516e84253cfb78586bae39c0094233efb391d5ce58bc5991a64472b6d9e87a6e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 06:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_e2a77170ec560d435b5513518438d422_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 2.5MB
Sample260816-g2dkca1emd
SHA256 516e84253cfb78586bae39c0094233efb391d5ce58bc5991a64472b6d9e87a6e
MD5 e2a77170ec560d435b5513518438d422
SHA1 fc357da5bc246d44332a933b1cd087da67ec5647
SHA512 b69848651d8a82df9fc3ad6ea71812367b9e9305af46fa1f9017d911441798b23615cfe8e95e168ef5301c5fefa4bab7ccbfded5fc47297e1aec00b0c4cd011c
SSDEEP 24576:9kId9BbVER68MYBjf5QN9Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT0S:DC3QN9JkGYYpT0+TFiH7efP8Hu
TLSH
T162C5BD01F3D695B6C4AF0538D47A925A6A70BC0403A6CBFB67C4B9762D337C08E357A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 7 IoCs

flow	pid	Process
14	3832	dfsvc.exe
14	3832	dfsvc.exe
14	3832	dfsvc.exe
14	3832	dfsvc.exe
14	3832	dfsvc.exe
14	3832	dfsvc.exe
14	3832	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
3380	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\JT7DNO6E.CGW\G5B2XND4.76J\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_e2a77170ec560d435b5513518438d422_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\lock!110000007179580ef80e00002c0f000000000000000000000af9 = 30303030306566382c30316464326434366661626437623534	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_4b2eaa1de5b9e80d\LastRunVersion = 68747470733a2f2f73686172652e7265647361696c746563686e6f6c6f676965732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d8	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8\SizeOfStronglyNamedComponent = 7cea1a0000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a\lock!040000005279580ef80e00002c0f0000000000000000000 = 30303030306566382c30316464326434366661626437623534	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3\lock!0e0000007e7c580e340d0000880e0000000000000000000 = 30303030306433342c30316464326434373030343436336130	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 54007200750065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8\implication!scre..tion_0000000000000000_001a.0004_61 = 68747470733a2f2f73686172652e7265647361696c746563686e6f6c6f676965732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "KTE6TDEYNQ3BZ2TVNBVBKVM4"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\implication!scre..tion_0000000000000000_001a.0004_61 = 68747470733a2f2f73686172652e7265647361696c746563686e6f6c6f676965732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\Files\ScreenConnect.WindowsFileManager.exe.conf = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188\SizeOfStronglyNamedComponent = 7318090000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\lock!0a0000007e7c580e340d0000880e0000000000000000000 = 30303030306433342c30316464326434373030343436336130	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 32003000320036002f00300038002f00310036002000300036003a00310038003a00300035000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\Files\ScreenConnect.WindowsClient.exe.config_f7 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\SubstructureCreated = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 30000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0004_61fa8f5132ba7575\scre...exe_0000000000000000_001a.0004_none_5d4c1629b = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\SizeOfStronglyNamedComponent = f3ba0a0000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_0000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\implication!scre..tion_0000000000000000_001a.0004_61fa8f5 = 68747470733a2f2f73686172652e7265647361696c746563686e6f6c6f676965732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\Files\ScreenConnect.ClientService.exe_e781b1ee3 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_4b2eaa1de5b9e80d	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\SizeOfStronglyNamedComponent = 1f82060000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\SizeOfStronglyNamedComponent = f85c040000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\DigestValue = 76194a0a5bca0f6c369ba0007f5dcfbf44b2c261	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818d = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\scre...exe_0000000000000000_001a.0004_none_5d4c1629b = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495	ScreenConnect.WindowsClient.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\JT7DNO6E.CGW\G5B2XND4.76J\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\KTE6TDEY.NQ3\BZ2TVNBV.BKV\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1804	2026-08-16_e2a77170ec560d435b5513518438d422_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	3832	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 3832	1804	2026-08-16_e2a77170ec560d435b5513518438d422_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	85
PID 3832 wrote to memory of 3380	3832	dfsvc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-16_e2a77170ec560d435b5513518438d422_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_e2a77170ec560d435b5513518438d422_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Users\Admin\AppData\Local\Apps\2.0\KTE6TDEY.NQ3\BZ2TVNBV.BKV\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\KTE6TDEY.NQ3\BZ2TVNBV.BKV\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:3380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\KTE6TDEY.NQ3\BZ2TVNBV.BKV\manifests\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d.cdf-ms
Size 14KB
SHA256 e5e15d7170936ecdba9627b4d301744a12c349f2861c62f3f9baa0be4c6f4446
MD5 a0e7a77d74bcc13d73be10cd757588d3
SHA1 e2f7bb0c6145452f0b8f193126f9b00adbb195fb
SHA512 1b2d75aea3e639e79cebb5e2f4155255fd6d884c6ae0051f08b86cd654a959a3efeac84c09a07fa1f2f2669ac939bd949b838a23e5bf6eaa632ad9bb63055b6b
SSDEEP 192:SWEwHnwboZJn8xV2SCq84CdPXXJRsSA3B+6TpClLUZG4siaSQERPk4:ScQsZJwVvCqdSA3gZiRPk4
TLSH
T14F62E621FB14F433E2625B32DCBAE2C16729BEA61DA611877080373E887119ACF357D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\KTE6TDEY.NQ3\BZ2TVNBV.BKV\manifests\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188.cdf-ms
Size 3KB
SHA256 f0241e55e813fb363f462627600df5bb867c760a87c96637230736f11d440f68
MD5 b7245f243229004ca25c23f314dccdd0
SHA1 3287956b59eda319c6c55726ff5200e710934be1
SHA512 c43762eba1187dee42e40049d1ccc3185f24d758960577ef794c0d5a055fea6c34cfcff76f862223c545a9270c5eb2ed82745b6bbf8bb84fa798b6052b3dfc83
TLSH
T1C561AC027644DE17D96B0633ACD6E2ED37757D83EE42520B70C0BB2F7A315FA56121A1
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\KTE6TDEY.NQ3\BZ2TVNBV.BKV\manifests\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8.cdf-ms
Size 5KB
SHA256 7c1a3d21390441479d03eaad2610c6536d7b800a8ec865fed84decf868217e26
MD5 dfa59d07e8e7a5eadf26eb89b901b97b
SHA1 d24619783a0f6e56832ed28dec206555969f19eb
SHA512 9c590035c7f05586ca50da0a210a51cd04ceb602abc6bd5900458bc19516bbe72d3610e1a0ce44e6113291bb4e1ca59481f291724cf3e2b828b4e072f49ca8d7
SSDEEP 96:Zv4qSl4eheV+Ww7O0I6Go6A6VcGHTSkrc4awnv+s:Zol4HJB6P6A6VcGHNV/
TLSH
T1D4B1DE11B304D913D9B90633AC6AE3ED2B687D43DE42020B70C4BF1FB9326F65321195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\KTE6TDEY.NQ3\BZ2TVNBV.BKV\manifests\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495.cdf-ms
Size 7KB
SHA256 3b062b313e03bf8764c5b9c98660889a123ba4b27bc09a7bd5111a6a7ef99fcd
MD5 424c8a3998a9716c3c03aa4c8b6aeff5
SHA1 508cf32c0dbcbd1578e94ca918539356d49655b5
SHA512 9cacfc8895d2bf61da939ecb378b5664887118ee2e47e0f8b6b5b2e58ffe27170f7b41eb399880fc00dba7f5f6f03094e9459386f23e196136c22d8af948a45c
SSDEEP 96:XOOOXxnCTUL4aFeV+WwwOO86D2/g92oUSxjesgPHev1+fsFVxThLgTD:e5xnAVaaJxDD2otxjqHO+f+8D
TLSH
T1CFF1CB02B354D916D5B90633AC9AE3ED3B693D92DE42560B70C0BF2FB6325B61326194
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\KTE6TDEY.NQ3\BZ2TVNBV.BKV\manifests\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c.cdf-ms
Size 2KB
SHA256 f0f54f5d970d2253a1df45be765df05541beca634fec10777c0732893b5c4da4
MD5 256d1e51ba09ad16ee90bada2c56e3dc
SHA1 6425d3918abba101a3cff385ac95f5832cd2c451
SHA512 a91f39ed65f242ac4e8ba518941d31d359b2be27ff0c52c4247daaa4585c6788190326c8d90a01993a4bffcd32fb958a1fe69d9f727b4b540a419d57868a15a5
TLSH
T10E519B057684EA67D67B0233EC96E2D933757D82EF030317B190BB2F7A716D15612092
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\KTE6TDEY.NQ3\BZ2TVNBV.BKV\manifests\scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a.cdf-ms
Size 4KB
SHA256 5f63c41ed446d2692408d2d1811921fd037cfbb30a664798003c427b1d55d2f0
MD5 cb6fcfa4d718a7395639aa9ebf203cf7
SHA1 6caa15f4360f2237eb0e416067ab5e51cdfe5810
SHA512 29eb63b8ddb245b0cc20e21c591fb9c01a38af6dbca58ba119d8d7d9116fea626e5a9c686cb78e3c0d2fc54e3a9e0426362cca6270793851ee62345e234ee22f
SSDEEP 48:nP/mrIPAqzIvc5grRu9o0m5RD7EqU7gFUTUEekspf4sQgbmZFms4Ch+UQRcY:POUvG3EW0m5R/vUm9ks1QPfmvVUQRN
TLSH
T112913E41B780E823D61447329CE3E2D032367DE64FD7971770987B2FAD363C59622666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\KTE6TDEY.NQ3\BZ2TVNBV.BKV\manifests\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3.cdf-ms
Size 4KB
SHA256 4b60b9234e0a0a6b266a848a454244d00c7ae866f134cbef969e6f835922c08c
MD5 86b1092dfd0515a0162454612df08ece
SHA1 7ffafe02e28a994e4f8af33cc4c8ff3b7cf1b381
SHA512 9835185338fd83224afac197b02826c13d1ca85f4541f44a3ebfaac07b4dc50129274f2bb794d004ea172fec6d1df7bc46b3add4b3499c5cc7b1b687c65f007a
SSDEEP 96:PXQxDBU5eV+Ww8OO4wewWVG2wjZvGBT63Am7ZEC:P8BNJPewYxEJ
TLSH
T13FA17B017280DE27D6AA16339C82E3DD3676BD82EE03134B71C4BF2F75716E74652091
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\KTE6TDEY.NQ3\BZ2TVNBV.BKV\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\ScreenConnect.ClientService.exe
Size 93KB
SHA256 bbbe7e148f6788a573d24503c237d6d558ba3a751089197b4fa8de20c0da9d51
MD5 08cd4d76263747ad29397e50dc19e271
SHA1 cf2951da09b83f98efa2317e7a1976bd6d903f7d
SHA512 a774bb57821c07c1e39ec46aa453e45a05aebdd7b6ca2bbe77acc280f2f90ca7a07d8fb32195105bac74d0bf28d874e7910cf2b3a3fab3cdc7f74bfce55ac9da
SSDEEP 1536:Ug1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgcU0HMW7i:thbNDxZGXfdHrX7rAc6myJkgcU0HnW
TLSH
T1EF935B13B5C28872D573093158E0DAB09A3FF9615E21DEAB3798022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\KTE6TDEY.NQ3\BZ2TVNBV.BKV\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\ScreenConnect.WindowsClient.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\KTE6TDEY.NQ3\BZ2TVNBV.BKV\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\app.config
Size 800B
SHA256 9c0ba5ee193a7777c9a0edd6451a0d587728faea48cd5d0e2c05c320e7656626
MD5 a6cd769c3f542436f202576aff03a61a
SHA1 b31a87f77012c2c079a0931ad39a23e4564be036
SHA512 bac051034248f41ab69a7f114d69697b55ba5cce480e98813a83f8a88959afda1609568d19bd3c6efbfc445eae61c0c3202534c620b8a6af6de74973db6a3a7e
TLSH
T1D101D61870C4BE6A16A31E33E6234540ACB09DA30216A4AC34EE3137DB716D513F33D6
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\KTE6TDEY.NQ3\BZ2TVNBV.BKV\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\user.config
Size 520B
SHA256 53420a21b9e026a9839e79dd3f012a68071aec1b9eb43fc27bf7eeed74b629ec
MD5 3483dcf494babc0b08cb328e5fa324a9
SHA1 07be0907d7ceaa153c38eec90d0a9410deed4ccf
SHA512 cf9f3d3d222f68d645658a156ef70e86b15b1b1ce28f4ced210fa24a3d4fec59d67a34b73554c7574491d7124bb4a43dec2fe8cc47a49df4dfdba25d08632edf
TLSH
T1BBF0E9A131C06D4703735E23C5114741EE725B9B0555249874AF227A9F315CE07A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\KTE6TDEY.NQ3\BZ2TVNBV.BKV\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\user.config
Size 657B
SHA256 8e053c139605bd7a05806ccb258d2c67f3a60d76ac6a310a3064632651b59679
MD5 30e7b5d4d92cc6eebf889d153c6aed29
SHA1 a44067736e6b925ef0d7e8cfe19994dad1b07564
SHA512 5eacf58e1f51eeca033c849bd479e20d216f0278d56665c72522f6caf66886382fccf4c385ce1fe7a79b9ebbee2bf33d673dfc96c103559d88bcb14ead204ffd
TLSH
T159014C6570C0AE9702732E33D5218741EE725A9B016120A874AF327B5F305CF07E32DE
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JT7DNO6E.CGW\G5B2XND4.76J\ScreenConnect.Client.dll
Size 412KB
SHA256 54aa1a930ee8577cf39e697e4b9a2cfd0aafe3a0766ebc5f265d1d5a0b7b8c63
MD5 513c63de95f2c2eca72b3af1ed87ffb3
SHA1 5fd40fb2cb18d62abeac2db4effdccd69acb42ed
SHA512 1c84959d914e4039669cc0aef8fd5abf1df44d650a0ed3cb2734f00524d7836e04474187906f68d9f19c250a702f2caa17323f75542090112dc6d692772559e5
SSDEEP 6144:zS59LDc+c31vpY2Y5sD8ETEavHy+vd7JPYIYyqQni65/PTe:2pcs2xDHTEavSW7OQniOe
TLSH
T10094CF8163E85D6EE9AF1F73F0A1A1344E72BC056182F2EE0D0475F51A7B7828B546E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JT7DNO6E.CGW\G5B2XND4.76J\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 6f4eae4b257cf30340c226bb3ee5d8656c6de79b820714e6727f62eee2044292
MD5 7400597be5c012b58f1c50ecdebf2a1a
SHA1 0c835ed0c70c99900fdabc79321e41c8694b4dca
SHA512 5a7aaf04ab807d602107c068bdc555d1ca0bd15d80ba96f2786cd8f960eb1f718cfcdb24fee1589e8072ab5b5378c28db90863d440d9330e98517d24d3a1acb3
TLSH
T18C11590191C4FA362F3341D1BEE7F46067AE5B23198E194BB0696C9F8B29AD643470B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JT7DNO6E.CGW\G5B2XND4.76J\ScreenConnect.ClientService.dll
Size 91KB
SHA256 f5a82014a8a000ba58fd40ec2d60724e11713fe94dd779b018d9f8e533db0dbb
MD5 c499af696f598c4726ff498b446116b9
SHA1 ab019c65abacee29d2737c71d6b44278d88df875
SHA512 771fba09c8b4415bce305e261d06cf7d069caae803da6eefc71dd2125a2fb2036af7f2cab477d87d36ab301ff8d9dbbeaad8ba63ad08f355337a51dc3a380638
SSDEEP 1536:tz0NAdGN6i9C4+Cm49qAOGWZa+QOV+eLj0GUazxDa91g0O97r:tz2pz9EyJ0QOVFjtUazxDa91gr9H
TLSH
T11F935D0293BCA92AC9EF1E34B461F1A006B1B903D4E6EBD86D9820DA2E553D15F543DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JT7DNO6E.CGW\G5B2XND4.76J\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 6f4e37343704120b5977eac90f904fa3aa74f111761aa604d5745beca115f727
MD5 57ae8924de501aea2d37892b8d4de231
SHA1 bd6957bbe37e112b9d18e63e6eb2224ca2aecbb8
SHA512 fdee6c86ad2f53b82c8de9e181193a14e6486682f5c055724a6cc31e7832280f9024ff7b95f1eb99aeef02932a6fe212104edda90fb0c36de88bc05bcf4dd8a4
TLSH
T1E431F61591C4FA351F3302C1BDE7E4605B9E5722158E190BB059699FCF29A97434B073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JT7DNO6E.CGW\G5B2XND4.76J\ScreenConnect.Core.dll
Size 577KB
SHA256 34f71df56e930be845cfe724a7f93e74d771f6d1a34041a678a0c3d8d27c9e65
MD5 46d043b411b0aefc0c229eeea96e3579
SHA1 f9ba0527b7a78b04bc11cc48c58ae72dffcb0673
SHA512 6b4d9ee36ab4ee78a7554cd8a88084bc8f9fe8a698ffb481c91272004b5822338dc8de09e484ff6035e336a12c81bcbba7703b593fb48112749fed7e3f261004
SSDEEP 6144:jJv2rM+MrJSR1wrpiTw8iXlcY2BbVEBc8fXySJPluAPb2iS/ChwDTax4kxPhUTx8:J2QTWo4T3ccY2BbV8ZJPlpPb2iLMU
TLSH
T1C4C48D1A73A48377C9DF0B7AE07055660F71E80424FBD76B7698F4A62CA33848E446E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JT7DNO6E.CGW\G5B2XND4.76J\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 655601939c46f0ec9cf99a4b37bd4622ac768a6eb4f0f558df4ecdec14ca0644
MD5 05ca8de63ce3a248e6cbfee8393ed0e1
SHA1 f789dac448e2e1cc4bda20bfffd99df6f0b4d045
SHA512 e8fe6d077535a5bda969f35bed7c1984e0f550eebf6ca5d9b01b8f0b0af09f14e32fa4e9977aee8d44c90dd0f175e5217f5721c2f57a7f85e7222d5326676f7f
TLSH
T15B21480181C8FA261F3302D2BDE7E42197AE5733188D194A7069689F8B19AD24747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JT7DNO6E.CGW\G5B2XND4.76J\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 70ce0a15fc51546d251c31de1997eb8fba9f0fadc79c14ff746837cb5a2aedcb
MD5 f66a771f7a6b092d6dacc5c742533e0a
SHA1 c4310e45e724f2c863de5156fcc78fad6768d6bc
SHA512 7ff21c7994d99bce8f7062a5e6f489220c69ecb2af55707b74fea184332cc43bbef8158f89d7b8d1776d4b883d9d188c950cb31ae8dfc3cb9113447becbf2e46
SSDEEP 24576:LBjf5QN9Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPS:DQN9JkGYYpT0+TFiH7efPP
TLSH
T14B85BD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JT7DNO6E.CGW\G5B2XND4.76J\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 6a0833e60c9e01dbe30a2036f7617953a2ed0f732f0ea0176c3f31463df6ab08
MD5 9e3b8f46a912c7d3efcea309dff71112
SHA1 ae0eb977f9bfbf00e5c46206c145fac1507200b8
SHA512 5898714462c0691bb41e17c165cc4f6e07d01e06cc63b82893490328bca7ec04ea7c6106b211db4bcd8076691365efaaffe020baf02f3f99bbeb5d00fd7b5376
TLSH
T10241F11281C8FA251F3302C2BEEBE431979E5723198E190B7099AD8BCF29AD74747037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JT7DNO6E.CGW\G5B2XND4.76J\ScreenConnect.WindowsBackstageShell.exe
Size 71KB
SHA256 05b55a089251605867293f971f066e7424c618d104709b01d496bfcd784e3b05
MD5 1d683880e77b8d4ebf4b68d7a524f2da
SHA1 53bb6e056eb9a136871929182949b44acd9e2766
SHA512 3d2a5b3c73f83a38db51987a1a1ae805fc9bae24dc4eaf066d9ce8045da87399f0b989c977b4d62195cf34d39880a6e47565b95c67c4771a0b56fd0f21556568
SSDEEP 768:QzlYsf/wCdOBti13kDeuRsUQHjSzmdvmDSmBsuMQX5E+TCMXESslRq75KYiDLk5w:QRYKtd739PDldvmDqfQX5E+TC7bu5K7f
TLSH
T10F637D5023ECC525E9FF2E34B0E1F6600AB3B963C8E1D7D52DA821DA1E127D14F64396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JT7DNO6E.CGW\G5B2XND4.76J\ScreenConnect.WindowsClient.exe
Size 676KB
SHA256 754e3bd3a763fd5d396a1f06149e6819aa7e3dd0d9a4f6dc2d7607fcfb0f258f
MD5 6b6846e44007df584c4fb773ba03f424
SHA1 76194a0a5bca0f6c369ba0007f5dcfbf44b2c261
SHA512 41677847adc26f0067d18a9e9f388bf8e5daa91ea175ff7de469463a0c135e3faf8b17e4aa5478ab58c427c2ae5e21fa054d87bb2e5ad5567f18a84e9855660a
SSDEEP 12288:bGafI0dcqD/bp96K0ZSDVkmwY7zvrPfaGOwg24oLJ:9g09eMRPvtChoLJ
TLSH
T14EE46D3137AC9A7BD5AF0B39F033391867B1E4057289E74FD948A4EA1D8B7848D0539B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JT7DNO6E.CGW\G5B2XND4.76J\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JT7DNO6E.CGW\G5B2XND4.76J\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 ef613a98b6ad15c74d85b533ea914337fb549c8f9b882c78f31616d27a664746
MD5 9ebf4d420218c403bd6eb773227b670a
SHA1 6e6b3f8dd8223cbbccb79b90a63649b06a378eb0
SHA512 dee07c4919b990b845b6ebd6cdb8f70363d0c733180ed53c954ca52b62518e0a43c938d5c4a20b05603f70224d48f964fbe1ea385f78b528be8909ddfa19ea1a
TLSH
T13751C61651C4FA351F3302C1BEEBE4709B9E5722158E190B7099A99FCF2DA97474B037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JT7DNO6E.CGW\G5B2XND4.76J\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 951218d6ff46cd53e73e97e4a4801130a1a37c8b8d2efcd7d08892132f0c3d90
MD5 3ba1b81529915bb42df0c62331522a60
SHA1 a863ffd69c1ce79df47f4fad62cc9b111fd531e9
SHA512 3c0fd033cb367038285c4a90be9a30841d40df54cf0cad138af0601e1817d7f326489623b9cc59bd37c12eb725934b573d04dc54f8371023c31c21d3647f9610
SSDEEP 96:xWLwOhoyTpte2wvy8kO/kWkDkXn+Pk8qkQhMyk5w4kOpQkOphykYAkOpD:oR/eKOMHIX+86QhM75w9UFUh7YVUD
TLSH
T1DCF1BC9684C07D21573391C0FEE3D914BD157F6302AE148EBC8D19AF9FA25899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JT7DNO6E.CGW\G5B2XND4.76J\ScreenConnect.WindowsFileManager.exe
Size 91KB
SHA256 9ea69d3699057fa5999eaedc7c9d4f9169be3481ba64c35afae6594a6fa7b960
MD5 a8e00048db6fcc17404a519c3ce77ea6
SHA1 c9850cc2944fc5f0343ba637ec875a4c65f5ae1e
SHA512 344f4363beacf7fed7f127b5c6b31ef884262eaec2eb5a7b727f6d8b4130815707f7f20d11521eb56913e5d5cd1f7e77fe27bd77efc85ccfb974a3f9dd5148d6
SSDEEP 1536:HUMOISlP4wyHI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVdi167M:8IsAukLCK6A
TLSH
T1AA93D652356A6231DEC5C033A492E9B19C337F6207FDC5BD28A1BA3639E03943E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PTDE6014.H47.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\P3BWQ5P5.YNW\PTDE6014.H47.application
Size 133KB
SHA256 e5de35169db22742e436e23be00f77789125c1e26144b4dd89ab0a49bf4a14d4
MD5 814ebde777161fbd38d556de9da12708
SHA1 d3617288823ebd901d0f90f09d2064871e685a4e
SHA512 bf1c420ddc36800616bc4fe03a4102e069824d724c237b191dfca77eeef0c8c2edbed82ffa19fc3657db7161fc085b2b1255d1a8939d7d69bc9b6e8227d78271
SSDEEP 3072:T/a9YuuBn1nfdvg2XOcuNKEBy25ZKEc2KEc4X1:ra9YuuBn1nRWUQG74
TLSH
T16FD3F73ACE30F5C4477DB021D0692D673DC11B939B730BACD90A196B0E69796EF1A68C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1804-6-0x0000000005360000-0x0000000005904000-memory.dmp

Download

memory/1804-7-0x0000000004E70000-0x0000000004F02000-memory.dmp

Download

memory/1804-0-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

Download

memory/1804-1-0x0000000000B00000-0x0000000000B08000-memory.dmp

Download

memory/1804-2-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

Download

memory/1804-3-0x0000000004BC0000-0x0000000004BCC000-memory.dmp

Download

memory/1804-9-0x0000000007B60000-0x0000000007D10000-memory.dmp

Download

memory/1804-5-0x0000000004D30000-0x0000000004D58000-memory.dmp

Download

memory/1804-10-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

Download

memory/1804-8-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

Download

memory/1804-4-0x0000000004C80000-0x0000000004D14000-memory.dmp

Download

memory/1804-11-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

Download

memory/1804-12-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

Download

memory/3380-339-0x00000000003C0000-0x000000000046E000-memory.dmp

Download

memory/3380-380-0x000000001B080000-0x000000001B208000-memory.dmp

Download

memory/3832-17-0x000001B25B560000-0x000001B25B570000-memory.dmp

Download

memory/3832-13-0x000001B240CA0000-0x000001B240CA8000-memory.dmp

Download

memory/3832-14-0x000001B25B220000-0x000001B25B3A6000-memory.dmp

Download

memory/3832-15-0x000001B25B560000-0x000001B25B570000-memory.dmp

Download

memory/3832-54-0x000001B25EF20000-0x000001B25F0D0000-memory.dmp

Download

memory/3832-26-0x000001B25EA30000-0x000001B25EA80000-memory.dmp

Download

memory/3832-344-0x000001B25B560000-0x000001B25B570000-memory.dmp

Download

memory/3832-36-0x000001B25EC60000-0x000001B25ECF4000-memory.dmp

Download

memory/3832-42-0x000001B25EAA0000-0x000001B25EABA000-memory.dmp

Download

memory/3832-48-0x000001B25EC30000-0x000001B25EC9C000-memory.dmp

Download

memory/3832-378-0x000001B25B560000-0x000001B25B570000-memory.dmp

Download

memory/3832-377-0x000001B25B3B0000-0x000001B25B538000-memory.dmp

Download

memory/3832-60-0x000001B25ED20000-0x000001B25EDCE000-memory.dmp

Download

memory/3832-381-0x000001B25B3B0000-0x000001B25B538000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads