c951ab48afe025583e6c97b286fefa53fe5a4e28f9d27b2de8653ff5e8aad839

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_946432b7f84a1b884205bdfcd40d26fe_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 2.4MB
Sample260820-pdagsabp91
SHA256 c951ab48afe025583e6c97b286fefa53fe5a4e28f9d27b2de8653ff5e8aad839
MD5 946432b7f84a1b884205bdfcd40d26fe
SHA1 e586bfea6d67718f705664b9e927232a92580e1f
SHA512 c426676dcfa13c2f4bfa94b8fa0b3d49df237c15bfb68a5c1ea9ea8af3cc5e192c7339b57a85153e473deb0b6a3725b21352341cf1b7bab3671313c306c2b6f8
SSDEEP 24576:380QoZ4aH/fMtp8Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFib:s0D4E6p8JkGYYpT0+TFiH7efPzQgm+m
TLSH
T179C5BE02F3D656B5C46F0638D87A921AAB70BC040315DBFB56C8A9792E337C04E397A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 7 IoCs

flow	pid	Process
4	5568	dfsvc.exe
4	5568	dfsvc.exe
4	5568	dfsvc.exe
4	5568	dfsvc.exe
4	5568	dfsvc.exe
4	5568	dfsvc.exe
4	5568	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
2864	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\O3ODQ1PQ.TLJ\JC1QGD0H.N55\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_946432b7f84a1b884205bdfcd40d26fe_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0009_none_d86c698c4fd7c776	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_fc6eafea63709ad9\scre..ient_4b14c015c87c1ad8_0019.0009_none_d86c698c4	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0009_none_42570bba40887172\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0009_none_f3aaa402d647d4dd\SizeOfStronglyNamedComponent = e851010000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0009_none_1cd80acbadc242ca\lock!10000000d28f590e300b000034130000000000000000000 = 30303030306233302c30316464333039643336303334343531	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 54007200750065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_61ea22db1970351a\LastRunVersion = 68747470733a2f2f736f706f7274652e736f66746c616e642e636f6d2f42696e2f456c73696e6f72652e53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e392e31302e393534352c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e392e31302e393534352c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0009_none_f3aaa402d647d4dd\implication!scre..tion_0000000000000000_0019.0009_2e = 68747470733a2f2f736f706f7274652e736f66746c616e642e636f6d2f42696e2f456c73696e6f72652e53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e392e31302e393534352c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "BGW0VZVGKJH3A2BVYAKP0HA5"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0009_none_a39de4de296c547f\DigestValue = dd1a5c21efd06e9fb06cc08fe2a6081613db537d	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_fc6eafea63709ad9\scre..vice_4b14c015c87c1ad8_0019.0009_none_f3aaa402d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0009_none_f3aaa402d647d4dd\Files\ScreenConnect.ClientService.dll_e781b1c63 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_61ea22db1970351a	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_0019.0009_fc6eafea63709ad9\HasRunBefore = 01	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0009_none_f3aaa402d647d4dd\lock!0e000000d28f590e300b000034130000000000000000000 = 30303030306233302c30316464333039643336303334343531	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0009_fc6eafea63709ad9\lock!1d000000f28f590e300b0000341300000000000000000000f569 = 30303030306233302c30316464333039643336303334343531	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0009_2edb5b65a541b952\pin!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0009_none_a39de4de296c547f\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32352e392e31302e393534352c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0009_none_f3aaa402d647d4dd\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0009_none_46cee39b7cd684a2	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0009_none_a39de4de296c547f\lock!0c0000006b8e590ec01500009c060000000000000000000 = 30303030313563302c30316464333039643266303635353264	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_61ea22db1970351a	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0009_none_46cee39b7cd684a2	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0009_none_1cd80acbadc242ca	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0009_none_a39de4de296c547f\SizeOfStronglyNamedComponent = 0196090000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_fc6eafea63709ad9\scre..dows_4b14c015c87c1ad8_0019.0009_none_46cee39b7 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 32003000320036002f00300038002f00320030002000310032003a00310032003a00340035000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0009_none_6f525cc3ae071fcd\implication!scre..tion_0000000000000000_0019.0009_2e = 68747470733a2f2f736f706f7274652e736f66746c616e642e636f6d2f42696e2f456c73696e6f72652e53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e392e31302e393534352c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0009_none_42570bba40887172\SizeOfStronglyNamedComponent = 74b8080000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0009_fc6eafea63709ad9\implication!scre..tion_0000000000000000_0019.0009_2edb5b6 = 68747470733a2f2f736f706f7274652e736f66746c616e642e636f6d2f42696e2f456c73696e6f72652e53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e392e31302e393534352c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0009_none_a39de4de296c547f	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_61ea22db1970351a\LastRunVersion = 68747470733a2f2f736f706f7274652e736f66746c616e642e636f6d2f42696e2f456c73696e6f72652e53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e392e31302e393534352c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e392e31302e393534352c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "AMQN7EK6EOB51RX0QTVBLCLM"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_0000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0009_none_d86c698c4fd7c776\implication!scre..tion_0000000000000000_0019.0009_2e = 68747470733a2f2f736f706f7274652e736f66746c616e642e636f6d2f42696e2f456c73696e6f72652e53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e392e31302e393534352c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0009_none_d86c698c4fd7c776\SizeOfStronglyNamedComponent = 214c060000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_fc6eafea63709ad9	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0009_none_a39de4de296c547f\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_fc6eafea63709ad9\scre..core_4b14c015c87c1ad8_0019.0009_none_42570bba4 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0009_none_f3aaa402d647d4dd\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e392e31302e393534352c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_none_1cd80acbadc242ca	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_none_1cd80acbadc242ca\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e392e31302e393534352c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0009_none_f3aaa402d647d4dd\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e392e31302e393534352c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0009_none_42570bba40887172\lock!0e0000006b8e590ec01500009c060000000000000000000 = 30303030313563302c30316464333039643266303635353264	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0009_none_f3aaa402d647d4dd\lock!1c000000d28f590e300b000034130000000000000000000 = 30303030306233302c30316464333039643336303334343531	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_0000000000000000_57051d5779c6eb7e	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0009_2edb5b65a541b952	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0009_none_d86c698c4fd7c776\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0009_none_a39de4de296c547f\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_fc6eafea63709ad9\scre..core_4b14c015c87c1ad8_0019.0009_none_42570bba4	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0009_none_46cee39b7cd684a2\Files\ScreenConnect.Windows.dll_fc0d83aff7df0b5 = 01	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\O3ODQ1PQ.TLJ\JC1QGD0H.N55\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\BGW0VZVG.KJH\3A2BVYAK.P0H\scre..ient_4b14c015c87c1ad8_0019.0009_none_a39de4de296c547f\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6000	2026-08-20_946432b7f84a1b884205bdfcd40d26fe_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	5568	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6000 wrote to memory of 5568	6000	2026-08-20_946432b7f84a1b884205bdfcd40d26fe_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	89
PID 5568 wrote to memory of 2864	5568	dfsvc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-20_946432b7f84a1b884205bdfcd40d26fe_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_946432b7f84a1b884205bdfcd40d26fe_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6000
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5568
- - C:\Users\Admin\AppData\Local\Apps\2.0\BGW0VZVG.KJH\3A2BVYAK.P0H\scre..tion_0000000000000000_0019.0009_fc6eafea63709ad9\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\BGW0VZVG.KJH\3A2BVYAK.P0H\scre..tion_0000000000000000_0019.0009_fc6eafea63709ad9\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:2864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_0019.0009_none_6f525cc3ae071fcd.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\BGW0VZVG.KJH\3A2BVYAK.P0H\manifests\scre...exe_0000000000000000_0019.0009_none_6f525cc3ae071fcd.cdf-ms
Size 14KB
SHA256 2ddd741faf22c07bea1c9f3e2fb6d2697269284dc0aafc4f88f27c7246abc21b
MD5 810b7ab0d81c972c783689c6cef8c75d
SHA1 172255ca52dd98bc749ffcedd83a136abc0b47a3
SHA512 33afb810ba5898bb053c6c5219afa7236b393bb1989cc4a7be09be3ad837855ebc8e43b682420eb628a729d49f1bf53cad7260dffc833e2fd767d988a747b942
SSDEEP 192:uW5wHXpRr1cG8NOWAdqX2zI8WlP7vPySyT6jc3GybrzNfDM24e/sSEFKiqFea4:u1Pr1yNXRPP7PVyT0g/3QKLFea4
TLSH
T16A622021B6C9E8FAD6B54E32EF79E6E9F7253D6C0C60184B3144332D8D7C659AF20681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0009_none_42570bba40887172.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\BGW0VZVG.KJH\3A2BVYAK.P0H\manifests\scre..core_4b14c015c87c1ad8_0019.0009_none_42570bba40887172.cdf-ms
Size 3KB
SHA256 fb4f4f41c105b51eb48675179c954114d47431333e86030ddb586821c3cc910d
MD5 95455856056b29743e75216a7682e4c6
SHA1 54f66532ef267221f4b38fed110cf7cc98efe51e
SHA512 73faae20761cc6ad276eeafb816e491950da989370b3aa40cc9710daf4c00f1a4c5c605ace9bf53e460fc7f33193771e811d5b750d15cd0815bebc556a1206c3
TLSH
T12161FF027604D917D9AA06336CD1E1EE27743E83CF85554F74C47F2F76721BA46222A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0009_none_46cee39b7cd684a2.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\BGW0VZVG.KJH\3A2BVYAK.P0H\manifests\scre..dows_4b14c015c87c1ad8_0019.0009_none_46cee39b7cd684a2.cdf-ms
Size 5KB
SHA256 0c445741d2143aef056d7445f7a1875374959ee1ea5b982f6a69a1b4cad3e006
MD5 406575e6f9f46fe5ac89a0925ea0535d
SHA1 3ef575587de2fbaa69ce4d6c768dbd4cea250b24
SHA512 178272dff76636848b9c85c5c76d568ec5c704be07df90c4e9d33f59a71fbfe3f2e3a2872fa4330637f488a4aa2f6993b43f0335d2772a91028fb1063eef59cc
SSDEEP 96:APP+RxU9LVeV+Ww7Ikr+tlI4j0K7gg/hjngnsRTu:VRxUNqJsr+lT5gaQeu
TLSH
T1D6B195107681DD97D4B90633ACE6D3DD2731BE82CE42430B71D8BB6F7A322D6862A195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0009_none_a39de4de296c547f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\BGW0VZVG.KJH\3A2BVYAK.P0H\manifests\scre..ient_4b14c015c87c1ad8_0019.0009_none_a39de4de296c547f.cdf-ms
Size 6KB
SHA256 3cf0e4177e9a005403c8ef4dde96d85038765f613e229e695d7b04e876fea1b7
MD5 c88fa28b06591974b34a7de8e4fadc84
SHA1 3cb1ec4d7602b008d18d1f271354141558539898
SHA512 150bdd4a8b5fc4aa69734a221128ae436a436db635a0c41263f16883465ba87ad27bf57bd179f56bc0b9ab052443f39a9c9597bfde4c55824f2a76896aa12630
SSDEEP 96:HeQaoeV+Wwwq8WeMM+3d2YSbJGWTFdKIteFTsVR/Xka8M:ZanJuet+DSbEUPKce1sMaR
TLSH
T134D12C21BB01DA57C17A06326CEBD2DD27243E87DF4A824730C4B72F7A325975B25268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0009_none_d86c698c4fd7c776.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\BGW0VZVG.KJH\3A2BVYAK.P0H\manifests\scre..ient_4b14c015c87c1ad8_0019.0009_none_d86c698c4fd7c776.cdf-ms
Size 2KB
SHA256 aef60abbf73ad69b859f51a981f5cbb22c90e0ef75f101ba48f0cdac5899a088
MD5 f5e145c1b9e79deb4f0401c7799009dd
SHA1 7f8284b6a8fb39942584390bd2f80fa76b0e35be
SHA512 fcf4f43733bb1906ea0122594c00c86d5e0f6ed88dbe9759a1c48bc09655d8faee647660f5d5cf10c9433c8d66e3c09a3116654214630da8792c3c20133c02ca
TLSH
T13251DC043A48D527D66B423ABC92F6DE32A23D42DE5C32C7B0903B3F2A7419E4A130F1
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_0019.0009_none_1cd80acbadc242ca.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\BGW0VZVG.KJH\3A2BVYAK.P0H\manifests\scre..tion_0000000000000000_0019.0009_none_1cd80acbadc242ca.cdf-ms
Size 4KB
SHA256 71a1e1d11dfe12426a8d1c66f226689f753ee5ecebb3247ec9c82c40575972a5
MD5 1e320b3c0f4b4b0accf5dfff2cf541b5
SHA1 8adea15c0061586cf75a793587b00ca91c303117
SHA512 dcaefb034abb7a8acd57e2d64158cfd10ce3f628e32a14bc755b4217269f35621b4716f43209397ae31c8d1408591b6e7930cae9240258b5f8b9d81b8f1af7de
SSDEEP 48:bP/mrIVAjIvrcQg0Ru9o0m5RD7zKU7gFUTUEVkEYXt4sQgbmZFms4Ch+UQRcb:TOUQGpEW0m5R/2Um2khQPfmvVUQRm
TLSH
T115910E80B740E823D6145732ACE3D2D032357DA64FD7971B70987B3FAD367C596222A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0009_none_f3aaa402d647d4dd.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\BGW0VZVG.KJH\3A2BVYAK.P0H\manifests\scre..vice_4b14c015c87c1ad8_0019.0009_none_f3aaa402d647d4dd.cdf-ms
Size 4KB
SHA256 cbc3cf24f9382752cab2cce0d33ce3b9010c9483404d88eccda3e41711dcaaa7
MD5 c6063d8268255d3fcb9a00cef3db44ad
SHA1 ddf4a6324f6338e147076b320a92a2f7dc87c135
SHA512 603e23566fa0c903ab31d2683fb4d73eaea635294d0626006305b1860817c2482d7ea1ef31d7b31a0a4935755b270cfa6bff51a5cdf6db3986e9d35e6d5befed
SSDEEP 96:VbTeV+Ww8q45uECi6Np+ZsEwuZNf+Tv7QNf:eJZuEf6p9uZFgvM
TLSH
T1D5910D017240E976D6A50633ACA6C2CE3B757E83DE82560BB0C47F3F76306E61B211A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CTD3COLM.Z8Z.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\44A32V0C.VKP\CTD3COLM.Z8Z.application
Size 170KB
SHA256 f7eec99f7213a2f0296cfd563059be3437d8ea1eca930d4ddc9875f41373b44b
MD5 b099eda5a462f2c4492a90c85f67288e
SHA1 64d7a8e780afbb42675d130a363e110dc2a0909b
SHA512 e0c7715503ff87e95aaad4140df09de0d8fce84070e0e88cb5542c2b9322bd7721b5578ac16b8308945c10f0ac544d9e099ab7b7deefbb4bfeab02164303a713
SSDEEP 1536:n/iBHhe2WCRSmQfn4/5EHSZ5GE/uLTvooycu5KQ/IuK7E3GSnKDZNq3nxLZMdC+v:n/YHhlWCRbW22XOcu5X9ZiXi5yzznf
TLSH
T11A04613A8E30F5C0477DB421D1692D6B3DC11B93DB731FACD90A18A60E69396EF1A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O3ODQ1PQ.TLJ\JC1QGD0H.N55\ScreenConnect.Client.dll
Size 399KB
SHA256 e08674490da57536fae94818d80e9959f61142c6bd558e23f704b7a7b6804c64
MD5 46e9a540da86b9ffe3f74cc9de8da9c6
SHA1 cfbe1f1dbedfc8a91a2fdf7b118d83e80fcfe1f5
SHA512 02955bae1d9c7ecbd9d06fd89a70b81d731a9e0a1dcc553c04d445f17edf4e38fefc6390a10d73b7b710cde60f465dff88468df8984d6fce414e2f7706e49602
SSDEEP 6144:EMq4l+zvJNDZvD8ETEavHy+vd7JPYIYyqQni65/PGOD:L5+v5DHTEavSW7OQni3w
TLSH
T14C94BF86B3A44C6DFF6F0A77F45041299E73AC456552F26D4E04B8F90AB3BD28740BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O3ODQ1PQ.TLJ\JC1QGD0H.N55\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 7301fb27f13c8f662374da4da3842ecdf5530d44ecb53528f8b1e8ddbbc2bc2d
MD5 0b5e6effceae83ec4651402649bedc29
SHA1 95d0f6192d6f22532f92b583df3639c9113c405b
SHA512 cdf27ab9b39362f36f242258769aefdd8bd898fe82bba5b4a2cb31bef2ab5cb04af427555d4a7758ced3a9749ed1c6fe016ba7771fb14adf3977cb328a784a5f
TLSH
T197117B0581C8FA261F3301D1BEE7E021576E1B37048E194BB0696DAF8B2DBE647971B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O3ODQ1PQ.TLJ\JC1QGD0H.N55\ScreenConnect.ClientService.dll
Size 78KB
SHA256 aceb9a2c3ad257041c2467c69b026b938d8ffef38644baef935c02c0be2d01f7
MD5 d2e9496d772ef9d7bee5a4ca48066855
SHA1 4ca765faf2b114c2e78607335654c6302d9af962
SHA512 fa712286c5e1e51247b9923a4652ed8a2a1f7a7842b4111de7f6ebc77aa9942881e5b3fb68efd1ac76589c7616d75248bfbb5713329a736cc8de054de2493c65
SSDEEP 1536:O/7xQmiDHn5f2yoI4vn3R0as57k/QQV3lTdmkbPlC57K:K7xQmKH5eygf3R0H0QQVFdXC5m
TLSH
T11A734D41A3AC5E26C9DF4F787465B0450F709A02E4A3FBDD9D8EA4EA1B563C12E043DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O3ODQ1PQ.TLJ\JC1QGD0H.N55\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 3aed96134a6a23aba5b06880e3912aa4d2dbeb7a90bf460975ed96464fd421ed
MD5 4109d1216988c013ea88c8ef7f0e3210
SHA1 1ac951007dc095985729a931d806751ed1fd4c5c
SHA512 6a9bc22a24c66b57ce2dbddec90b26f2f26d3b2440b234dab083b60958138732bfc8ad4d6bafa0ee691f4d24c7e6b7d744c7fd0e00629f0f1067e7e0c94dd44c
TLSH
T12431E70681C8FA251F3302C1BEE7E0619BAE1B33158E1947B059599B8F2DAA6479B173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O3ODQ1PQ.TLJ\JC1QGD0H.N55\ScreenConnect.ClientService.exe
Size 93KB
SHA256 e7ac6dfb146c2e69fb33753492b692eaf980505781914fc7bea9fefe439a734d
MD5 01687c649432932854285d807f53b430
SHA1 1bcb958dd54f7790f1a976e42d099dfba0e0ac16
SHA512 201f0702731c6e37af60fcf960995b7ae88c8ce4415ff75d246d2b0116c0850858d3ed64bce337d226602d64fc81efc4ef3bc814de9010ff2f313e5156148530
SSDEEP 1536:tg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUfT0HME7U:+hbNDxZGXfdHrX7rAc6myJkgUfT0HVw
TLSH
T19B935B13B5C28872D573093158E0DAB09A3FF9215E61DEAB3788022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O3ODQ1PQ.TLJ\JC1QGD0H.N55\ScreenConnect.Core.dll
Size 553KB
SHA256 301744db4e2da7351d05d117b4ff3620f9dc21de5ce41260a647e07232485f25
MD5 d49f1e1437a60a7d23e22831a928e228
SHA1 c15bce21aced2653211efa417816ab66c2385651
SHA512 5ea376e4f87637418f42d50cc82e097e9c8355e82bb340cb03ed8ee0622211fd05b4c5bd6a20f83e55dfba835714c26298f840e03ed3babed4757a96cc35f16e
SSDEEP 12288:M+IY2aqteJvg7FwVzP/DVzeCXV8VNNve49HWpEAby6X/fsM:c0QoZ4aH/f1
TLSH
T154C46C5233E8873AC56F1B3AE420D6150B71EA00B05AE76B25DEE4E91E837855D0C7FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O3ODQ1PQ.TLJ\JC1QGD0H.N55\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 3fa5b2e7463e32504cc6f0a5b40214a57747ddde1f61ec8e2fd0962e1fdb4e99
MD5 ec0e00361f15bdda5f508d9708d40b2f
SHA1 3a94903147b2bc12f1520439d909f3c8b81de848
SHA512 f7e94ea29dcd5be11285aef02ad33ddc44310ea8aaf24b0ddfe291c110f4c11d0bfc186cbd719f93a34148e1b8c7a0739516075d01bffd77ccc46c5b6a6eab49
TLSH
T15521370181C8FA261F3302D2BEE7E421979E5B33188E194B7469699FCB2DAD64747173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O3ODQ1PQ.TLJ\JC1QGD0H.N55\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 59c51554b09e765d2dd0aea37be681c11f6d0ca4317441ee30b25b1ebcb81928
MD5 34dcb69872c7c5691237fd2f80ff4518
SHA1 7b340c4b04bd961850c3aa7b79ad7bc35b67e5a9
SHA512 383f4495b01e9a7e8f8fbac68c5c9daebbd0c7e07cda0cd0a157cdf0c3160336f1210a2569d180dc906a40cb995e192d7605723198fe82bf4b8e2e817085a3ae
SSDEEP 24576:Ltp8Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTZ:Bp8JkGYYpT0+TFiH7efPs
TLSH
T12B85AD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE356D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O3ODQ1PQ.TLJ\JC1QGD0H.N55\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 8246751d2a09c7348036e710b7cdf10c038838230ba9a204ecd2f3336c716b3a
MD5 b2bcfac0132a3f9e4c0fe1d0dca2ae40
SHA1 379b1cfe09f0283b8d110749a15dcca6e6223754
SHA512 fb464dc86ebd2b18978b98f9019ef6cc6cc9ffd349d5602674ce36fee093cc2656bf374d59b826d80f3bbeb25f98e929498d107f0645ed7874aefe78dff312a7
TLSH
T1E941E11681C8EA250F3301C27EEBE431879E5733158E190B7499AA9BCF29AD74787167
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O3ODQ1PQ.TLJ\JC1QGD0H.N55\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 6e60738752dd9e1ad6d017f948f3e9da6a55bd8c358dd57f8c17232a69a2bce2
MD5 ee921bee985b375a696a890c624e3a84
SHA1 abddbe2112e2a6fd57ce92f7dd081706b9a0d6c7
SHA512 9e348d2801d161a429c75bc60d85f1576e4c3a0589ca4b135f0ba47d129f3decb67bfbc2323b53e111cc9f3550d991ffcdcd08861011cb87e9c41298d10b998b
SSDEEP 1536:poSOs/MRZFe9aT2DvmDTyQX5E+TC7Lh2syGbnU87v:poTsCZFe9VmyQODjU87
TLSH
T182538E4163E84615C9FF2E7CB8F2A1141EB1AA439441EBAE0DCD65EA1E537815F303E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O3ODQ1PQ.TLJ\JC1QGD0H.N55\ScreenConnect.WindowsClient.exe
Size 604KB
SHA256 667b219bc294be007d55fb4a94c62ec58582c36c051e15b202664ff23b4c627d
MD5 922a53a63b7c963b121c2705643cf8ee
SHA1 dd1a5c21efd06e9fb06cc08fe2a6081613db537d
SHA512 32862ea63f958655fbd1f1f6ea5f601bb33f2714838312247401528da5911d02ab9fe62eefcc83878f1ea18ecd1a7f9f3e634c159a98f03ff3efbd0f4bd8c645
SSDEEP 12288:yacSlKUy8wjSPIDQVrW/C1qE6+z+kYh+C:G/8wekCYyCjhb
TLSH
T128D46C2173BC8A3BC4BF077BA0A11E6857B0FC0291C5D79E5924A8E94EE73D649443E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O3ODQ1PQ.TLJ\JC1QGD0H.N55\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O3ODQ1PQ.TLJ\JC1QGD0H.N55\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 c7f619e579e257739ed2c5bfafaa9788f873184fd9d65a1765c7b0ec5068af90
MD5 e6eed96299c8a1254b4f8c23d500b878
SHA1 2cde7630b64bdc06ab6a38d5ba41570e7c74aa84
SHA512 12cca86b6132cfe7cb62292e99b6b7e1a75eae28808cba8a7227aeacaba531e2d540bfea9d34202b09641bc86d86ae66f36e27e0e116d7028313762ed2bcd759
TLSH
T13C51B40641C8FA210F3301C1BEEBE471979E5B32158E194770999A9FCF2DAA7478B177
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O3ODQ1PQ.TLJ\JC1QGD0H.N55\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 dfc05c833eb1aa74e8179b11b109606639783f55c722ad7bfa81ef87830480cf
MD5 af1ee26dd1184d588024de7e9beda213
SHA1 119fdfe9e1616201866ae517a906330afc252d40
SHA512 7d1d34dee8fd971d36a79cadae96a5728f169cfa2c7aabe6683ad6182ab7a0aa65a338e12c7b60288abf89fd0a1795379a9de24057c51025d211adaa65b513bb
SSDEEP 96:xWLwOhoyTl/e2wvypYkck5akjkkfpkTqke9kF4kOpQkOprkjAkOpD:oRxegdJ5zjhfC3eeF9UFUAjVUD
TLSH
T1F8F1AB9684C07D21573381C0FEE39924BE157F3302AE148ABC4D1AAF9F765499B972B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O3ODQ1PQ.TLJ\JC1QGD0H.N55\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 e0c20e61219b2204d91eb524aeeeed5d3d92993418b8e684ad1d03af761af376
MD5 329c8ba250f3048533388333d001b228
SHA1 44a0298e89f6bef8913f1f249fe0dc6870de96a7
SHA512 55c1c817dba58c7582896cf9fc38005612b4f508914a282ca5227719c0fd34e7a867eada4193da6c2347d8024761a94cd19d6519344e85e721414a0e553f6219
SSDEEP 1536:Gtyzl44wzbdI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Mxd7px:FRkukLdoxd9x
TLSH
T11483E68235762231DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03443A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2864-298-0x0000000002770000-0x0000000002788000-memory.dmp

Download

memory/2864-287-0x0000000000430000-0x00000000004CC000-memory.dmp

Download

memory/5568-14-0x00007FFCAE0F0000-0x00007FFCAE0F1000-memory.dmp

Download

memory/5568-24-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/5568-35-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/5568-45-0x000002D1C02D0000-0x000002D1C0338000-memory.dmp

Download

memory/5568-300-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/5568-51-0x000002D1C0300000-0x000002D1C039C000-memory.dmp

Download

memory/5568-19-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/5568-57-0x000002D1C02F0000-0x000002D1C037E000-memory.dmp

Download

memory/5568-18-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/5568-299-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/5568-63-0x000002D1BDB50000-0x000002D1BDB68000-memory.dmp

Download

memory/5568-69-0x000002D1C05C0000-0x000002D1C076E000-memory.dmp

Download

memory/5568-16-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/5568-15-0x000002D1BBAB0000-0x000002D1BBC38000-memory.dmp

Download

memory/5568-12-0x000002D1A14C0000-0x000002D1A14C8000-memory.dmp

Download

memory/5568-31-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/5568-20-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/5568-22-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/5568-34-0x000002D1C00D0000-0x000002D1C0120000-memory.dmp

Download

memory/5568-297-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/5568-17-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/5568-296-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/5568-288-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/5568-23-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/6000-0-0x00000000748B2000-0x00000000748B3000-memory.dmp

Download

memory/6000-10-0x0000000005910000-0x0000000005ABE000-memory.dmp

Download

memory/6000-5-0x0000000003060000-0x0000000003084000-memory.dmp

Download

memory/6000-4-0x00000000748A0000-0x000000007505C000-memory.dmp

Download

memory/6000-3-0x0000000005580000-0x000000000560E000-memory.dmp

Download

memory/6000-8-0x00000000748A0000-0x000000007505C000-memory.dmp

Download

memory/6000-7-0x0000000005BD0000-0x000000000618A000-memory.dmp

Download

memory/6000-9-0x00000000056F0000-0x0000000005782000-memory.dmp

Download

memory/6000-6-0x00000000748A0000-0x000000007505C000-memory.dmp

Download

memory/6000-1-0x0000000001610000-0x0000000001618000-memory.dmp

Download

memory/6000-11-0x00000000748B2000-0x00000000748B3000-memory.dmp

Download

memory/6000-13-0x00000000748A0000-0x000000007505C000-memory.dmp

Download

memory/6000-2-0x0000000002F20000-0x0000000002F28000-memory.dmp

Download

memory/6000-21-0x00000000748A0000-0x000000007505C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads