090d55a238cded9ae9218b1e253ccddafb652bfa49b47fcb6357a56614184e35

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_d0558388875c6dfcaf928211e0bbe35f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 2.5MB
Sample260804-ref23abh69
SHA256 090d55a238cded9ae9218b1e253ccddafb652bfa49b47fcb6357a56614184e35
MD5 d0558388875c6dfcaf928211e0bbe35f
SHA1 84b50904fe1450bc8c075fbfae77cae7a68d4e99
SHA512 3e77361bbe8e07ac1b2c1f9d66a39bfc13960ca66773761bf93d9e032b3e7360f55d62f053b16d27dbd679765058386aea11dbfa95800e78f0036c06ba28ac8f
SSDEEP 24576:2sId9BbVER68MYBjf5QN9Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT09:MC3QN9JkGYYpT0+TFiH7efP8cA
TLSH
T174C5BD01F3D695B6C4AF0538D47A925A6A70BC0403A6CBFB67C4B9762D337C08E357A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 7 IoCs

flow	pid	Process
18	2624	dfsvc.exe
18	2624	dfsvc.exe
18	2624	dfsvc.exe
18	2624	dfsvc.exe
18	2624	dfsvc.exe
18	2624	dfsvc.exe
18	2624	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
4892	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\G17HPAXH.Y90\BDRKWN2V.W7M\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_d0558388875c6dfcaf928211e0bbe35f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0005_none_3c3096683062d5f3	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb\scre..ient_420d02d3849b7992_001a.0005_none_cdce1c59036	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0\lock!0e00000073e75a0e400a0000ec0a000000000000000000004 = 30303030306134302c30316464323431613963363833393937	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f\lock!04000000fae85a0e1c130000900e000000000000000000005 = 30303030313331632c30316464323431616238343662653734	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_442d9093522db512	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_27fa83f1ad328157_a61738684e8fb74b\LastRunVersion = 68747470733a2f2f636f736c63616e616461312e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad32815 = 54007200750065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0\DigestValue = 050ccf94dd3a4e8455e35609dff01011d83a55d5	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0\Files\ScreenConnect.WindowsClient.exe_6492277df2d = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_27fa83f1ad328157_a61738684e8fb74b	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0005_none_7eb8c5776d0b1316\implication!scre..tion_27fa83f1ad328157_001a.0005_e218 = 68747470733a2f2f636f736c63616e616461312e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0005_none_37b8be86f414c2c3\lock!0e000000fae85a0e1c130000900e000000000000000000005 = 30303030313331632c30316464323431616238343662653734	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows	ScreenConnect.WindowsClient.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0005_e21878aac1367bfe	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb\implication!scre..tion_27fa83f1ad328157_001a.0005_e21878aac = 68747470733a2f2f636f736c63616e616461312e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0005_none_37b8be86f414c2c3\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0\SizeOfStronglyNamedComponent = f3c00a0000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb\scre..core_420d02d3849b7992_001a.0005_none_37b8be86f41 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0005_none_e90c56cf89d4262e\SizeOfStronglyNamedComponent = 4b8a010000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0005_e21878aac1367bfe\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f\Files\ScreenConnect.WindowsClient.exe.config_f7f1 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb\lock!1100000092e75a0e400a0000ec0a00000000000000000000e9d128 = 30303030306134302c30316464323431613963363833393937	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0\lock!0c000000fae85a0e1c130000900e000000000000000000005 = 30303030313331632c30316464323431616238343662653734	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0005_none_cdce1c59036418c7\lock!1600000009e95a0e1c130000900e000000000000000000001 = 30303030313331632c30316464323431616238343662653734	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0005_none_e90c56cf89d4262e\lock!1400000009e95a0e1c130000900e000000000000000000001 = 30303030313331632c30316464323431616238343662653734	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0005_none_3c3096683062d5f3\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0005_none_37b8be86f414c2c3\SizeOfStronglyNamedComponent = 7320090000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0005_none_e90c56cf89d4262e\lock!06000000fae85a0e1c130000900e000000000000000000005 = 30303030313331632c30316464323431616238343662653734	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_442d9093522db512\LastRunVersion = 68747470733a2f2f636f736c63616e616461312e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad32815 = 30000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0005_e21878aac1367bfe	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f\Files\ScreenConnect.ClientService.exe_e781b1ee36f = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0005_none_37b8be86f414c2c3\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0005_none_e90c56cf89d4262e\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0005_none_e90c56cf89d4262e\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0005_none_3c3096683062d5f3\lock!0a000000fae85a0e1c130000900e000000000000000000005 = 30303030313331632c30316464323431616238343662653734	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0005_none_7eb8c5776d0b1316\SizeOfStronglyNamedComponent = 0323020000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0005_e21878aac1367bfe\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f\Files\ScreenConnect.WindowsFileManager.exe_0e21f8 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0005_none_37b8be86f414c2c3\DigestValue = a7507898469487eb7c7fed613194cf97273a5fc6	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0005_none_e90c56cf89d4262e\Files\ScreenConnect.ClientService.dll_e781b1c636f = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_27fa83f1ad328157_a61738684e8fb74b	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0005_none_e90c56cf89d4262e\implication!scre..tion_27fa83f1ad328157_001a.0005_e218 = 68747470733a2f2f636f736c63616e616461312e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f\SizeOfStronglyNamedComponent = 02ed040000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0005_none_cdce1c59036418c7\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0005_none_37b8be86f414c2c3\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb\HasRunBefore = 01	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0\implication!scre..tion_27fa83f1ad328157_001a.0005_e218 = 68747470733a2f2f636f736c63616e616461312e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb\scre..ient_420d02d3849b7992_001a.0005_none_cdce1c59036 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0005_none_cdce1c59036418c7\Files\ScreenConnect.Client.dll_fc1d7bd48553fcab = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	ScreenConnect.WindowsClient.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\G17HPAXH.Y90\BDRKWN2V.W7M\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\WCOCYV3H.T8C\CM8PBM45.VQE\scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4928	2026-08-04_d0558388875c6dfcaf928211e0bbe35f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	2624	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 2624	4928	2026-08-04_d0558388875c6dfcaf928211e0bbe35f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	90
PID 2624 wrote to memory of 4892	2624	dfsvc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-04_d0558388875c6dfcaf928211e0bbe35f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_d0558388875c6dfcaf928211e0bbe35f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Users\Admin\AppData\Local\Apps\2.0\WCOCYV3H.T8C\CM8PBM45.VQE\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\WCOCYV3H.T8C\CM8PBM45.VQE\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:4892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\WCOCYV3H.T8C\CM8PBM45.VQE\manifests\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f.cdf-ms
Size 32KB
SHA256 1e23cc8241fc8cb0075f2de8e48cc80a40836ffbfea387d103503ef38a52a5bf
MD5 dc1b11674029dd4f0684cbe1b31d41d4
SHA1 664971e97f6fa066abee7351516673dda1fe2d70
SHA512 65f3cf9b136e264e6fefc88a93c619eaf1ee1ee0229b0d4a40c41a92c40a8977c0d463086a33ad97c1fec1cb98b478b64dc8d47d95c38bccdc7424123ae7da8a
SSDEEP 768:VIwwaVAPL10HfgP2am6Yc2bS4VRfI+++am+:HrWi1PLfvR+
TLSH
T1B4E2D541BBD2E923D2121633DCD6C7E87235BDD14E92179B34413B2EAD707DA1A33A89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0005_none_37b8be86f414c2c3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\WCOCYV3H.T8C\CM8PBM45.VQE\manifests\scre..core_420d02d3849b7992_001a.0005_none_37b8be86f414c2c3.cdf-ms
Size 3KB
SHA256 26605b7be5083747c321c3aca4e79b30eef90908fa72ca26a974e31446a17066
MD5 553720aafaa3868b11bbf8fcba3c0f13
SHA1 1f13a71e12fce626181beb3787d7661aceec5b34
SHA512 30151ccb69bb80b18a291a8144edead62cf6e0fc4e909309ea46ed01bd2ca7f62404469bdd8c16b94483ff658276993e362876d26159e6ad81d0dbd6881ef0a1
TLSH
T1A96150027744CA53EA790332ACF2C2DE6FB83D83CE82810FB4C07B5F79324A555212A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0005_none_3c3096683062d5f3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\WCOCYV3H.T8C\CM8PBM45.VQE\manifests\scre..dows_420d02d3849b7992_001a.0005_none_3c3096683062d5f3.cdf-ms
Size 5KB
SHA256 65858648aec1ec6a0970c0218b89d00b1e49ab5b0a35551dbdc26bbc2473f789
MD5 9e3fdeee6fa6027746605b63aba03d06
SHA1 45b3719d9b0ef4a8f741799d1b837ad3321e6dfc
SHA512 26a15184bc16b120d3c52d0478f7ab5ec7d6ac57a9b232a71d77f51fa476bf4cc1cf0ff3422afa5f4be72e53725be18a23cc8452f673351d4d52e9598abc879b
SSDEEP 96:HLA+Rxlr3eV+Ww7OHIKOr21XiezwZkg4ngnPsP:zRxlcJ0KlY6u6
TLSH
T1C3B154117290DD17D5B90633ACA6D3ED2B36BE92DE43430B70D4FB2FBA326D65222095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\WCOCYV3H.T8C\CM8PBM45.VQE\manifests\scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0.cdf-ms
Size 7KB
SHA256 e0bb6aeef26b581e5fdb41042a6a5ec6d23740aa20342e265648bf5f098e4924
MD5 cf83d48b4fb6c85f80469fa880bc70ca
SHA1 a15065e8ac0f705adf7b038c2fd606328b4558a7
SHA512 9d11cbe27dd8ef3a3f7ef0023343c51af15d4197389c33941e4c2911fe73fab849852da5d372fd27f6e9a1e8444853c689db5ff1ecd18c679c63501a33c50ff3
SSDEEP 96:oOONr8nebEf4kFeV+WwwOf86g6JUtX4cwrWISHZGxMNHAJAY6q8THwgE:5wQnebkaJ8gJTsatLC
TLSH
T12BF16B017690DD1AD5E905339CA6C3ECBA26BEA6DE43031770C4BF2FB6321E657220D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0005_none_cdce1c59036418c7.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\WCOCYV3H.T8C\CM8PBM45.VQE\manifests\scre..ient_420d02d3849b7992_001a.0005_none_cdce1c59036418c7.cdf-ms
Size 2KB
SHA256 bfe07dda299c19782dcde5ca04658d9ff8ae63a711f6dade35596fcdf4ca730a
MD5 90154895e58f2dcd921c13ab396d086b
SHA1 785b59cbfd164c7f5e34ae77496d5082a28e2494
SHA512 e6178c4fad7c0d92224f1031009115c6c1b7528ba20f7f58a79c7ae651ff581d2653b2f1377875511aa4bbc426e6b08ba21ca317d17520ee036307877d895091
TLSH
T15B5179053684EAA7D67A0233EC92D2DD32757D82EF430307B180BB7F3A716C55612092
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_27fa83f1ad328157_001a.0005_none_7eb8c5776d0b1316.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\WCOCYV3H.T8C\CM8PBM45.VQE\manifests\scre..tion_27fa83f1ad328157_001a.0005_none_7eb8c5776d0b1316.cdf-ms
Size 22KB
SHA256 5a54f94c9f76dc7e6b22009aeba2bc9bd03a5be5c957f3369028f83b7fe2e32a
MD5 606711479e7ec0f777a7129bfec87e0c
SHA1 1c05fceb9bfc47414a18295c128237366e321930
SHA512 c83b89ac23bcd16f7d8e8ae59f249a17af5d8d207feaa8dd15b35437f923fa9ae374da16f38257b0326c613d78403620649fc2acc336a77c6ab5a75faf2316f3
SSDEEP 384:mRUM9OXaowdQEezGf1EeznljP2psgM7Y6GQhiEtcAQI7wTkaOs1sL3+tpbh:YPQa39fRPL10VQhiEtHJ7wTkf6sL3oxh
TLSH
T137A25B843B51E916C2125632DDC2CBE83539BED78EC2875B38053B5EAA74F49A6319C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0005_none_e90c56cf89d4262e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\WCOCYV3H.T8C\CM8PBM45.VQE\manifests\scre..vice_420d02d3849b7992_001a.0005_none_e90c56cf89d4262e.cdf-ms
Size 4KB
SHA256 5458b3c064e8fce881761399972bbed05561144145c863bc0fa2b66c23bc456c
MD5 fe9468a4b9699afe20e80b45fb685427
SHA1 8eff2fd1e0db1d0b55af7e81ce2a982c4f8ae8dd
SHA512 08cc339899b6c6ea65ffca64c0aa38da911024c8edda5117d22fbf24ed8f2ab98f43e86cfe62da57fca1b52ac17489c92d6305446449b2404e3dcadcad3d98f2
SSDEEP 96:XQcnOxeV+Ww8Of4wKOr21XmtTO0gzDPuWiV:dJeKl2i+V
TLSH
T10BA189017280ED67E6A90633EC92C2DD3A767D82EE43530B71C4BF2F76722D65326096
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\WCOCYV3H.T8C\CM8PBM45.VQE\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb\user.config
Size 520B
SHA256 24a625a49d3e17065ac0104841e224a44d7e59bc1c4da5cb7b0cc3288f429a95
MD5 01e948960e2decfaaa734c6d26912437
SHA1 587df2f4f53db32a02ea4914702128166bef5a27
SHA512 d232aa7b3fa2264dfe018a7366163ff3802f9d1f5601d718fdbdd387cddcd718241a179c945ee7ddb6ee7452a086a2f606f248de09048f733f5af753eb4b4b6b
TLSH
T122F0E9A131846D4703A35E33C5124745EE72679B0566209874AF213A5F315DE03A31DF
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\WCOCYV3H.T8C\CM8PBM45.VQE\scre..tion_27fa83f1ad328157_001a.0005_c243907d67278fdb\user.config
Size 683B
SHA256 4a3b4b2c2d003e6c514ed2696d982fcbc3c28ffbd752ba46dcff3ddfc430e66a
MD5 de28c3c6e45d8fef0f85131f820c3cec
SHA1 ce38988070b2f1e04e81b18b192c7d01fe2ce449
SHA512 bc6ed703dfe403939ca4c9d7787bf6c8a26c37133cf72f0b258915969920d81c1ed1b05df8e58fe65053e466610dfa3a23d144b7cbd7ee481ba0b3dfd6a8694f
TLSH
T1E50144A571C0AE4602A72E33D6224745FE32165B02A620D834AE213B5F305DF07E32DF
MD5 SHA1 SHA512 TLSH

Submit Download

NWMDWK5O.1RY.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\64ZVMVDD.A86\NWMDWK5O.1RY.application
Size 114KB
SHA256 2505ec5e02dfccd9659bc26e66fc3661566d8099f7171b121f6569725e92cbc4
MD5 d5bc080b2f33bbf06e9ea8334f7134c0
SHA1 906353264ceabd2115839f018da8d538d02033b8
SHA512 9bfdbd6112882cfa2330a3570c5d2c9f12b59dfd7721e2747f57f34b97b3b4ab17b9b20e1e99219158f8c4e265476926cb27740e0dfe9b52d37ded6b89240e83
SSDEEP 1536:df7vKQXWsEPK+zuLD4UABnjRnfduUW5Ab4KpSE5GP/uLTvooycupKQ/IuKE:dzyQXWsYuuBn1nfdvg2XOcupX1
TLSH
T19AB3A63ACE30F4C0477DB021D1A52D673D811B93DBB31BACD90A186B0E69796EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\G17HPAXH.Y90\BDRKWN2V.W7M\ScreenConnect.Client.dll
Size 412KB
SHA256 8e5531c2b302f9c95ed32ac7481d3535b6d51147257d317686c07ea1a9cb8362
MD5 a86960060335629b7a4b061360c18ea1
SHA1 b7ae51d426631f73c70f6ff3d82a39cf592fb047
SHA512 57663335082fb7fa90d8039ffa8f65964379b75741cdc58b61d16119951f4b1567bca200e2a9eaec023e6cc243b136426705396559cbac918582633f2bf87249
SSDEEP 6144:uS59LDc+cn1vp42Y5sD8ETEavHy+vd7JPYIYyqQni65/PTG:1pcM2xDHTEavSW7OQniOG
TLSH
T18894CF8163E85D6EE9AF1F73F0A1A1344E76BC056182F2EE0D0475F41A7B7828B546E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\G17HPAXH.Y90\BDRKWN2V.W7M\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 f4f96f09fadd8c91ba8e5cdfedea6e330d5efb0514804f2d811feeb4aac9b757
MD5 b8d02f114f47cb2d6b944e2bbeb88181
SHA1 6f721ca6225b51bf275519e8a0607fcec3effb8e
SHA512 480eee982952f8d99a7e0c9fb4d10ea2a4def1e3ddf68a6b4f862032a197e29044c4764502b69808ab763f17517387dda43c2c64b5b3627db4a4c0b5b78249e5
TLSH
T15D117B0191C4FA3A1F3341D1BEE7E46067AD5B73158E194BB069689F8B29AD7434B0B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\G17HPAXH.Y90\BDRKWN2V.W7M\ScreenConnect.ClientService.dll
Size 92KB
SHA256 ed32fe0d924959020cbef0534a7ba612e94263ccc74837475f3b5a6a726acad0
MD5 29e07dd26e1a322bc49505d0239c78ed
SHA1 bc45a3738ed666f2b6b94f22bc7fe22ffedd01e5
SHA512 3639a2889f6187144364ca73d3c13eec2bfa31964bbbe148d26352ea52f6fb7e1010d92a83e362092ab3a47f206a5849972b84b72389367e7aceb96d84d98464
SSDEEP 1536:Yz0NVwxLGDPpGiIVzLU49GWZaiQOV+eD/0nUazxDa91g0Bp7A:Yz2Lj8FFPA0QOVx/IUazxDa91gEpc
TLSH
T123935C4293BCA92ACDDF1E34B461F1610AB1B913D8E6EBD46DC860DA1F523D21F4439B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\G17HPAXH.Y90\BDRKWN2V.W7M\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 0584d36dea99da050f42b3b5ea17d6983632c2b1a8e5ca201b3c00a47998737d
MD5 0ea927442992cdeb93b6182a0159b146
SHA1 4c0d7667559eb4494df34e55da9ff2f66cda8c99
SHA512 2b8e6deb4dd222663842e95d4e36a2326412a4578f633c70de9b2e583aa4726aa6306896a336c730bef58f986de6764a9677f3a76a35a4e0ddc4a921c7b531c9
TLSH
T10F31080191C4FA751F3302C1BDE7E4609B9D5763158E290BB059A99FCF29AD7434B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\G17HPAXH.Y90\BDRKWN2V.W7M\ScreenConnect.ClientService.exe
Size 93KB
SHA256 16b4c273a25526e7262716ebe9d46480962347191a034595f18be740d9ce1e17
MD5 e1f2d75dd49355496a2e147cef862ede
SHA1 c7deaed84f074f4618c41132c89017a1d66191c1
SHA512 beed34147f64f740fadff9dbd7537183f4f9effa33a28e7adc7b12240e2e66ae46149f39c17adc0564a4487fbfca75f22d88556e4b3969779459018f80a5045b
SSDEEP 1536:dg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgcU0HME75:uhbNDxZGXfdHrX7rAc6myJkgcU0HxV
TLSH
T102935B13B5C28872D473093158E0DAB09A3FF9615E61DEAB3798022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\G17HPAXH.Y90\BDRKWN2V.W7M\ScreenConnect.Core.dll
Size 579KB
SHA256 f64cb7ab5f105c22348a22e02dd506ff45456884639fee0f322862112860af24
MD5 f2577cb81a640ef1219dac5e98e72a30
SHA1 a7507898469487eb7c7fed613194cf97273a5fc6
SHA512 424ce0322428eee6ab0ac3ebbe5cebdcd48247a4e0f805ae77ea6fb115e12e20f0ac80749a65f4bf5de57622111e65933f8bbe1929d052fa91b57970b8eae901
SSDEEP 6144:X3IGbCeeMkZBRqj1xcvWlEfu37PtJp71A/J7ysZVFeEjIfR9BwnNXJyS/chwDTaT:npbCeMmxnFrtyFQEq+NXJyLAO
TLSH
T122C47D1273D8B767C5BE1B7BE0B061144270E40A7CBBE79B1994F4A9ACA73854E413B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\G17HPAXH.Y90\BDRKWN2V.W7M\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 fb74391d810e4056258197589dd397313c3de41d245d738b5a9f1b68d1f6f9ec
MD5 e82556b925f08d8bb7dce616c437c65b
SHA1 307dde221b1ec99e4d2a5e009c4899edcd8a5fe0
SHA512 646144bdc29ace38bff7d860ab976e1cffec909cf6b4441c8f748a6025cc5726a78cc105008f8c0d882b3cb8df3e76e33e30a6e02e16a11451e9a852301dd641
TLSH
T1F9217C0181C8FA261F3302D2BDE7E42197AE5733158D194B74696C9FCB2DAD24747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\G17HPAXH.Y90\BDRKWN2V.W7M\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 c50d6e8d93ed197dd0cfb647743b42a2a6a9289f6db04092f56cefd6d569663e
MD5 9ec7c251b0b81419c7b5549eb50721b6
SHA1 198c3abd767595efc0b44e11b0bdfafdf8e3dba6
SHA512 c53596ea4ad4012ba48b81fdf6c36d0be5f5e2c056cfd64da4c158882976d65a0a243397f377c7daa8f1026789f4f72d3da0669aa51c49de62f5318382ed63d7
SSDEEP 24576:yBjf54NHFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPn:K4NHJkGYYpT0+TFiH7efPO
TLSH
T13A85BD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\G17HPAXH.Y90\BDRKWN2V.W7M\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 901598794f456530c9d7479a8dfee10633fe8e6e1a9b8d270ad4026f10632c0e
MD5 97f675907d9dc70dc4f308d65f642308
SHA1 4c869875ade3db7ac7012c011537cf8332d4fc2b
SHA512 9fab9127a078125ff125f39739a510befa8c74d32655ef2e07c9d512e5cff0a1c15fc3da7e4a1cf225b92d29458efcb3278cf23591ac9cbc33e1bff8db8e2d40
TLSH
T14241F11181C8FA250F3302C2BEEBE431979E5723158E190BB499AD8BCF29AD7474B037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\G17HPAXH.Y90\BDRKWN2V.W7M\ScreenConnect.WindowsBackstageShell.exe
Size 71KB
SHA256 3d8b4ccdd893b97aa4e30d92c3a57cd54632529fdb730af29f3fba8435f2e12d
MD5 b34a0403a58513a09fe43d5752edb975
SHA1 9fc4d0eee77ff12f96a04f329764aa74d20db5fc
SHA512 d685bba60b1b77008219b27413df198863e4c254306846f996a3e0e8c68a4a58ae4e30c443b64ee70a6886c9b7026ca7cadcef8e69b5a43459967d6e86e67e29
SSDEEP 768:FzlYsf/wCdOBti13kDeuRsUQHjSz2dvmDSmBsuMQX5E+TCMXESslbq7kaYiDLk52:FRYKtd739PDVdvmDqfQX5E+TC7huka7R
TLSH
T1F2637D5063DCD535E9FF2E34B0E1F6600AB3BA6388E1D7D52DA821DA2E127C14F64396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\G17HPAXH.Y90\BDRKWN2V.W7M\ScreenConnect.WindowsClient.exe
Size 678KB
SHA256 2ad8f126461607aad3fa31a41f1f39bc74f471fd84191b43e205610db2c4cf09
MD5 7f626afbf536e6b90f7724a0d5cc8613
SHA1 050ccf94dd3a4e8455e35609dff01011d83a55d5
SHA512 77bb24905ccff34d96c508baaadc7f76e5e53aa43444aaec65c350017e0d1425b410f334610a70acfe280580fa2a2d0641e42d9fd50bc02095c1418e5eda5d5d
SSDEEP 6144:YLzDkss+w0qZxJoIqxXby4Ag9THzLH1SPl3HdmBtwxRFc822/R4IHZ2CZlAs1fzl:KnksifZxJoHW043Oc92TpN4
TLSH
T106E47E2137AC9B7BC4AF0B39B0721914D7B4E8436385DF9EE944B0EA1D877898D0539B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\G17HPAXH.Y90\BDRKWN2V.W7M\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\G17HPAXH.Y90\BDRKWN2V.W7M\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 1f35f1ccba28750025d5dce8710a78188a6938e59593aae725ad7157fbc2667a
MD5 6edb13c5d06e16808f8feedee7b68c1b
SHA1 0e9f66850387a669b63d566be9d1ee424967689a
SHA512 4077e92e5ca5368c1ff0ee269fb8c919feb94ad679b67f25c038f453c241dcbc165bb13fe783d97fc5b964321b582c5850174c4cd483569dc506b52fb7e4ff9b
TLSH
T1F851E61151C4FA750F3302C1BEEBE4709B9E5762158E190BB499A98FCF2CA97474B037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\G17HPAXH.Y90\BDRKWN2V.W7M\ScreenConnect.WindowsClient.exe.manifest
Size 25KB
SHA256 a44d4efeb6c96b1061c8f352a81c8a4790d84c77295df390bb34045b52833403
MD5 9401969a1239b9cebcf6aa61c39ef58c
SHA1 fe35504e971c015044096558305ee471d96e8784
SHA512 24b484fcf40d1a1730406ca9884ef89c1a7993394f3c3453a305cecc59e12f100fe28e3e9a876b2e776f00a2b633be6649ad4eed2543903cf40384eb5546664a
SSDEEP 384:LeVAFg+UEoMa6IfaAhLEezk/F3EezuEeznljP2psHM7YCfi17P2aa16YcnVC1bS+:L+azgPLs0CfgP2am6Yc2bS4VRfx
TLSH
T133C24A9A8CC17C2103329194FEE38A28FD043F6345E9109E7D4D15AFDF64A5A63972EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\G17HPAXH.Y90\BDRKWN2V.W7M\ScreenConnect.WindowsFileManager.exe
Size 91KB
SHA256 a8bad1d3b18bd9ec3836b852815c87a73b339caef3d43cd616d33e0d1806f03f
MD5 4ba1ab0423aa4685eefc3a8f9facca38
SHA1 69bf0a0baedff7dedacc808b94401c8f4933b30e
SHA512 67e78fea095c7bb395bd97d8cabd3c6d40b599d577ebcdebbbeb0b4e7feb440680a986af5694f63986eaba32ad855b3ba3bdbd90dfe85abeefdb2e0d16a0245f
SSDEEP 1536:fUMOI2lP49yvI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVdiWv7zzUX:0IQRukLCZvjO
TLSH
T19593D552356A6231DEC5C033A492E9B19C377F6207FDC5BD28A1BA3639E03943E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2624-16-0x000001A660520000-0x000001A660528000-memory.dmp

Download

memory/2624-18-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp

Download

memory/2624-27-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp

Download

memory/2624-28-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp

Download

memory/2624-31-0x000001A67AED0000-0x000001A67AF20000-memory.dmp

Download

memory/2624-38-0x000001A67B070000-0x000001A67B178000-memory.dmp

Download

memory/2624-39-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp

Download

memory/2624-68-0x000001A67F8E0000-0x000001A67F94C000-memory.dmp

Download

memory/2624-25-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp

Download

memory/2624-74-0x000001A67F9D0000-0x000001A67FA7E000-memory.dmp

Download

memory/2624-24-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp

Download

memory/2624-80-0x000001A67F910000-0x000001A67F9A4000-memory.dmp

Download

memory/2624-23-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp

Download

memory/2624-86-0x000001A67FBD0000-0x000001A67FD80000-memory.dmp

Download

memory/2624-22-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp

Download

memory/2624-92-0x000001A67AF20000-0x000001A67AF3A000-memory.dmp

Download

memory/2624-21-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp

Download

memory/2624-20-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp

Download

memory/2624-19-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp

Download

memory/2624-15-0x00007FFF25B4F000-0x00007FFF25B50000-memory.dmp

Download

memory/2624-17-0x000001A67ABF0000-0x000001A67AD78000-memory.dmp

Download

memory/4892-316-0x0000000000F10000-0x0000000000FBE000-memory.dmp

Download

memory/4928-7-0x00000000741F0000-0x00000000749AC000-memory.dmp

Download

memory/4928-6-0x0000000005350000-0x000000000590A000-memory.dmp

Download

memory/4928-13-0x00000000741F0000-0x00000000749AC000-memory.dmp

Download

memory/4928-12-0x00000000741F0000-0x00000000749AC000-memory.dmp

Download

memory/4928-11-0x00000000741F0000-0x00000000749AC000-memory.dmp

Download

memory/4928-10-0x0000000005030000-0x00000000051E0000-memory.dmp

Download

memory/4928-14-0x00000000741F0000-0x00000000749AC000-memory.dmp

Download

memory/4928-9-0x00000000741F0000-0x00000000749AC000-memory.dmp

Download

memory/4928-8-0x0000000004E80000-0x0000000004F12000-memory.dmp

Download

memory/4928-0-0x0000000074202000-0x0000000074203000-memory.dmp

Download

memory/4928-5-0x00000000741F0000-0x00000000749AC000-memory.dmp

Download

memory/4928-4-0x0000000004D50000-0x0000000004D78000-memory.dmp

Download

memory/4928-3-0x0000000004CC0000-0x0000000004D54000-memory.dmp

Download

memory/4928-26-0x00000000741F0000-0x00000000749AC000-memory.dmp

Download

memory/4928-2-0x0000000000E70000-0x0000000000E7C000-memory.dmp

Download

memory/4928-1-0x0000000000E00000-0x0000000000E08000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads