93e913cff39ed5f3802a0af4bb90f50cf6ac63497f763927e6ab1bf918c2ac2e

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_9d1e380236434fbce89f0ca89605fd37_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 2.4MB
Sample260729-mtq4cstyfs
SHA256 93e913cff39ed5f3802a0af4bb90f50cf6ac63497f763927e6ab1bf918c2ac2e
MD5 9d1e380236434fbce89f0ca89605fd37
SHA1 ab2b1277311264c541bc119cfdae8d9ce922b97e
SHA512 62051f5329397e88de89e701fcde4427ce95af5128ba84464fc63ba4b03dba2e62dd56f4dc8abaf880da94f345b34ee39db8c7991d68e3730055c701ffdf6936
SSDEEP 24576:QjubA9DS2XINpgFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiHf:CDupgJkGYYpT0+TFiH7efP0Q97Ah
TLSH
T127C5AD01F3D265F5C46F0A3884BA421AA774BC081315DBFB56D4A9A93E337C05E36BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
8	5008	dfsvc.exe
8	5008	dfsvc.exe
8	5008	dfsvc.exe
8	5008	dfsvc.exe
8	5008	dfsvc.exe
8	5008	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
2964	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\4BCD72OP.HM7\ZXB49N3A.WN7\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_9d1e380236434fbce89f0ca89605fd37_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 680074007400700073003a002f002f00720062006d0077002e00630063003a0039003100310033002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006d0061006e00690066006500730074000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 0000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236\appid = 68747470733a2f2f72626d772e63633a393131332f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244\DigestValue = ef1aa54cd6a09f178eb0fe006908099bde860f86	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236\scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d\lock!0a00000098be580e940b0000d80600000000000000000000 = 30303030306239342c30316464316634373733623333633337	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\DigestValue = 8aaf1107de02e0190a4ea0dd4e4ed05808e3df85	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a843f70\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 32003000320036002f00300037002f00320039002000310030003a00340036003a00300032000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a843f70\implication!scre..tion_0000000000000000_0019.0004_76a = 68747470733a2f2f72626d772e63633a393131332f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a843f70\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d\Files\ScreenConnect.WindowsClient.exe_6492277df2 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0004_none_1cbe04a2ab6ffd98\lock!10000000b7be580e940b0000d80600000000000000000000 = 30303030306239342c30316464316634373733623333633337	ScreenConnect.WindowsClient.exe
Key deleted	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244\SizeOfStronglyNamedComponent = 01a2030000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d\SizeOfStronglyNamedComponent = e17f090000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb527 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236\scre...exe_0000000000000000_0019.0004_none_6f38569aab = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a843f70	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 680074007400700073003a002f002f00720062006d0077002e00630063003a0039003100310033002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e003f0065003d0053007500700070006f0072007400260079003d0047007500650073007400260068003d00720062006d0077002e0063006300260070003d003800300034003100260073003d00630030003300320064006400330037002d0031003200640031002d0034006400350065002d0039003300620038002d0061003100370034003400640039003000640039006300360026006b003d0042006700490041004100410043006b00410041004200530055003000450078004100410067004100410041004500410041005100420064004c004c00420055004b0068004b004b004e006a0070004e004b0073004e00750047006a007400390041005200520044004b00480071005200460078004d006b00340068006d006b0068003900540058004a0068004b0059004100620070004d006f006d005a0052004400670044002500320062006e00680063007400420067004900660057004200470058005700380041005a007a004e003900580074004a007000390079002500320062004c004d005900630065005900770052005800520076003800380025003200620044007a00370078004a00710033004500510072005500250032006200700047006c00500033005700370059007a0043007800520030005900320044006600590056003100430025003200660074005a00300059006d007200710048007a0053004500430039004a0042007400430054007100450059007100360033004b00620059005100740061004800690039004700590055006600510079002500320062004c0053004c00590071006f004300500057006700250032006600720068005600590056003000500035006c007200730030006900420078004300710030006e006d00510042004b00660053003700250032006200450070003600460037006100700069004c005500250032006200250032006600490030006500510056006e007700510071004e006b00560025003200620062004c004200350076006d00560061006f0035006300750055004e00780048004700510034002500320066003800340025003200620030006b0025003200660031004a0025003200620046004500530069007a0069006f006d004500450042006700710035003300740045004d00300064007800670045005900450057007000500042005a006500540038007a0070004b00450063006900580058005a006e005a0067004c00470036003200410051004f007a0061007800760048004c0058004900500025003200620058005a006500760063004300620061004200640056006300460076004f003100260072003d00260069003d0055006e007400690074006c0065006400250032003000530065007300730069006f006e000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0004_none_1cbe04a2ab6ffd98	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\lock!06000000c9bb580e90130000441000000000000000000000 = 30303030313339302c30316464316634373664626632363231	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236\HasRunBefore = 01	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 68747470733a2f2f72626d772e63633a393131332f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236\SubstructureCreated = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0004_none_1cbe04a2ab6ffd98\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\Files\ScreenConnect.WindowsBackstageShell.exe_89 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\Files\ScreenConnect.WindowsBackstageShell.exe.co = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d\DigestValue = 4b7f3832da8745d35314d29405637e0eefb88994	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d\implication!scre..tion_0000000000000000_0019.0004_76a = 68747470733a2f2f72626d772e63633a393131332f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\implication!scre..tion_0000000000000000_0019.0004_76a = 68747470733a2f2f72626d772e63633a393131332f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_76a526c08ba3dce1	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "CYGWHL0CV78M3DBRAVKG5DLW"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40\lock!0e000000c9bb580e90130000441000000000000000000000 = 30303030313339302c30316464316634373664626632363231	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\4BCD72OP.HM7\ZXB49N3A.WN7\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\CYGWHL0C.V78\M3DBRAVK.G5D\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3420	2026-07-29_9d1e380236434fbce89f0ca89605fd37_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	5008	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 5008	3420	2026-07-29_9d1e380236434fbce89f0ca89605fd37_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	86
PID 5008 wrote to memory of 2964	5008	dfsvc.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-29_9d1e380236434fbce89f0ca89605fd37_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_9d1e380236434fbce89f0ca89605fd37_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Users\Admin\AppData\Local\Apps\2.0\CYGWHL0C.V78\M3DBRAVK.G5D\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\CYGWHL0C.V78\M3DBRAVK.G5D\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:2964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\CYGWHL0C.V78\M3DBRAVK.G5D\manifests\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b.cdf-ms
Size 14KB
SHA256 755be0a965b590a551e6c574bfef071e96fee2ee4dfe8ac65094d67f8ec95678
MD5 667437aab879e7bd589fb272eb83ae9d
SHA1 7faa43f8f293a97607ee47e406afe206971adc8a
SHA512 864824266dd51b93076e19785813238c507ec9c1b00e972b0274d1e71acb205948d95686ea9183bf3c8302076d2a1d2655c47a2e0edf16dc1e8937bb5b120576
SSDEEP 192:xvgwHXpAkd4mT8GZD4XjlrererSrZIQGV67gqdEiG4:xHCkamT5ZC++aHEF4
TLSH
T1A362A711BBD5E832E2552733DCD6C3D47232BCE55F96035B70843B2EAD702D98A23695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\CYGWHL0C.V78\M3DBRAVK.G5D\manifests\scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40.cdf-ms
Size 3KB
SHA256 cdd6c7ac6c70bb752a1bce3f57609acd7bc03db9c8904fc4239125a2e97cb61a
MD5 b21553af14d2a2a8aacb77a6473bbb3e
SHA1 3c92ef7870e8b1b674cec5b24158f1227327d287
SHA512 cbc652c0e6a63a0ef343fffb3aa50a1095be7ee3ba380363da07541eef38cdf4b7fc92f2f09c2824d9db2551567c6851a8e05fa881377e0c347b23be2965b1f8
TLSH
T1FF6199027284DE57D9690233ACD1D2ED37757E83CF42430BB5C0BB2F7A312E69612291
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a843f70.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\CYGWHL0C.V78\M3DBRAVK.G5D\manifests\scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a843f70.cdf-ms
Size 5KB
SHA256 6d8cb5d0fafd6b008c73674cd2ee0a098735aba6585ebd4594df2695561bc25a
MD5 226ea1bf4ec717c11170c898b9630c85
SHA1 91c24805bd75a26a2e7c4a759776c240ffb8cdca
SHA512 a71daf9b45ca60387e186d3d4af80fc07846eac4ba7d4f8003188917054aef770c4d33f608a5d86b721ab0cd0cf237182433f8d698c74b72814ccdd8f4540554
SSDEEP 96:Q6fP+RxU9LlAAAAAAAYeV+Ww7mkLTWKmKQ+PDwlI5ngnsRgu:qRxUNuJiLTlmULXQdu
TLSH
T1D9B11E11B344DA13D4BD06336CA5E2DD2B783E93CE82260B70C87F6F76322E647212A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\CYGWHL0C.V78\M3DBRAVK.G5D\manifests\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d.cdf-ms
Size 6KB
SHA256 49540f3b641b7b754a1ea4ecaa930137df8e68789d23ba2e7a05cd15b9a7be79
MD5 49e688b4440515bd5f5dd9e09439ae0d
SHA1 0a801497eb773cb0897e4a8b82c612b552f596b2
SHA512 05d0fcd01099937fe8b712a190f6c95b14934a32a9932544fbd4808f749100e1deee8342743375ca85e5e9fed8cb19319e41694e5e7729fbb938a6d68c5bc44b
SSDEEP 96:rjkhWhDM5yAAAAAAAAAAqeV+WwwU8WbOr2WAvgoG6v+WaOoMMnsVoeiw:EAZMqJwblaZN3s6w
TLSH
T1CFD123127290EE16D1A90633ACDAE2DD32767E96DF43430B70C4BB2F7B322E60612195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\CYGWHL0C.V78\M3DBRAVK.G5D\manifests\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244.cdf-ms
Size 2KB
SHA256 c70bdcf5a820cc7e71b9606c37d186a3048c913f6a39836ab142b64ea2224b60
MD5 3f3fd38d59cdf82964351a623e7c5aff
SHA1 f2f840d35aaaedd2064390d032821cc2eacede24
SHA512 8da8ede892a1266146fbf5142aba482b12c3eed0d07efdcee93d06491a7e41832069c7afed051cec6197266cc014a2a5a5c610e57cb863dea5cfbb12f9902b9e
TLSH
T1525179053784EA67D66A0633ECD1D6D932367E87DF460317B190BB7F3A312D58A121A2
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_0019.0004_none_1cbe04a2ab6ffd98.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\CYGWHL0C.V78\M3DBRAVK.G5D\manifests\scre..tion_0000000000000000_0019.0004_none_1cbe04a2ab6ffd98.cdf-ms
Size 4KB
SHA256 e066828ba378cccf6f323b7d7bf10e6691be8bd29f6a66d3f4961906e8199eef
MD5 c1d0337df59eeaaa1811cf982c448437
SHA1 adcfeb6c8a9583ea37599c8165e4f04cf2310d1f
SHA512 4cd7468c50c3f83ae8ce725be75fc5bffe204364dbddf333160afd6d2927e5a4d35b164c6f0b2ea2090e78640c9daa09c3e9a8ecc0f14db6d7cfdaba1e53a903
SSDEEP 96:Z+a+rAtEW0m5R/8UmPkEQK1m9mL+dxH/s:oGVA98aEuC0
TLSH
T126813040B780E823E6145732ACE2D2C073357DA64FEB570F70987B2EAD367C69722265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\CYGWHL0C.V78\M3DBRAVK.G5D\manifests\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab.cdf-ms
Size 4KB
SHA256 f56ddde575a4f9cc2309ab949386f67a80feeab1b36dfe8137624cbd7c9c479a
MD5 f7f8a25d2c1db286573a9b245311f6e4
SHA1 202d05c1714c1df3fa270f5f20a5715095315b60
SHA512 a257b3d3c8b449d2890349f1d225e41389fc7eb86ad1e88e2c00a1b10434f2df72c84c8bd33f414700ec49a1ed61088da0ffbea7e60674c89db8c30a59001411
SSDEEP 96:guGLqAAAAA3eV+Ww8U45uEC0W6Np+Ahx1+8nDvUf:dJjuEQ6p59DM
TLSH
T13691FA017281ED66D5A406339C96C2CD3A347D82DE82060BB1C07F3FB6306E65B211A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\CYGWHL0C.V78\M3DBRAVK.G5D\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\ScreenConnect.ClientService.exe
Size 93KB
SHA256 bc0b03a340d46c23a4a2f91ebd7ed4d0fcf92fc7c4323f522c86369ad483f68a
MD5 01670513447f464926e6d2c74f529162
SHA1 22627141ffec9b9317b49ca95ac9b27aa5b79ee2
SHA512 e6747fb124f5e8e3361d723cce10a1626572682b19d713278e6081611e2f55c4ee5a0680cf96cd4cfd31759fef676c242bc133677222ccd682c6d04085291388
SSDEEP 1536:jg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg0T0HMa7r/Q:MhbNDxZGXfdHrX7rAc6myJkg0T0HhHo
TLSH
T1C1935A13B5C28872D473093158E0DAB49A3FF9615E21DEAB3798022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\CYGWHL0C.V78\M3DBRAVK.G5D\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236\ScreenConnect.WindowsClient.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4BCD72OP.HM7\ZXB49N3A.WN7\ScreenConnect.Client.dll
Size 228KB
SHA256 9507c29ca92f850426ba5a05647214f3f6e408853a2baef97892db5f7e974a55
MD5 db64c607261db6c29852fbb235df5d44
SHA1 ef1aa54cd6a09f178eb0fe006908099bde860f86
SHA512 6710ab02207e5abc9f6f9a343894dfe654fa00aedf879759997528582011bfe7c1135896fd4f86584063913e33704c54d020b451b08616bbbb56112919fb7ac5
SSDEEP 3072:xNYrrhDXQePbEIG2hsNVFJRCcyzv5qnn44O9BexzNzn42zDvJXYd/HT:wrtD1bsI4Jjeqnng+Zz42GZ
TLSH
T1C8347F4633A64C65FBEF0AFBB49091248A72ED056153E76E8D0479FA1DB378283507E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4BCD72OP.HM7\ZXB49N3A.WN7\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 abedad01322bc77aaecf0e58331298f62daff9937666265931efc7995e7aa890
MD5 cb59fbfe2c4b0db2feab82b39bb41d4e
SHA1 4144d072fbd1495b70d2412d6cee9c7010bfcefd
SHA512 f1775552d4b3eb070d226db4b7e6ca17def881bc5b78dd44817426454156ad874d4efafa3cb39e9b81353efe87942c0d41b00980e33fecc80cb993ecb2acf9ae
TLSH
T108117B0181C8FA261F3341D1BEE7E021976D5B33048D194BB06968AF8F3DAE683471B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4BCD72OP.HM7\ZXB49N3A.WN7\ScreenConnect.ClientService.dll
Size 78KB
SHA256 81d06d6f5c4dcca630d5001425566ab976e222082612f96dfc99078f585139ed
MD5 4aaa3056c5af955a0a8c233869d7291f
SHA1 b373544d77580000e73dd09c7ef3c53a65d747de
SHA512 f0ae365f3ee4cae565dfbbbbdbe66631c12a1e381ef642bf29420366e58f7819cafc3c580a4dd7bb2e465fad7234c715927cee621cf88bcafcbb57145a770e2f
SSDEEP 1536:sOZLd94e+JBm+Xfi/N7t2DEPVQXV3lk9OIb5M7rbm:sEgtxPantQXV2hMHi
TLSH
T18E736D12A3BC8A26CDDF4E7874A1B0450F719A41D4A6FBD89DC9A4EE5F523C13A043DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4BCD72OP.HM7\ZXB49N3A.WN7\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 97a3af25bfd040d4b7c09d39137024e3054db3e3ffc6d70c48c8e037bc7d28de
MD5 adc9c617ac3026a6947fdf12027f9144
SHA1 6c4c468e7457e446cb9ede02348342d07df41eb8
SHA512 809c19fb85b74764cd0e6d50e6ee5620e170e24b3340c30c463dd81ae2ab69a4e85949dcd5ccdcb845112359ee9efe53a049aa62f78c95bd8148cd1e2809e106
TLSH
T15A31E90641C4FA251F3301C1BEE7E061975D5B33158E194B706959AB8F3DAA6434B173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4BCD72OP.HM7\ZXB49N3A.WN7\ScreenConnect.Core.dll
Size 552KB
SHA256 dc3168bfff8b8bffb36f4374da4dfce8a96786a632eb6bdb666099fc0cf16a54
MD5 d7c08ace02be7766ca7c7cd2db3f092c
SHA1 c458f768008fcf3cea1f683665a14f049aaf0da1
SHA512 e7370785050c9cb4772fd0e15f9af11b00b90b812226689603c2f44f93af220bd9a638e440935e284739220e1232993de07f264d5b2505bce8b35345168fca1b
SSDEEP 6144:ZTc03YqaaDUy3dX19jcjxrvm7zh7LZP8UllEDOb6E9GI7Ar1nb2q/QSeDTax4k4J:ZTeqafoFYkPJuolEDOuE9GWKb2IiXh/
TLSH
T164C48F11B394B66AC6BF0B37E0A084151730ED08710AE76759A4D4E83F6278F6E49EF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4BCD72OP.HM7\ZXB49N3A.WN7\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 701043b60905f164f8c7eacbe72a8738948409475263bc331711895950a4edc0
MD5 dfc5114133b3b1356aed7daeb3386c6a
SHA1 ac875bebb46228d56ca4f48e64a165229e0d8aea
SHA512 6d76465e8a60678f5e4cdfc7141aa00a46f63b1384aa447d6b0350c3632f920c6b70966da3d02dcf5a073893a1edf876e1d7aec550d11bd5782f6d3d90561f03
TLSH
T10121670181C8FA261F3302D2BEE7E421979E5B33188D194B7469689FCB2DAD64747173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4BCD72OP.HM7\ZXB49N3A.WN7\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 ff82ff2c60cebea3eb57b9d50e5ac1653009ff781d288f4b4b0c3578b2aefd30
MD5 70c1afe03b8e1787c55301c4e40a4524
SHA1 6d4f89426b36cba739ac87a116308a133ab4343f
SHA512 71f50772c6ef48fa01bbdb1c6272ab087664f77c1ae2805c30c55a9100c9de09c4b6ac00fd77bacb14b8ef3f48dc8a5d959ce3537de488e60afa99cba3fedc78
SSDEEP 24576:B5phFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTE:nphJkGYYpT0+TFiH7efPJ
TLSH
T11D85AD41E2C369F5D46B047888BF572AAA747C080324CAFB97D4BE356D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4BCD72OP.HM7\ZXB49N3A.WN7\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 22a7184049b2294a26e2ae97f1e52a45dae7e375bd40bcef82d28afb76628549
MD5 e7e3aeee640f9090fbf05eddbd147a95
SHA1 4ee7cb637008e348d72f8adc46a86893eb715b2e
SHA512 3f911ff1fab3935405ded38be4b7570e7e495f7595b2196013df2957a42f57065606fe74bde96256cdd3fa32f1a074c701fd044568de2ad33415402d2328b1e9
TLSH
T18F41F31281C8FA250F3301C27EEBE431879E5733158E190B74A9A99BCF29AD74747177
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4BCD72OP.HM7\ZXB49N3A.WN7\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 6cb34f11581e157628118bf39adc1effdc92ef81043632ad9f6b7952b85fb1eb
MD5 5291b601616078582e4448dd8f0dd03d
SHA1 734146fafa922d6fdf9adebe76b05d8747c71784
SHA512 b663aa83b020ecf0990dc2e6c28bdde5ae88f0e7fba93bbbb87420ce8add29ebb8e4845ae2bb9d5b4009edbc7de97bd4c71cdd9495a585e1496548a6a20836aa
SSDEEP 1536:hoSOs/MRZFe9aGhDvmDTyQX5E+TC7tih2syGbXe7rN:hoTsCZFe99myQOKDeH
TLSH
T1EC537D4163E84619C9FF2E7DB9F2A1141EB0AA438441DBAE0DCD65EA1E537816F203F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4BCD72OP.HM7\ZXB49N3A.WN7\ScreenConnect.WindowsClient.exe
Size 599KB
SHA256 0fcf040e7c627085146cbe9ca77bc61d2dec0eacc500651fd2b02f76387a0c2e
MD5 b35a60a49d6b334ab27104e72d011661
SHA1 4b7f3832da8745d35314d29405637e0eefb88994
SHA512 f4512a1e06bed58f324640d160940118df72be916e7deae095084122d2f374126dcda438e6078aafab8347df4dca6d21dd88a6c50ae862fbed57fdb08171f297
SSDEEP 12288:tdqgkJ1ws1YGO711SxLBr+b/SCNv9h+si:61Yd1ExLQb/NtSsi
TLSH
T12BD45C22737CDE7BC8AF0779A0B118245FB0F819A285E35E4954A5E90F8738A5E443F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4BCD72OP.HM7\ZXB49N3A.WN7\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4BCD72OP.HM7\ZXB49N3A.WN7\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 aface8e8210443e62021751699279663bed2007af7a86d905f2ec7ba5dfc6ffe
MD5 54e4e4a218ca37ef40fe7a66eff9169c
SHA1 6356b3e9a4b105b93fdb0f26ca6992149ceeba1d
SHA512 9060ed3ed281f8eb08efdf7fbceebf6b5e6b03c3328c8336b67185a6dece723eefba3f969341be014682fb728aabc2e7199d9cc8259c0bebef6a7be71fda6cfa
TLSH
T1CD51D41641C8FA210F3301C1BEEBE471979E5B32158E190B7099999FCF2DAA7474B177
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4BCD72OP.HM7\ZXB49N3A.WN7\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 360f2c32f1675fd92ea4895693de10e849cf36b21f7c9952d6af4e7090cd8421
MD5 283b73cc24c8b64544a19a0212f12f0c
SHA1 8aaf1107de02e0190a4ea0dd4e4ed05808e3df85
SHA512 54fda7d41a7ce92ee47d12ba99e6a1f43e27b6165105cf77e9d31743cc0a2f708f3d474fd13d1f42167353c4c5a7a2ebe9325f1e172f9a0f1a67df8a2ce4f370
SSDEEP 96:xWLwOhoyTvJe2wvyAkodkYkFk8kwvkpdykG4kOpQkOpXyk2AkOpD:oRReYo+d2pbpd7G9UFUX72VUD
TLSH
T192F1BC9684C0BD21573291C0FEE39924BD057F2302BE148ABC4D19BF9F765899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4BCD72OP.HM7\ZXB49N3A.WN7\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 14525dd6476e98c5746aefc3386768c2320d3ed802e638ad1ff49dabb983229b
MD5 fef4bfd6bdb04cbe2e2a860be8485a90
SHA1 0bbed282196b5d8dd22e327ee1c4c593b3d9f064
SHA512 f38e6cdadca4b57584c450d4662489a5fa4fbd9b612e2305c19cc7a9f3c5b9228a6b50340a03fcc6ca7f35daf61e478c2daca4032cfa40990d332c99429e9553
SSDEEP 1536:Ntyil44BzbRCI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC70t7re:OcSukLdwtH
TLSH
T17483F68235762631DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9GEJNE2A.ZT4.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\DQ8233YA.DVV\9GEJNE2A.ZT4.application
Size 93KB
SHA256 6ea3e7e4148fc6b4fcc59ce9abed72247b822a6ffebba6383d623729d45c0267
MD5 1fced0998dbf1f609eaaea7526202b56
SHA1 5624b63fed9cdfa3e8936058449c557d03802b36
SHA512 b2745812745c6f36e54e8da8baf280d4859d705682a65349e21cafd665e0e6af3958af0700ec9510cc1e1d75f727b6bafd0ff207cfc6b0b23cfde1de5a1122f4
SSDEEP 1536:pkp63XmAmki10M5n76+8rJsZckAGSZNVNzWJJ29ymy:pr32AiqM5n76+syMVN6K9ymy
TLSH
T13093413A8E30F4C0477DB021D1A52D673D812B93DB730BACD90A186B0E69796EF5E65C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2964-336-0x0000000000540000-0x00000000005DA000-memory.dmp

Download

memory/2964-354-0x0000000002800000-0x0000000002818000-memory.dmp

Download

memory/3420-12-0x0000000005330000-0x0000000005340000-memory.dmp

Download

memory/3420-9-0x0000000005EA0000-0x000000000604E000-memory.dmp

Download

memory/3420-1-0x0000000002AC0000-0x0000000002AC8000-memory.dmp

Download

memory/3420-2-0x0000000005330000-0x0000000005340000-memory.dmp

Download

memory/3420-3-0x0000000002C70000-0x0000000002C78000-memory.dmp

Download

memory/3420-4-0x0000000005250000-0x00000000052DE000-memory.dmp

Download

memory/3420-5-0x00000000052E0000-0x0000000005304000-memory.dmp

Download

memory/3420-6-0x00000000058F0000-0x0000000005E94000-memory.dmp

Download

memory/3420-7-0x0000000005420000-0x00000000054B2000-memory.dmp

Download

memory/3420-0-0x0000000005330000-0x0000000005340000-memory.dmp

Download

memory/3420-8-0x0000000005330000-0x0000000005340000-memory.dmp

Download

memory/5008-24-0x00000238A1F30000-0x00000238A1F40000-memory.dmp

Download

memory/5008-10-0x00000238A1AC0000-0x00000238A1AC8000-memory.dmp

Download

memory/5008-11-0x00000238BC190000-0x00000238BC316000-memory.dmp

Download

memory/5008-14-0x00000238A1F30000-0x00000238A1F40000-memory.dmp

Download

memory/5008-23-0x00000238BCF20000-0x00000238BCF70000-memory.dmp

Download

memory/5008-58-0x00000238BCEF0000-0x00000238BCF08000-memory.dmp

Download

memory/5008-34-0x00000238C0710000-0x00000238C08BE000-memory.dmp

Download

memory/5008-314-0x00000238A1F30000-0x00000238A1F40000-memory.dmp

Download

memory/5008-40-0x00000238C0270000-0x00000238C02AE000-memory.dmp

Download

memory/5008-46-0x00000238C0450000-0x00000238C04EA000-memory.dmp

Download

memory/5008-52-0x00000238C0440000-0x00000238C04CE000-memory.dmp

Download

memory/5008-355-0x00000238A1F30000-0x00000238A1F40000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads