b8caa335146d6b01704f69c08a8c6b700caade573d1fafc6b53b7ae82e5284ff

Analysis

max time kernel
149s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 21:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_b6f3af443ba967605deb006364a7cc94_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 2.5MB
Sample260815-1a5pasvtbw
SHA256 b8caa335146d6b01704f69c08a8c6b700caade573d1fafc6b53b7ae82e5284ff
MD5 b6f3af443ba967605deb006364a7cc94
SHA1 eee7fcd555e78033a8d06878ef6a0307cebbb545
SHA512 e9970ae102198059332d62668201df7517f48839b5e2caf6cbc77a248c77210feff24afa69ae8e553ced33510043d555a6cd273c06bc7258d4b34452f96b8f6d
SSDEEP 24576:hYId9BbVER68MYBjf5QN9Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT0c:LC3QN9JkGYYpT0+TFiH7efP8jk
TLSH
T12FC5BD01F3D695B6C4AF0538D47A925A6A70BC0403A6CBFB67C4B9762D337C08E357A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 7 IoCs

flow	pid	Process
8	96	dfsvc.exe
8	96	dfsvc.exe
8	96	dfsvc.exe
8	96	dfsvc.exe
8	96	dfsvc.exe
8	96	dfsvc.exe
8	96	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
6104	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\Q867XD6E.XCB\HMOTJ9V4.KEZ\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_b6f3af443ba967605deb006364a7cc94_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_61fa8f5132ba7575\appid = 68747470733a2f2f73686172652e7265647361696c746563686e6f6c6f676965732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\implication!scre..tion_0000000000000000_001a.0004_61 = 68747470733a2f2f73686172652e7265647361696c746563686e6f6c6f676965732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a\implication!scre..tion_0000000000000000_001a.0004_61 = 68747470733a2f2f73686172652e7265647361696c746563686e6f6c6f676965732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\SizeOfStronglyNamedComponent = 1f82060000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\lock!0400000053f5590ed817000048170000000000000000000 = 30303030313764382c30316464326366636664653063386338	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8\lock!1600000062f5590ed817000048170000000000000000000 = 30303030313764382c30316464326366636664653063386338	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\Files\ScreenConnect.WindowsBackstageShell.exe_8 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\DigestValue = 5fd40fb2cb18d62abeac2db4effdccd69acb42ed	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\lock!11000000ebf3590e600000003c1100000000000000000000278e = 30303030303036302c30316464326366636633333434646361	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3\DigestValue = ab019c65abacee29d2737c71d6b44278d88df875	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3\lock!10000000adf3590e600000003c110000000000000000000 = 30303030303036302c30316464326366636633333434646361	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\lock!1400000062f5590ed817000048170000000000000000000 = 30303030313764382c30316464326366636664653063386338	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_4b2eaa1de5b9e80d	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_0000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\SizeOfStronglyNamedComponent = f85c040000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a\lock!1000000062f5590ed817000048170000000000000000000 = 30303030313764382c30316464326366636664653063386338	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a\lock!04000000adf3590e600000003c110000000000000000000 = 30303030303036302c30316464326366636633333434646361	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8\implication!scre..tion_0000000000000000_001a.0004_61 = 68747470733a2f2f73686172652e7265647361696c746563686e6f6c6f676965732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\implication!scre..tion_0000000000000000_001a.0004_61 = 68747470733a2f2f73686172652e7265647361696c746563686e6f6c6f676965732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\lock!08000000adf3590e600000003c110000000000000000000 = 30303030303036302c30316464326366636633333434646361	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\scre...exe_0000000000000000_001a.0004_none_5d4c1629b = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 680074007400700073003a002f002f00730068006100720065002e007200650064007300610069006c0074006500630068006e006f006c006f0067006900650073002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006d0061006e00690066006500730074000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_0000000000000 = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d002200680074007400700073003a002f002f00730068006100720065002e007200650064007300610069006c0074006500630068006e006f006c006f0067006900650073002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320036002e0034002e0033002e0039003600360032002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320036002e0034002e0033002e0039003600360032002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e00530065007400200063006c006100730073003d002200530079007300740065006d002e00530065006300750072006900740079002e005000650072006d0069007300730069006f006e0053006500740022000d000a00760065007200730069006f006e003d002200310022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d00220028006800740074007000730029003a002f002f00730068006100720065005c002e007200650064007300610069006c0074006500630068006e006f006c006f0067006900650073005c002e0063006f006d002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300030003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\SizeOfStronglyNamedComponent = f3ba0a0000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\SubstructureCreated = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8	dfsvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\OnlineAppQuotaUsageEstimate = "4017336"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\lock!1200000062f5590ed817000048170000000000000000000 = 30303030313764382c30316464326366636664653063386338	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\implication!scre..tion_0000000000000000_001a.0004_61 = 68747470733a2f2f73686172652e7265647361696c746563686e6f6c6f676965732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\Files\ScreenConnect.ClientService.exe_e781b1ee3 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a\lock!0200000053f5590ed817000048170000000000000000000 = 30303030313764382c30316464326366636664653063386338	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\lock!01000000e2f2590e600000003c110000000000000000000 = 30303030303036302c30316464326366636633333434646361	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0004_61fa8f5132ba7575\scre...exe_0000000000000000_001a.0004_none_5d4c1629b	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\Q867XD6E.XCB\HMOTJ9V4.KEZ\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\3091K08Z.DZ0\63HBKRYC.ZXC\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5044	2026-08-15_b6f3af443ba967605deb006364a7cc94_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	96	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 96	5044	2026-08-15_b6f3af443ba967605deb006364a7cc94_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	90
PID 96 wrote to memory of 6104	96	dfsvc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-15_b6f3af443ba967605deb006364a7cc94_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_b6f3af443ba967605deb006364a7cc94_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:96
- - C:\Users\Admin\AppData\Local\Apps\2.0\3091K08Z.DZ0\63HBKRYC.ZXC\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\3091K08Z.DZ0\63HBKRYC.ZXC\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:6104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\3091K08Z.DZ0\63HBKRYC.ZXC\manifests\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d.cdf-ms
Size 14KB
SHA256 bf1ab945ff4b2739c143dedc48a27421c6bfe5b97faf466e63a730eec126f705
MD5 14826fdef84f658e28523a8fddacc7c7
SHA1 43ad5c2ea455df6ee1c404d69aedcd939d3ed8aa
SHA512 4d34487a5e2ebf81f74d240ff9c623c12329cacb0022346b8b572b52d8a6208c46a53e65f09e8ca601048fa07f6039c20e6b2bcf31e71ba23356750b30bfa138
SSDEEP 192:vWEwHnwGN4CxV2SCQoYd8Lu29cWPYAyU7AbMLGE+2zk/K8LF/B7HyFXr4:vcQGN4KVvCQoS8bVnAbgXr4
TLSH
T1B462B420BB44F033E2925A329CB7E6C17B657EBA2DA1154B7080377C5CB169ACF35399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\3091K08Z.DZ0\63HBKRYC.ZXC\manifests\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188.cdf-ms
Size 3KB
SHA256 79a9c3558e40635537f1081a01a9b508615669b2d40d7a0f226742297ea5cd02
MD5 095f841ce9ac793fc2ee6fc6a29e9c4b
SHA1 30a06643872af251f89f7dc8ac23cac0ce136295
SHA512 bb1208597bd9bab9fa2c1bf7de79e7536776310f1bd7e6a4449204dd6206f02b193719d026303e2ee39ad5ab3ceb84220043009e07fc9373e3320d7c7675bff1
TLSH
T145612C01B304DA57D96A0633ACE2D6EE27783E83DE81820B70C47F6F79361F662112A1
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\3091K08Z.DZ0\63HBKRYC.ZXC\manifests\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8.cdf-ms
Size 5KB
SHA256 07ef8d01eecbc6e32f0059a2318123c6a0261959684d14622c7b85c2327d16e6
MD5 0cc23cfd6772eacbe702799c7315f541
SHA1 4846e8d77f397a4fd1c514f0266adacbe91c8bab
SHA512 55478e17d253de4b8a7511f247cfb88db57ea037a31543a34eb00873a7bd2f9f8e2c8eb84e88558c75e711fe23f3b2d80d65c16be4983303164b17601910c20d
SSDEEP 96:O4qSl4+heV+Ww7O0I6Go6A6VcGHTSZrUMwnv+s:/l4nJB6P6A6VcGHv/
TLSH
T1E7B1FF117354D953D9B90633ACAAD3ED2B687D83DE42030B70C8BF6F79326EA5321294
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\3091K08Z.DZ0\63HBKRYC.ZXC\manifests\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495.cdf-ms
Size 7KB
SHA256 59affbdb08f40b1425c9d0cc2935be5817c39ad81d1cd46e6df3903ff5021ef2
MD5 6b7358254e8984f38a65b1acb76fd5b8
SHA1 24b9c836915045afb867859b0539b80bfee2174e
SHA512 ece33a5d603d7a0567d1b6402411b9616d2033997eb341afe2509672a168f4967a082553b4762f5c13b96d886fb4074bdd5be97e744c13c3cff266fa08a4d708
SSDEEP 96:POOOXxnCTUL43ceV+WwwOO86ycFWeSIRWPH4vxmjDqWodn1JKQ+IFVxThLgTD:W5xnAV3TJxycFHlRWf+mXvEcA8D
TLSH
T1DFF18402B294ED22E5A80A339C97D3ED66357D82DE43470B70C4BF2FBA323D65222195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\3091K08Z.DZ0\63HBKRYC.ZXC\manifests\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c.cdf-ms
Size 2KB
SHA256 34a3b150e7afb1a0bf9dbe5793755841176c7080abbd754460fb33f6f39c54cd
MD5 d0135149be1e4b8dabe968fa8f47309b
SHA1 bbdb7ded72ecf9003af6a222af86257a3247658e
SHA512 b3af433e7200237e4747e504c1711a516a22938171f07e32b5cc444b8ed98d3199027c95757b45f4bfb7626ddc8158ed76760ba85197b91f331ec92d275938dc
TLSH
T12F51AB057684EA67D67A0233EC96D2E932367E82EF03030BB1C0BB7F7A712D15612092
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\3091K08Z.DZ0\63HBKRYC.ZXC\manifests\scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a.cdf-ms
Size 4KB
SHA256 215224b8e237b96ddd7e83300ec8f6755fa4897d7bba56d6a55997a4cc38c86b
MD5 6bfe4c486a947f6df1d5b7152d2f3696
SHA1 9f1f87e30669cbde11f3ddb7e94b69982a71ac49
SHA512 36075a68ade7dc34de78eb05b27168791da4f0ae8a142c6cf6c9e53f22717e7f8a76972863e1d5bcc0fd39e2d86d90a4852f4ffe86701ae5a8c323054c2de43b
SSDEEP 48:mLP/mrIPAqzIv+0grRu9o0m5RD7EqU7gFUTUEekspf4sQgbmZFms4Ch+UQRcY:mDOUvGIEW0m5R/vUm9ks1QPfmvVUQRN
TLSH
T13E911E41B780E823D61447329CE3D2D032367DA64FD7971770987B2FAD363C5A622666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\3091K08Z.DZ0\63HBKRYC.ZXC\manifests\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3.cdf-ms
Size 4KB
SHA256 4758a3da3f04507f028a3cfc613178c62e49e9e4412232f8c9d0b19362fe6752
MD5 a47a96207f4ee346f962236e8175fab6
SHA1 76c379f403f0d1d31c54efb59842c76462cbb08a
SHA512 797e226cba53e6860dae2ddc9a06105d86a7fa756becbaa75ae9a5bacd7065574328e1ea9656fd84bd296ccb40c68f39a41c7cf7bef92be122a129f40e27787f
SSDEEP 48:AzQgc3xxy0UVYg4e6S+9ow87gXwbW7wvndT4ezF42Bq+fTQb3p7wiBeC:EQxDBUqeV+Ww8OO4wSeO2BqWTap7ZEC
TLSH
T12FA1890172A0F96BE66946339D92C2CD3A727D82DF43030FB1C4BB6F76726C65312196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\3091K08Z.DZ0\63HBKRYC.ZXC\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\app.config
Size 800B
SHA256 9c0ba5ee193a7777c9a0edd6451a0d587728faea48cd5d0e2c05c320e7656626
MD5 a6cd769c3f542436f202576aff03a61a
SHA1 b31a87f77012c2c079a0931ad39a23e4564be036
SHA512 bac051034248f41ab69a7f114d69697b55ba5cce480e98813a83f8a88959afda1609568d19bd3c6efbfc445eae61c0c3202534c620b8a6af6de74973db6a3a7e
TLSH
T1D101D61870C4BE6A16A31E33E6234540ACB09DA30216A4AC34EE3137DB716D513F33D6
MD5 SHA1 SHA512 TLSH

Submit Download

nth3gg1e.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\3091K08Z.DZ0\63HBKRYC.ZXC\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\nth3gg1e.newcfg
Size 657B
SHA256 8e053c139605bd7a05806ccb258d2c67f3a60d76ac6a310a3064632651b59679
MD5 30e7b5d4d92cc6eebf889d153c6aed29
SHA1 a44067736e6b925ef0d7e8cfe19994dad1b07564
SHA512 5eacf58e1f51eeca033c849bd479e20d216f0278d56665c72522f6caf66886382fccf4c385ce1fe7a79b9ebbee2bf33d673dfc96c103559d88bcb14ead204ffd
TLSH
T159014C6570C0AE9702732E33D5218741EE725A9B016120A874AF327B5F305CF07E32DE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\3091K08Z.DZ0\63HBKRYC.ZXC\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\user.config
Size 520B
SHA256 53420a21b9e026a9839e79dd3f012a68071aec1b9eb43fc27bf7eeed74b629ec
MD5 3483dcf494babc0b08cb328e5fa324a9
SHA1 07be0907d7ceaa153c38eec90d0a9410deed4ccf
SHA512 cf9f3d3d222f68d645658a156ef70e86b15b1b1ce28f4ced210fa24a3d4fec59d67a34b73554c7574491d7124bb4a43dec2fe8cc47a49df4dfdba25d08632edf
TLSH
T1BBF0E9A131C06D4703735E23C5114741EE725B9B0555249874AF227A9F315CE07A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

W510HJ9K.E9A.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\PRRN4BLM.O9X\W510HJ9K.E9A.application
Size 133KB
SHA256 e5de35169db22742e436e23be00f77789125c1e26144b4dd89ab0a49bf4a14d4
MD5 814ebde777161fbd38d556de9da12708
SHA1 d3617288823ebd901d0f90f09d2064871e685a4e
SHA512 bf1c420ddc36800616bc4fe03a4102e069824d724c237b191dfca77eeef0c8c2edbed82ffa19fc3657db7161fc085b2b1255d1a8939d7d69bc9b6e8227d78271
SSDEEP 3072:T/a9YuuBn1nfdvg2XOcuNKEBy25ZKEc2KEc4X1:ra9YuuBn1nRWUQG74
TLSH
T16FD3F73ACE30F5C4477DB021D0692D673DC11B939B730BACD90A196B0E69796EF1A68C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q867XD6E.XCB\HMOTJ9V4.KEZ\ScreenConnect.Client.dll
Size 412KB
SHA256 54aa1a930ee8577cf39e697e4b9a2cfd0aafe3a0766ebc5f265d1d5a0b7b8c63
MD5 513c63de95f2c2eca72b3af1ed87ffb3
SHA1 5fd40fb2cb18d62abeac2db4effdccd69acb42ed
SHA512 1c84959d914e4039669cc0aef8fd5abf1df44d650a0ed3cb2734f00524d7836e04474187906f68d9f19c250a702f2caa17323f75542090112dc6d692772559e5
SSDEEP 6144:zS59LDc+c31vpY2Y5sD8ETEavHy+vd7JPYIYyqQni65/PTe:2pcs2xDHTEavSW7OQniOe
TLSH
T10094CF8163E85D6EE9AF1F73F0A1A1344E72BC056182F2EE0D0475F51A7B7828B546E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q867XD6E.XCB\HMOTJ9V4.KEZ\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 6f4eae4b257cf30340c226bb3ee5d8656c6de79b820714e6727f62eee2044292
MD5 7400597be5c012b58f1c50ecdebf2a1a
SHA1 0c835ed0c70c99900fdabc79321e41c8694b4dca
SHA512 5a7aaf04ab807d602107c068bdc555d1ca0bd15d80ba96f2786cd8f960eb1f718cfcdb24fee1589e8072ab5b5378c28db90863d440d9330e98517d24d3a1acb3
TLSH
T18C11590191C4FA362F3341D1BEE7F46067AE5B23198E194BB0696C9F8B29AD643470B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q867XD6E.XCB\HMOTJ9V4.KEZ\ScreenConnect.ClientService.dll
Size 91KB
SHA256 f5a82014a8a000ba58fd40ec2d60724e11713fe94dd779b018d9f8e533db0dbb
MD5 c499af696f598c4726ff498b446116b9
SHA1 ab019c65abacee29d2737c71d6b44278d88df875
SHA512 771fba09c8b4415bce305e261d06cf7d069caae803da6eefc71dd2125a2fb2036af7f2cab477d87d36ab301ff8d9dbbeaad8ba63ad08f355337a51dc3a380638
SSDEEP 1536:tz0NAdGN6i9C4+Cm49qAOGWZa+QOV+eLj0GUazxDa91g0O97r:tz2pz9EyJ0QOVFjtUazxDa91gr9H
TLSH
T11F935D0293BCA92AC9EF1E34B461F1A006B1B903D4E6EBD86D9820DA2E553D15F543DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q867XD6E.XCB\HMOTJ9V4.KEZ\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 6f4e37343704120b5977eac90f904fa3aa74f111761aa604d5745beca115f727
MD5 57ae8924de501aea2d37892b8d4de231
SHA1 bd6957bbe37e112b9d18e63e6eb2224ca2aecbb8
SHA512 fdee6c86ad2f53b82c8de9e181193a14e6486682f5c055724a6cc31e7832280f9024ff7b95f1eb99aeef02932a6fe212104edda90fb0c36de88bc05bcf4dd8a4
TLSH
T1E431F61591C4FA351F3302C1BDE7E4605B9E5722158E190BB059699FCF29A97434B073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q867XD6E.XCB\HMOTJ9V4.KEZ\ScreenConnect.ClientService.exe
Size 93KB
SHA256 bbbe7e148f6788a573d24503c237d6d558ba3a751089197b4fa8de20c0da9d51
MD5 08cd4d76263747ad29397e50dc19e271
SHA1 cf2951da09b83f98efa2317e7a1976bd6d903f7d
SHA512 a774bb57821c07c1e39ec46aa453e45a05aebdd7b6ca2bbe77acc280f2f90ca7a07d8fb32195105bac74d0bf28d874e7910cf2b3a3fab3cdc7f74bfce55ac9da
SSDEEP 1536:Ug1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgcU0HMW7i:thbNDxZGXfdHrX7rAc6myJkgcU0HnW
TLSH
T1EF935B13B5C28872D573093158E0DAB09A3FF9615E21DEAB3798022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q867XD6E.XCB\HMOTJ9V4.KEZ\ScreenConnect.Core.dll
Size 577KB
SHA256 34f71df56e930be845cfe724a7f93e74d771f6d1a34041a678a0c3d8d27c9e65
MD5 46d043b411b0aefc0c229eeea96e3579
SHA1 f9ba0527b7a78b04bc11cc48c58ae72dffcb0673
SHA512 6b4d9ee36ab4ee78a7554cd8a88084bc8f9fe8a698ffb481c91272004b5822338dc8de09e484ff6035e336a12c81bcbba7703b593fb48112749fed7e3f261004
SSDEEP 6144:jJv2rM+MrJSR1wrpiTw8iXlcY2BbVEBc8fXySJPluAPb2iS/ChwDTax4kxPhUTx8:J2QTWo4T3ccY2BbV8ZJPlpPb2iLMU
TLSH
T1C4C48D1A73A48377C9DF0B7AE07055660F71E80424FBD76B7698F4A62CA33848E446E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q867XD6E.XCB\HMOTJ9V4.KEZ\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 655601939c46f0ec9cf99a4b37bd4622ac768a6eb4f0f558df4ecdec14ca0644
MD5 05ca8de63ce3a248e6cbfee8393ed0e1
SHA1 f789dac448e2e1cc4bda20bfffd99df6f0b4d045
SHA512 e8fe6d077535a5bda969f35bed7c1984e0f550eebf6ca5d9b01b8f0b0af09f14e32fa4e9977aee8d44c90dd0f175e5217f5721c2f57a7f85e7222d5326676f7f
TLSH
T15B21480181C8FA261F3302D2BDE7E42197AE5733188D194A7069689F8B19AD24747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q867XD6E.XCB\HMOTJ9V4.KEZ\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 70ce0a15fc51546d251c31de1997eb8fba9f0fadc79c14ff746837cb5a2aedcb
MD5 f66a771f7a6b092d6dacc5c742533e0a
SHA1 c4310e45e724f2c863de5156fcc78fad6768d6bc
SHA512 7ff21c7994d99bce8f7062a5e6f489220c69ecb2af55707b74fea184332cc43bbef8158f89d7b8d1776d4b883d9d188c950cb31ae8dfc3cb9113447becbf2e46
SSDEEP 24576:LBjf5QN9Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPS:DQN9JkGYYpT0+TFiH7efPP
TLSH
T14B85BD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q867XD6E.XCB\HMOTJ9V4.KEZ\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 6a0833e60c9e01dbe30a2036f7617953a2ed0f732f0ea0176c3f31463df6ab08
MD5 9e3b8f46a912c7d3efcea309dff71112
SHA1 ae0eb977f9bfbf00e5c46206c145fac1507200b8
SHA512 5898714462c0691bb41e17c165cc4f6e07d01e06cc63b82893490328bca7ec04ea7c6106b211db4bcd8076691365efaaffe020baf02f3f99bbeb5d00fd7b5376
TLSH
T10241F11281C8FA251F3302C2BEEBE431979E5723198E190B7099AD8BCF29AD74747037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q867XD6E.XCB\HMOTJ9V4.KEZ\ScreenConnect.WindowsBackstageShell.exe
Size 71KB
SHA256 05b55a089251605867293f971f066e7424c618d104709b01d496bfcd784e3b05
MD5 1d683880e77b8d4ebf4b68d7a524f2da
SHA1 53bb6e056eb9a136871929182949b44acd9e2766
SHA512 3d2a5b3c73f83a38db51987a1a1ae805fc9bae24dc4eaf066d9ce8045da87399f0b989c977b4d62195cf34d39880a6e47565b95c67c4771a0b56fd0f21556568
SSDEEP 768:QzlYsf/wCdOBti13kDeuRsUQHjSzmdvmDSmBsuMQX5E+TCMXESslRq75KYiDLk5w:QRYKtd739PDldvmDqfQX5E+TC7bu5K7f
TLSH
T10F637D5023ECC525E9FF2E34B0E1F6600AB3B963C8E1D7D52DA821DA1E127D14F64396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q867XD6E.XCB\HMOTJ9V4.KEZ\ScreenConnect.WindowsClient.exe
Size 676KB
SHA256 754e3bd3a763fd5d396a1f06149e6819aa7e3dd0d9a4f6dc2d7607fcfb0f258f
MD5 6b6846e44007df584c4fb773ba03f424
SHA1 76194a0a5bca0f6c369ba0007f5dcfbf44b2c261
SHA512 41677847adc26f0067d18a9e9f388bf8e5daa91ea175ff7de469463a0c135e3faf8b17e4aa5478ab58c427c2ae5e21fa054d87bb2e5ad5567f18a84e9855660a
SSDEEP 12288:bGafI0dcqD/bp96K0ZSDVkmwY7zvrPfaGOwg24oLJ:9g09eMRPvtChoLJ
TLSH
T14EE46D3137AC9A7BD5AF0B39F033391867B1E4057289E74FD948A4EA1D8B7848D0539B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q867XD6E.XCB\HMOTJ9V4.KEZ\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q867XD6E.XCB\HMOTJ9V4.KEZ\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 ef613a98b6ad15c74d85b533ea914337fb549c8f9b882c78f31616d27a664746
MD5 9ebf4d420218c403bd6eb773227b670a
SHA1 6e6b3f8dd8223cbbccb79b90a63649b06a378eb0
SHA512 dee07c4919b990b845b6ebd6cdb8f70363d0c733180ed53c954ca52b62518e0a43c938d5c4a20b05603f70224d48f964fbe1ea385f78b528be8909ddfa19ea1a
TLSH
T13751C61651C4FA351F3302C1BEEBE4709B9E5722158E190B7099A99FCF2DA97474B037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q867XD6E.XCB\HMOTJ9V4.KEZ\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 951218d6ff46cd53e73e97e4a4801130a1a37c8b8d2efcd7d08892132f0c3d90
MD5 3ba1b81529915bb42df0c62331522a60
SHA1 a863ffd69c1ce79df47f4fad62cc9b111fd531e9
SHA512 3c0fd033cb367038285c4a90be9a30841d40df54cf0cad138af0601e1817d7f326489623b9cc59bd37c12eb725934b573d04dc54f8371023c31c21d3647f9610
SSDEEP 96:xWLwOhoyTpte2wvy8kO/kWkDkXn+Pk8qkQhMyk5w4kOpQkOphykYAkOpD:oR/eKOMHIX+86QhM75w9UFUh7YVUD
TLSH
T1DCF1BC9684C07D21573391C0FEE3D914BD157F6302AE148EBC8D19AF9FA25899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q867XD6E.XCB\HMOTJ9V4.KEZ\ScreenConnect.WindowsFileManager.exe
Size 91KB
SHA256 9ea69d3699057fa5999eaedc7c9d4f9169be3481ba64c35afae6594a6fa7b960
MD5 a8e00048db6fcc17404a519c3ce77ea6
SHA1 c9850cc2944fc5f0343ba637ec875a4c65f5ae1e
SHA512 344f4363beacf7fed7f127b5c6b31ef884262eaec2eb5a7b727f6d8b4130815707f7f20d11521eb56913e5d5cd1f7e77fe27bd77efc85ccfb974a3f9dd5148d6
SSDEEP 1536:HUMOISlP4wyHI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVdi167M:8IsAukLCK6A
TLSH
T1AA93D652356A6231DEC5C033A492E9B19C337F6207FDC5BD28A1BA3639E03943E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/96-16-0x00007FFD1E61F000-0x00007FFD1E620000-memory.dmp

Download

memory/96-17-0x0000021AF1BA0000-0x0000021AF1D28000-memory.dmp

Download

memory/96-36-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/96-39-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/96-47-0x0000021AF6280000-0x0000021AF6314000-memory.dmp

Download

memory/96-15-0x0000021AD7450000-0x0000021AD7458000-memory.dmp

Download

memory/96-53-0x0000021AF6050000-0x0000021AF606A000-memory.dmp

Download

memory/96-24-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/96-59-0x0000021AF6250000-0x0000021AF62BC000-memory.dmp

Download

memory/96-25-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/96-62-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/96-23-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/96-66-0x0000021AF6940000-0x0000021AF6AF0000-memory.dmp

Download

memory/96-22-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/96-21-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/96-20-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/96-72-0x0000021AF6740000-0x0000021AF67EE000-memory.dmp

Download

memory/96-18-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/96-19-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/96-35-0x0000021AF60F0000-0x0000021AF6140000-memory.dmp

Download

memory/5044-8-0x0000000074BD0000-0x000000007538C000-memory.dmp

Download

memory/5044-7-0x0000000074BD0000-0x000000007538C000-memory.dmp

Download

memory/5044-14-0x0000000074BD0000-0x000000007538C000-memory.dmp

Download

memory/5044-13-0x0000000074BD0000-0x000000007538C000-memory.dmp

Download

memory/5044-12-0x0000000005700000-0x00000000058B0000-memory.dmp

Download

memory/5044-11-0x0000000074BD0000-0x000000007538C000-memory.dmp

Download

memory/5044-10-0x0000000074BE2000-0x0000000074BE3000-memory.dmp

Download

memory/5044-9-0x0000000005510000-0x00000000055A2000-memory.dmp

Download

memory/5044-26-0x0000000074BD0000-0x000000007538C000-memory.dmp

Download

memory/5044-6-0x00000000059D0000-0x0000000005F8A000-memory.dmp

Download

memory/5044-0-0x0000000074BE2000-0x0000000074BE3000-memory.dmp

Download

memory/5044-5-0x0000000074BD0000-0x000000007538C000-memory.dmp

Download

memory/5044-4-0x00000000053E0000-0x0000000005408000-memory.dmp

Download

memory/5044-1-0x0000000001360000-0x0000000001368000-memory.dmp

Download

memory/5044-3-0x0000000005330000-0x00000000053C4000-memory.dmp

Download

memory/5044-2-0x00000000052B0000-0x00000000052BC000-memory.dmp

Download

memory/6104-292-0x0000000000540000-0x00000000005EE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads