516e84253cfb78586bae39c0094233efb391d5ce58bc5991a64472b6d9e87a6e

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 06:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_e2a77170ec560d435b5513518438d422_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 2.5MB
Sample260816-g2dkca1emd
SHA256 516e84253cfb78586bae39c0094233efb391d5ce58bc5991a64472b6d9e87a6e
MD5 e2a77170ec560d435b5513518438d422
SHA1 fc357da5bc246d44332a933b1cd087da67ec5647
SHA512 b69848651d8a82df9fc3ad6ea71812367b9e9305af46fa1f9017d911441798b23615cfe8e95e168ef5301c5fefa4bab7ccbfded5fc47297e1aec00b0c4cd011c
SSDEEP 24576:9kId9BbVER68MYBjf5QN9Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT0S:DC3QN9JkGYYpT0+TFiH7efP8Hu
TLSH
T162C5BD01F3D695B6C4AF0538D47A925A6A70BC0403A6CBFB67C4B9762D337C08E357A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 7 IoCs

flow	pid	Process
8	3716	dfsvc.exe
8	3716	dfsvc.exe
8	3716	dfsvc.exe
8	3716	dfsvc.exe
8	3716	dfsvc.exe
8	3716	dfsvc.exe
8	3716	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
2388	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\1VPO1N2A.OB3\4J8EX8E2.MMB\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_e2a77170ec560d435b5513518438d422_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\HasRunBefore = 01	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\Files\ScreenConnect.WindowsBackstageShell.exe.c = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818d = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "2PA1AQ4173HMB0BO04PZVH84"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a\lock!020000000cb0590e54090000dc120000000000000000000 = 30303030303935342c30316464326434373030626336323033	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\implication!scre..tion_0000000000000000_001a.0004_61 = 68747470733a2f2f73686172652e7265647361696c746563686e6f6c6f676965732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\implication!scre..tion_0000000000000000_001a.0004_61 = 68747470733a2f2f73686172652e7265647361696c746563686e6f6c6f676965732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\lock!0800000086ae590e840e0000e40e0000000000000000000 = 30303030306538342c30316464326434366662366364336432	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 680074007400700073003a002f002f00730068006100720065002e007200650064007300610069006c0074006500630068006e006f006c006f0067006900650073002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320036002e0034002e0033002e0039003600360032002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320036002e0034002e0033002e0039003600360032002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e00330032000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8\DigestValue = c4310e45e724f2c863de5156fcc78fad6768d6bc	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_4b2eaa1de5b9e80d	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_0000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\implication!scre..tion_0000000000000000_001a.0004_61 = 68747470733a2f2f73686172652e7265647361696c746563686e6f6c6f676965732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a\implication!scre..tion_0000000000000000_001a.0004_61 = 68747470733a2f2f73686172652e7265647361696c746563686e6f6c6f676965732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\Files\ScreenConnect.WindowsClient.exe_6492277df = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3\lock!1000000086ae590e840e0000e40e0000000000000000000 = 30303030306538342c30316464326434366662366364336432	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a\lock!0400000086ae590e840e0000e40e0000000000000000000 = 30303030306538342c30316464326434366662366364336432	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\PreparedForExecution = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\SubstructureCreated = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_0000000000000000_57051d5779c6eb7e\LastRunVersion = 68747470733a2f2f73686172652e7265647361696c746563686e6f6c6f676965732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 680074007400700073003a002f002f00730068006100720065002e007200650064007300610069006c0074006500630068006e006f006c006f0067006900650073002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e003f0065003d0053007500700070006f0072007400260079003d0047007500650073007400260068003d00370032002e00330034002e003100390032002e00310031003600260070003d00340034003300260073003d00310064003000660065003500630066002d0035003400640062002d0034003600350031002d0061003100630032002d0066003800320039003400300062006500640031006500380026006b003d0042006700490041004100410043006b004100410042005300550030004500780041004100670041004100410045004100410051004300680031004c004d00690075005a004800430057006e006f004500780033007a00790070003300510025003200620079004d0052004e004b004d0079002500320066004d0070007a004500390068004c00610071002500320062006c005300680038007100370043007700390034002500320062006d00440041003800570077004900390049004b006300720044004e0025003200660072002500320066006400710055003400410067007300350039004700530036005200430061005000790050006e0039003300360072004100660043004f0054004900390043005800500030003600340079004f00760063006600390066005100610076005000650074004e0066006900660035007200330047004e007a006e00580046003500460036005800520051004300750070004a007800790057007a002500320066004d0073004f0073005a0051004a0066004a0067004e0073004200440046007600300048004d002500320062004d0047003500650059005600740061006800530059003900320056004f00320025003200620039004d0053004f007000360071006a0074007300550025003200660048007100320069004b00590038006800440039003700710055006e005000650045007000430066005300690045006b0054006c0064006b00380053006c00530078004a007400650061006e006d0044006c0035004500690073004900380079006a00750030005500660062004b0069005100490069006a007200250032006200320030002500320066003300510052006f0025003200620051005000760043005800250032006600650063005200560071003200500037005a0074006e003100610039006a0047004d0051007800320044006b004f006e0032007200740056006100570062006100680045005400750035006900300044006c006400300043005600350046002500320062003300780050004b004f0032006b0038004d00680059005a0069005a005a0052004f004500610035004200480043006100260072003d00260069003d00500069006f006e00650065007200250032003000480065006c0070000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_0000000000000 = 68747470733a2f2f73686172652e7265647361696c746563686e6f6c6f676965732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3\DigestValue = ab019c65abacee29d2737c71d6b44278d88df875	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\SizeOfStronglyNamedComponent = 1f82060000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\Files\ScreenConnect.Client.dll_fc1d7bd48553fcab = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\lock!040000000cb0590e54090000dc120000000000000000000 = 30303030303935342c30316464326434373030626336323033	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\SizeOfStronglyNamedComponent = f85c040000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\1VPO1N2A.OB3\4J8EX8E2.MMB\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\K6EN27K8.45H\59XHL589.2Q8\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3224	2026-08-16_e2a77170ec560d435b5513518438d422_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	3716	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 3716	3224	2026-08-16_e2a77170ec560d435b5513518438d422_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	90
PID 3716 wrote to memory of 2388	3716	dfsvc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-16_e2a77170ec560d435b5513518438d422_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_e2a77170ec560d435b5513518438d422_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Users\Admin\AppData\Local\Apps\2.0\K6EN27K8.45H\59XHL589.2Q8\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\K6EN27K8.45H\59XHL589.2Q8\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:2388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\K6EN27K8.45H\59XHL589.2Q8\manifests\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d.cdf-ms
Size 14KB
SHA256 d269afc70906986ddb936218395c70e8afa4de3290f77de94b16335cd764d3cb
MD5 2240a8276283f83253125dd846c315ab
SHA1 d5c3317a7c0efaa3d4889230aca30cf90a626821
SHA512 3e35d176c0dcdb2ee1e1c4d99487eb14689d48f0360590ef9ccb9c4e7035fa757773ba5e46baac9d6862dda054b2a0bff75fc4e8cc72eb0963b231d2fd1c2ae2
SSDEEP 192:jWEwHnwiTMPCxV2SCQoYd8Lu29cWPYAyU7AbMLGE+2zk/K8LF/B7HyFXq4:jcQiTsKVvCQoS8bVnAbgXq4
TLSH
T10C62B520FB44F433E2525A329CBBE6C16B657EBA2DA1114B7084337C6C7169ACF35395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\K6EN27K8.45H\59XHL589.2Q8\manifests\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188.cdf-ms
Size 3KB
SHA256 4d92c4744cf2772ead8cda809057762a21013ad38b6841bba951822a403b7816
MD5 6e6ce405de85f3d5d2528636f21c089b
SHA1 e3625ac3989b29e18e6e9dc13d58b4b4cd58055d
SHA512 4b3a82c713360e12882b7428d84c608c7aa7ae59fa5cefbf0558e6ed11562ba73b1402068e63423cb731b4fc50583e7c55f81d279274c0c901397840519fb7e4
TLSH
T1CD610D01B344DE17D96A0633ACE6D6EE27747E83DE41820B74C47F2F79361F66612291
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\K6EN27K8.45H\59XHL589.2Q8\manifests\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8.cdf-ms
Size 5KB
SHA256 d1db166ba85a295a58dd7c978d2079c2ef969a85343d915e864b224cab925a28
MD5 0e38111baf1871889ff3b5780ed7dc32
SHA1 5127d7a0fbeb25a278a81153e9f0ab79dba9bf00
SHA512 7446c70f90b79d73b32737b4a1b26334a32476766a9151ebad6e165f7d86693b7503472dac05114cdf709e8ea23ada3140ca09512204087d60335a18c54a4192
SSDEEP 96:zV4qSl4+heV+Ww7O0IKOQlVXXezoZpvi2wnv+s:zOl4nJBKNB63/
TLSH
T1EDB14411B290DD1BD5B90633ACA6D3ED2B367E92DE43030B70D8BB1F7A326D65222195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\K6EN27K8.45H\59XHL589.2Q8\manifests\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495.cdf-ms
Size 7KB
SHA256 783512367682fd7d1678f20652aad27d0b1dd1c4bd8b6e60ebd87b2214b88f9a
MD5 328aa34c9cb6a7e15be2d0be5c7de806
SHA1 2bc0ea181a53a264012d15e3965adaa0b4142990
SHA512 f13a880eaa41b4d4a9a59ec9cc925bea4d4fb221e5efb97a72df50b36aadaa233497728d2bb9146c4151720d1b62dfb28a93c333483975854dd7d3adf2720f9d
SSDEEP 96:2zOOOXxnCTUL43FeV+WwwOO86KWwXYLW5mJpVf8h1PDHGtqRZc+FVxThLgTD:2C5xnAV3aJxKsLLMD1L8D
TLSH
T1CBF177227290DD22D1A90A33DC96C3ED3725BE86EE43470B70C6BF2FB6725D65712095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\K6EN27K8.45H\59XHL589.2Q8\manifests\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c.cdf-ms
Size 2KB
SHA256 22cfda438eaa6db9fb96c3b1a0da803c173641f25400c7477158aff085db7209
MD5 74b251bc7e47439334b2b9ba828b4ca7
SHA1 de56f54c181e48f69b6fcc400345f8789527b12b
SHA512 3511cb475417a01dc648c57d0e5de7c713f8e29bf5c49faaf0d01e9636eab510572b5a662ccba390982766c08fe490e7231b1ebdbef9bb61a89c59994da5a14b
TLSH
T1F4519A047684FA67D66A0232BC92D2DD32757EC2FF424327B1C07BAF69716C65A12093
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\K6EN27K8.45H\59XHL589.2Q8\manifests\scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a.cdf-ms
Size 4KB
SHA256 f852194d8b1c7f973eb1868b71b5b52fe645cbf2a5730bdf2e84c33caa8ce6c9
MD5 6d7e8c9a6d9dbe4db253fb6de888828a
SHA1 bc212e33e4e879ac6440b9fc5ecee8a51c4c2fe4
SHA512 d4b5794e0e84f8ed48a176c3c93ebb656f9df3e1169c05e0853e8af5bb1785668d37d217a303e93b1cad2e8cbbd55f5ecf2430737f4f2a1466cc0a28f332dc7f
SSDEEP 48:mnP/mrIPAqzIvATgrRu9o0m5RD7EqU7gFUTUEekspf4sQgbmZFms4Ch+UQRcY:+OUvGREW0m5R/vUm9ks1QPfmvVUQRN
TLSH
T1D8913F81B780E823D61447329CE3E2D032367DE64FD7971770987B2FAD363C59622266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\K6EN27K8.45H\59XHL589.2Q8\manifests\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3.cdf-ms
Size 4KB
SHA256 80477cc0996f769b1fd2ea2906406feeac5614a40050f22d758e5678608dc336
MD5 e49a5881306f1ea230b525dc15543719
SHA1 c5fa8ab9d82ffb6d132e6defb1973add6ec98216
SHA512 5da9f86461ccef65e64bf0ceb61b3da0c8b4c5e51cca36b26ae4db7d6149f313b8d8c2334cfa7519a7fe909e6e77586782c7536f4a9f111c534143e9d18e18ca
SSDEEP 96:CQxDBUqeV+Ww8OO4wFWVt2JjPvcnT1gSO7ZEC:3B+JPFz2mJ
TLSH
T169A19C217280DD77D5A90633DC92C2DD3A76BD86EE03430B71C6BF2F7672AD60612192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\K6EN27K8.45H\59XHL589.2Q8\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\app.config
Size 800B
SHA256 9c0ba5ee193a7777c9a0edd6451a0d587728faea48cd5d0e2c05c320e7656626
MD5 a6cd769c3f542436f202576aff03a61a
SHA1 b31a87f77012c2c079a0931ad39a23e4564be036
SHA512 bac051034248f41ab69a7f114d69697b55ba5cce480e98813a83f8a88959afda1609568d19bd3c6efbfc445eae61c0c3202534c620b8a6af6de74973db6a3a7e
TLSH
T1D101D61870C4BE6A16A31E33E6234540ACB09DA30216A4AC34EE3137DB716D513F33D6
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\K6EN27K8.45H\59XHL589.2Q8\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\user.config
Size 520B
SHA256 53420a21b9e026a9839e79dd3f012a68071aec1b9eb43fc27bf7eeed74b629ec
MD5 3483dcf494babc0b08cb328e5fa324a9
SHA1 07be0907d7ceaa153c38eec90d0a9410deed4ccf
SHA512 cf9f3d3d222f68d645658a156ef70e86b15b1b1ce28f4ced210fa24a3d4fec59d67a34b73554c7574491d7124bb4a43dec2fe8cc47a49df4dfdba25d08632edf
TLSH
T1BBF0E9A131C06D4703735E23C5114741EE725B9B0555249874AF227A9F315CE07A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\K6EN27K8.45H\59XHL589.2Q8\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\user.config
Size 657B
SHA256 8e053c139605bd7a05806ccb258d2c67f3a60d76ac6a310a3064632651b59679
MD5 30e7b5d4d92cc6eebf889d153c6aed29
SHA1 a44067736e6b925ef0d7e8cfe19994dad1b07564
SHA512 5eacf58e1f51eeca033c849bd479e20d216f0278d56665c72522f6caf66886382fccf4c385ce1fe7a79b9ebbee2bf33d673dfc96c103559d88bcb14ead204ffd
TLSH
T159014C6570C0AE9702732E33D5218741EE725A9B016120A874AF327B5F305CF07E32DE
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1VPO1N2A.OB3\4J8EX8E2.MMB\ScreenConnect.Client.dll
Size 412KB
SHA256 54aa1a930ee8577cf39e697e4b9a2cfd0aafe3a0766ebc5f265d1d5a0b7b8c63
MD5 513c63de95f2c2eca72b3af1ed87ffb3
SHA1 5fd40fb2cb18d62abeac2db4effdccd69acb42ed
SHA512 1c84959d914e4039669cc0aef8fd5abf1df44d650a0ed3cb2734f00524d7836e04474187906f68d9f19c250a702f2caa17323f75542090112dc6d692772559e5
SSDEEP 6144:zS59LDc+c31vpY2Y5sD8ETEavHy+vd7JPYIYyqQni65/PTe:2pcs2xDHTEavSW7OQniOe
TLSH
T10094CF8163E85D6EE9AF1F73F0A1A1344E72BC056182F2EE0D0475F51A7B7828B546E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1VPO1N2A.OB3\4J8EX8E2.MMB\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 6f4eae4b257cf30340c226bb3ee5d8656c6de79b820714e6727f62eee2044292
MD5 7400597be5c012b58f1c50ecdebf2a1a
SHA1 0c835ed0c70c99900fdabc79321e41c8694b4dca
SHA512 5a7aaf04ab807d602107c068bdc555d1ca0bd15d80ba96f2786cd8f960eb1f718cfcdb24fee1589e8072ab5b5378c28db90863d440d9330e98517d24d3a1acb3
TLSH
T18C11590191C4FA362F3341D1BEE7F46067AE5B23198E194BB0696C9F8B29AD643470B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1VPO1N2A.OB3\4J8EX8E2.MMB\ScreenConnect.ClientService.dll
Size 91KB
SHA256 f5a82014a8a000ba58fd40ec2d60724e11713fe94dd779b018d9f8e533db0dbb
MD5 c499af696f598c4726ff498b446116b9
SHA1 ab019c65abacee29d2737c71d6b44278d88df875
SHA512 771fba09c8b4415bce305e261d06cf7d069caae803da6eefc71dd2125a2fb2036af7f2cab477d87d36ab301ff8d9dbbeaad8ba63ad08f355337a51dc3a380638
SSDEEP 1536:tz0NAdGN6i9C4+Cm49qAOGWZa+QOV+eLj0GUazxDa91g0O97r:tz2pz9EyJ0QOVFjtUazxDa91gr9H
TLSH
T11F935D0293BCA92AC9EF1E34B461F1A006B1B903D4E6EBD86D9820DA2E553D15F543DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1VPO1N2A.OB3\4J8EX8E2.MMB\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 6f4e37343704120b5977eac90f904fa3aa74f111761aa604d5745beca115f727
MD5 57ae8924de501aea2d37892b8d4de231
SHA1 bd6957bbe37e112b9d18e63e6eb2224ca2aecbb8
SHA512 fdee6c86ad2f53b82c8de9e181193a14e6486682f5c055724a6cc31e7832280f9024ff7b95f1eb99aeef02932a6fe212104edda90fb0c36de88bc05bcf4dd8a4
TLSH
T1E431F61591C4FA351F3302C1BDE7E4605B9E5722158E190BB059699FCF29A97434B073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1VPO1N2A.OB3\4J8EX8E2.MMB\ScreenConnect.ClientService.exe
Size 93KB
SHA256 bbbe7e148f6788a573d24503c237d6d558ba3a751089197b4fa8de20c0da9d51
MD5 08cd4d76263747ad29397e50dc19e271
SHA1 cf2951da09b83f98efa2317e7a1976bd6d903f7d
SHA512 a774bb57821c07c1e39ec46aa453e45a05aebdd7b6ca2bbe77acc280f2f90ca7a07d8fb32195105bac74d0bf28d874e7910cf2b3a3fab3cdc7f74bfce55ac9da
SSDEEP 1536:Ug1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgcU0HMW7i:thbNDxZGXfdHrX7rAc6myJkgcU0HnW
TLSH
T1EF935B13B5C28872D573093158E0DAB09A3FF9615E21DEAB3798022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1VPO1N2A.OB3\4J8EX8E2.MMB\ScreenConnect.Core.dll
Size 577KB
SHA256 34f71df56e930be845cfe724a7f93e74d771f6d1a34041a678a0c3d8d27c9e65
MD5 46d043b411b0aefc0c229eeea96e3579
SHA1 f9ba0527b7a78b04bc11cc48c58ae72dffcb0673
SHA512 6b4d9ee36ab4ee78a7554cd8a88084bc8f9fe8a698ffb481c91272004b5822338dc8de09e484ff6035e336a12c81bcbba7703b593fb48112749fed7e3f261004
SSDEEP 6144:jJv2rM+MrJSR1wrpiTw8iXlcY2BbVEBc8fXySJPluAPb2iS/ChwDTax4kxPhUTx8:J2QTWo4T3ccY2BbV8ZJPlpPb2iLMU
TLSH
T1C4C48D1A73A48377C9DF0B7AE07055660F71E80424FBD76B7698F4A62CA33848E446E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1VPO1N2A.OB3\4J8EX8E2.MMB\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 655601939c46f0ec9cf99a4b37bd4622ac768a6eb4f0f558df4ecdec14ca0644
MD5 05ca8de63ce3a248e6cbfee8393ed0e1
SHA1 f789dac448e2e1cc4bda20bfffd99df6f0b4d045
SHA512 e8fe6d077535a5bda969f35bed7c1984e0f550eebf6ca5d9b01b8f0b0af09f14e32fa4e9977aee8d44c90dd0f175e5217f5721c2f57a7f85e7222d5326676f7f
TLSH
T15B21480181C8FA261F3302D2BDE7E42197AE5733188D194A7069689F8B19AD24747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1VPO1N2A.OB3\4J8EX8E2.MMB\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 70ce0a15fc51546d251c31de1997eb8fba9f0fadc79c14ff746837cb5a2aedcb
MD5 f66a771f7a6b092d6dacc5c742533e0a
SHA1 c4310e45e724f2c863de5156fcc78fad6768d6bc
SHA512 7ff21c7994d99bce8f7062a5e6f489220c69ecb2af55707b74fea184332cc43bbef8158f89d7b8d1776d4b883d9d188c950cb31ae8dfc3cb9113447becbf2e46
SSDEEP 24576:LBjf5QN9Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPS:DQN9JkGYYpT0+TFiH7efPP
TLSH
T14B85BD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1VPO1N2A.OB3\4J8EX8E2.MMB\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 6a0833e60c9e01dbe30a2036f7617953a2ed0f732f0ea0176c3f31463df6ab08
MD5 9e3b8f46a912c7d3efcea309dff71112
SHA1 ae0eb977f9bfbf00e5c46206c145fac1507200b8
SHA512 5898714462c0691bb41e17c165cc4f6e07d01e06cc63b82893490328bca7ec04ea7c6106b211db4bcd8076691365efaaffe020baf02f3f99bbeb5d00fd7b5376
TLSH
T10241F11281C8FA251F3302C2BEEBE431979E5723198E190B7099AD8BCF29AD74747037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1VPO1N2A.OB3\4J8EX8E2.MMB\ScreenConnect.WindowsBackstageShell.exe
Size 71KB
SHA256 05b55a089251605867293f971f066e7424c618d104709b01d496bfcd784e3b05
MD5 1d683880e77b8d4ebf4b68d7a524f2da
SHA1 53bb6e056eb9a136871929182949b44acd9e2766
SHA512 3d2a5b3c73f83a38db51987a1a1ae805fc9bae24dc4eaf066d9ce8045da87399f0b989c977b4d62195cf34d39880a6e47565b95c67c4771a0b56fd0f21556568
SSDEEP 768:QzlYsf/wCdOBti13kDeuRsUQHjSzmdvmDSmBsuMQX5E+TCMXESslRq75KYiDLk5w:QRYKtd739PDldvmDqfQX5E+TC7bu5K7f
TLSH
T10F637D5023ECC525E9FF2E34B0E1F6600AB3B963C8E1D7D52DA821DA1E127D14F64396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1VPO1N2A.OB3\4J8EX8E2.MMB\ScreenConnect.WindowsClient.exe
Size 676KB
SHA256 754e3bd3a763fd5d396a1f06149e6819aa7e3dd0d9a4f6dc2d7607fcfb0f258f
MD5 6b6846e44007df584c4fb773ba03f424
SHA1 76194a0a5bca0f6c369ba0007f5dcfbf44b2c261
SHA512 41677847adc26f0067d18a9e9f388bf8e5daa91ea175ff7de469463a0c135e3faf8b17e4aa5478ab58c427c2ae5e21fa054d87bb2e5ad5567f18a84e9855660a
SSDEEP 12288:bGafI0dcqD/bp96K0ZSDVkmwY7zvrPfaGOwg24oLJ:9g09eMRPvtChoLJ
TLSH
T14EE46D3137AC9A7BD5AF0B39F033391867B1E4057289E74FD948A4EA1D8B7848D0539B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1VPO1N2A.OB3\4J8EX8E2.MMB\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1VPO1N2A.OB3\4J8EX8E2.MMB\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 ef613a98b6ad15c74d85b533ea914337fb549c8f9b882c78f31616d27a664746
MD5 9ebf4d420218c403bd6eb773227b670a
SHA1 6e6b3f8dd8223cbbccb79b90a63649b06a378eb0
SHA512 dee07c4919b990b845b6ebd6cdb8f70363d0c733180ed53c954ca52b62518e0a43c938d5c4a20b05603f70224d48f964fbe1ea385f78b528be8909ddfa19ea1a
TLSH
T13751C61651C4FA351F3302C1BEEBE4709B9E5722158E190B7099A99FCF2DA97474B037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1VPO1N2A.OB3\4J8EX8E2.MMB\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 951218d6ff46cd53e73e97e4a4801130a1a37c8b8d2efcd7d08892132f0c3d90
MD5 3ba1b81529915bb42df0c62331522a60
SHA1 a863ffd69c1ce79df47f4fad62cc9b111fd531e9
SHA512 3c0fd033cb367038285c4a90be9a30841d40df54cf0cad138af0601e1817d7f326489623b9cc59bd37c12eb725934b573d04dc54f8371023c31c21d3647f9610
SSDEEP 96:xWLwOhoyTpte2wvy8kO/kWkDkXn+Pk8qkQhMyk5w4kOpQkOphykYAkOpD:oR/eKOMHIX+86QhM75w9UFUh7YVUD
TLSH
T1DCF1BC9684C07D21573391C0FEE3D914BD157F6302AE148EBC8D19AF9FA25899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1VPO1N2A.OB3\4J8EX8E2.MMB\ScreenConnect.WindowsFileManager.exe
Size 91KB
SHA256 9ea69d3699057fa5999eaedc7c9d4f9169be3481ba64c35afae6594a6fa7b960
MD5 a8e00048db6fcc17404a519c3ce77ea6
SHA1 c9850cc2944fc5f0343ba637ec875a4c65f5ae1e
SHA512 344f4363beacf7fed7f127b5c6b31ef884262eaec2eb5a7b727f6d8b4130815707f7f20d11521eb56913e5d5cd1f7e77fe27bd77efc85ccfb974a3f9dd5148d6
SSDEEP 1536:HUMOISlP4wyHI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVdi167M:8IsAukLCK6A
TLSH
T1AA93D652356A6231DEC5C033A492E9B19C337F6207FDC5BD28A1BA3639E03943E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0JCTE0WR.VZ0.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\D7PX4XZC.KBQ\0JCTE0WR.VZ0.application
Size 133KB
SHA256 e5de35169db22742e436e23be00f77789125c1e26144b4dd89ab0a49bf4a14d4
MD5 814ebde777161fbd38d556de9da12708
SHA1 d3617288823ebd901d0f90f09d2064871e685a4e
SHA512 bf1c420ddc36800616bc4fe03a4102e069824d724c237b191dfca77eeef0c8c2edbed82ffa19fc3657db7161fc085b2b1255d1a8939d7d69bc9b6e8227d78271
SSDEEP 3072:T/a9YuuBn1nfdvg2XOcuNKEBy25ZKEc2KEc4X1:ra9YuuBn1nRWUQG74
TLSH
T16FD3F73ACE30F5C4477DB021D0692D673DC11B939B730BACD90A196B0E69796EF1A68C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2388-291-0x0000000000FF0000-0x000000000109E000-memory.dmp

Download

memory/3224-7-0x00000000059E0000-0x0000000005A72000-memory.dmp

Download

memory/3224-4-0x00000000030E0000-0x0000000003108000-memory.dmp

Download

memory/3224-6-0x0000000005FA0000-0x000000000655A000-memory.dmp

Download

memory/3224-8-0x0000000074AF0000-0x00000000752AC000-memory.dmp

Download

memory/3224-9-0x0000000074AF0000-0x00000000752AC000-memory.dmp

Download

memory/3224-10-0x0000000005D20000-0x0000000005ED0000-memory.dmp

Download

memory/3224-5-0x0000000074AF0000-0x00000000752AC000-memory.dmp

Download

memory/3224-14-0x0000000074AF0000-0x00000000752AC000-memory.dmp

Download

memory/3224-3-0x0000000005840000-0x00000000058D4000-memory.dmp

Download

memory/3224-2-0x0000000001700000-0x000000000170C000-memory.dmp

Download

memory/3224-11-0x0000000074AF0000-0x00000000752AC000-memory.dmp

Download

memory/3224-12-0x0000000074AF0000-0x00000000752AC000-memory.dmp

Download

memory/3224-1-0x00000000016E0000-0x00000000016E8000-memory.dmp

Download

memory/3224-19-0x0000000074AF0000-0x00000000752AC000-memory.dmp

Download

memory/3224-0-0x0000000074B02000-0x0000000074B03000-memory.dmp

Download

memory/3716-16-0x000001C91DE60000-0x000001C91DFE8000-memory.dmp

Download

memory/3716-71-0x000001C922A30000-0x000001C922ADE000-memory.dmp

Download

memory/3716-65-0x000001C922830000-0x000001C9229E0000-memory.dmp

Download

memory/3716-59-0x000001C922540000-0x000001C9225AC000-memory.dmp

Download

memory/3716-53-0x000001C91E190000-0x000001C91E1AA000-memory.dmp

Download

memory/3716-47-0x000001C922570000-0x000001C922604000-memory.dmp

Download

memory/3716-37-0x000001C922240000-0x000001C922290000-memory.dmp

Download

memory/3716-28-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/3716-27-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/3716-26-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/3716-25-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/3716-24-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/3716-23-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/3716-22-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/3716-21-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/3716-20-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/3716-18-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/3716-17-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/3716-15-0x00007FFFAD5E0000-0x00007FFFAD5E1000-memory.dmp

Download

memory/3716-13-0x000001C903710000-0x000001C903718000-memory.dmp

Download

memory/3716-324-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads