251b0b81419c7b5549eb50721b6
SHA1 198c3abd767595efc0b44e11b0bdfafdf8e3dba6
SHA512 c53596ea4ad4012ba48b81fdf6c36d0be5f5e2c056cfd64da4c158882976d65a0a243397f377c7daa8f1026789f4f72d3da0669aa51c49de62f5318382ed63d7
SSDEEP 24576:yBjf54NHFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPn:K4NHJkGYYpT0+TFiH7efPO
TLSH
T13A85BD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LO6TDYCK.9WA\0K24GX7Q.4AK\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 901598794f456530c9d7479a8dfee10633fe8e6e1a9b8d270ad4026f10632c0e
MD5 97f675907d9dc70dc4f308d65f642308
SHA1 4c869875ade3db7ac7012c011537cf8332d4fc2b
SHA512 9fab9127a078125ff125f39739a510befa8c74d32655ef2e07c9d512e5cff0a1c15fc3da7e4a1cf225b92d29458efcb3278cf23591ac9cbc33e1bff8db8e2d40
TLSH
T14241F11181C8FA250F3302C2BEEBE431979E5723158E190BB499AD8BCF29AD7474B037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LO6TDYCK.9WA\0K24GX7Q.4AK\ScreenConnect.WindowsBackstageShell.exe
Size 71KB
SHA256 3d8b4ccdd893b97aa4e30d92c3a57cd54632529fdb730af29f3fba8435f2e12d
MD5 b34a0403a58513a09fe43d5752edb975
SHA1 9fc4d0eee77ff12f96a04f329764aa74d20db5fc
SHA512 d685bba60b1b77008219b27413df198863e4c254306846f996a3e0e8c68a4a58ae4e30c443b64ee70a6886c9b7026ca7cadcef8e69b5a43459967d6e86e67e29
SSDEEP 768:FzlYsf/wCdOBti13kDeuRsUQHjSz2dvmDSmBsuMQX5E+TCMXESslbq7kaYiDLk52:FRYKtd739PDVdvmDqfQX5E+TC7huka7R
TLSH
T1F2637D5063DCD535E9FF2E34B0E1F6600AB3BA6388E1D7D52DA821DA2E127C14F64396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LO6TDYCK.9WA\0K24GX7Q.4AK\ScreenConnect.WindowsClient.exe
Size 678KB
SHA256 2ad8f126461607aad3fa31a41f1f39bc74f471fd84191b43e205610db2c4cf09
MD5 7f626afbf536e6b90f7724a0d5cc8613
SHA1 050ccf94dd3a4e8455e35609dff01011d83a55d5
SHA512 77bb24905ccff34d96c508baaadc7f76e5e53aa43444aaec65c350017e0d1425b410f334610a70acfe280580fa2a2d0641e42d9fd50bc02095c1418e5eda5d5d
SSDEEP 6144:YLzDkss+w0qZxJoIqxXby4Ag9THzLH1SPl3HdmBtwxRFc822/R4IHZ2CZlAs1fzl:KnksifZxJoHW043Oc92TpN4
TLSH
T106E47E2137AC9B7BC4AF0B39B0721914D7B4E8436385DF9EE944B0EA1D877898D0539B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LO6TDYCK.9WA\0K24GX7Q.4AK\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LO6TDYCK.9WA\0K24GX7Q.4AK\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 1f35f1ccba28750025d5dce8710a78188a6938e59593aae725ad7157fbc2667a
MD5 6edb13c5d06e16808f8feedee7b68c1b
SHA1 0e9f66850387a669b63d566be9d1ee424967689a
SHA512 4077e92e5ca5368c1ff0ee269fb8c919feb94ad679b67f25c038f453c241dcbc165bb13fe783d97fc5b964321b582c5850174c4cd483569dc506b52fb7e4ff9b
TLSH
T1F851E61151C4FA750F3302C1BEEBE4709B9E5762158E190BB499A98FCF2CA97474B037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LO6TDYCK.9WA\0K24GX7Q.4AK\ScreenConnect.WindowsClient.exe.manifest
Size 25KB
SHA256 a44d4efeb6c96b1061c8f352a81c8a4790d84c77295df390bb34045b52833403
MD5 9401969a1239b9cebcf6aa61c39ef58c
SHA1 fe35504e971c015044096558305ee471d96e8784
SHA512 24b484fcf40d1a1730406ca9884ef89c1a7993394f3c3453a305cecc59e12f100fe28e3e9a876b2e776f00a2b633be6649ad4eed2543903cf40384eb5546664a
SSDEEP 384:LeVAFg+UEoMa6IfaAhLEezk/F3EezuEeznljP2psHM7YCfi17P2aa16YcnVC1bS+:L+azgPLs0CfgP2am6Yc2bS4VRfx
TLSH
T133C24A9A8CC17C2103329194FEE38A28FD043F6345E9109E7D4D15AFDF64A5A63972EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LO6TDYCK.9WA\0K24GX7Q.4AK\ScreenConnect.WindowsFileManager.exe
Size 91KB
SHA256 a8bad1d3b18bd9ec3836b852815c87a73b339caef3d43cd616d33e0d1806f03f
MD5 4ba1ab0423aa4685eefc3a8f9facca38
SHA1 69bf0a0baedff7dedacc808b94401c8f4933b30e
SHA512 67e78fea095c7bb395bd97d8cabd3c6d40b599d577ebcdebbbeb0b4e7feb440680a986af5694f63986eaba32ad855b3ba3bdbd90dfe85abeefdb2e0d16a0245f
SSDEEP 1536:fUMOI2lP49yvI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVdiWv7zzUX:0IQRukLCZvjO
TLSH
T19593D552356A6231DEC5C033A492E9B19C377F6207FDC5BD28A1BA3639E03943E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1416-3-0x0000000004C50000-0x0000000004C5C000-memory.dmp

Download

memory/1416-6-0x00000000053B0000-0x0000000005954000-memory.dmp

Download

memory/1416-7-0x0000000004F00000-0x0000000004F92000-memory.dmp

Download

memory/1416-0-0x0000000004CF0000-0x0000000004D00000-memory.dmp

Download

memory/1416-8-0x0000000004CF0000-0x0000000004D00000-memory.dmp

Download

memory/1416-5-0x0000000004CC0000-0x0000000004CE8000-memory.dmp

Download

memory/1416-4-0x0000000004D70000-0x0000000004E04000-memory.dmp

Download

memory/1416-10-0x0000000004CF0000-0x0000000004D00000-memory.dmp

Download

memory/1416-2-0x0000000004CF0000-0x0000000004D00000-memory.dmp

Download

memory/1416-9-0x0000000007BB0000-0x0000000007D60000-memory.dmp

Download

memory/1416-1-0x00000000025F0000-0x00000000025F8000-memory.dmp

Download

memory/1416-11-0x0000000004CF0000-0x0000000004D00000-memory.dmp

Download

memory/2760-26-0x00000204C3100000-0x00000204C3110000-memory.dmp

Download

memory/2760-70-0x00000204C6ED0000-0x00000204C7080000-memory.dmp

Download

memory/2760-13-0x00000204C2DC0000-0x00000204C2F46000-memory.dmp

Download

memory/2760-14-0x00000204C3100000-0x00000204C3110000-memory.dmp

Download

memory/2760-18-0x00000204C65E0000-0x00000204C6630000-memory.dmp

Download

memory/2760-76-0x00000204C6A30000-0x00000204C6A4A000-memory.dmp

Download

memory/2760-52-0x00000204C6BE0000-0x00000204C6C4C000-memory.dmp

Download

memory/2760-12-0x00000204A87C0000-0x00000204A87C8000-memory.dmp

Download

memory/2760-64-0x00000204C6C10000-0x00000204C6CA4000-memory.dmp

Download

memory/2760-25-0x00000204C3250000-0x00000204C33F9000-memory.dmp

Download

memory/2760-379-0x00000204C3250000-0x00000204C33F9000-memory.dmp

Download

memory/2760-58-0x00000204C6CD0000-0x00000204C6D7E000-memory.dmp

Download

memory/2760-42-0x00000204C3250000-0x00000204C33F9000-memory.dmp

Download

memory/4044-356-0x0000000000710000-0x00000000007BE000-memory.dmp

Download

memory/4044-380-0x000000001BDC0000-0x000000001BF69000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads