93e913cff39ed5f3802a0af4bb90f50cf6ac63497f763927e6ab1bf918c2ac2e

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_9d1e380236434fbce89f0ca89605fd37_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 2.4MB
Sample260729-mtq4cstyfs
SHA256 93e913cff39ed5f3802a0af4bb90f50cf6ac63497f763927e6ab1bf918c2ac2e
MD5 9d1e380236434fbce89f0ca89605fd37
SHA1 ab2b1277311264c541bc119cfdae8d9ce922b97e
SHA512 62051f5329397e88de89e701fcde4427ce95af5128ba84464fc63ba4b03dba2e62dd56f4dc8abaf880da94f345b34ee39db8c7991d68e3730055c701ffdf6936
SSDEEP 24576:QjubA9DS2XINpgFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiHf:CDupgJkGYYpT0+TFiH7efP0Q97Ah
TLSH
T127C5AD01F3D265F5C46F0A3884BA421AA774BC081315DBFB56D4A9A93E337C05E36BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
5	4104	dfsvc.exe
5	4104	dfsvc.exe
5	4104	dfsvc.exe
5	4104	dfsvc.exe
5	4104	dfsvc.exe
5	4104	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
4936	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\ZVTR7XA2.5EM\HEVA8Y1E.BMN\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_9d1e380236434fbce89f0ca89605fd37_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236\HasRunBefore = 01	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a843f70\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a843f70\lock!0a0000001a50590e08100000101300000000000000000000 = 30303030313030382c30316464316634373665366434663262	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 680074007400700073003a002f002f00720062006d0077002e00630063003a0039003100310033002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006d0061006e00690066006500730074000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\Files\ScreenConnect.WindowsBackstageShell.exe_89 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0004_none_1cbe04a2ab6ffd98	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236\scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236\lock!1d0000008151590e48130000d81100000000000000000000b824a = 30303030313334382c30316464316634373735383633643336	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0004_76a526c08ba3dce1\appid = 68747470733a2f2f72626d772e63633a393131332f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb527	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab\SizeOfStronglyNamedComponent = c84f010000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236\identity = 68747470733a2f2f72626d772e63633a393131332f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a843f70	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\lock!01000000304f590e08100000101300000000000000000000 = 30303030313030382c30316464316634373665366434663262	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 680074007400700073003a002f002f00720062006d0077002e00630063003a0039003100310033002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320035002e0034002e00320035002e0039003300310033002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320035002e0034002e00320035002e0039003300310033002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e00330032000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab\implication!scre..tion_0000000000000000_0019.0004_76a = 68747470733a2f2f72626d772e63633a393131332f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d\implication!scre..tion_0000000000000000_0019.0004_76a = 68747470733a2f2f72626d772e63633a393131332f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236\scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a	dfsvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\OnlineAppQuotaUsageEstimate = "3627427"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236\appid = 68747470733a2f2f72626d772e63633a393131332f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244\implication!scre..tion_0000000000000000_0019.0004_76a = 68747470733a2f2f72626d772e63633a393131332f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236\scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244\lock!060000007251590e48130000d81100000000000000000000 = 30303030313334382c30316464316634373735383633643336	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_b644749fd7435ff7	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236\implication!scre..tion_0000000000000000_0019.0004_76a526c0 = 68747470733a2f2f72626d772e63633a393131332f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\Files\ScreenConnect.WindowsFileManager.exe_0e21f = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab\Files\ScreenConnect.ClientService.dll_e781b1c636 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d\SizeOfStronglyNamedComponent = e17f090000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40\Files\ScreenConnect.Core.dll_b96889d378047e27 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0004_none_1cbe04a2ab6ffd98\lock!100000008151590e48130000d81100000000000000000000 = 30303030313334382c30316464316634373735383633643336	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_b644749fd7435ff7\LastRunVersion = 68747470733a2f2f72626d772e63633a393131332f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\implication!scre..tion_0000000000000000_0019.0004_76a = 68747470733a2f2f72626d772e63633a393131332f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\ZVTR7XA2.5EM\HEVA8Y1E.BMN\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\1NLWY8HT.B4J\107VXV4M.HA6\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2480	2026-07-29_9d1e380236434fbce89f0ca89605fd37_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	4104	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 4104	2480	2026-07-29_9d1e380236434fbce89f0ca89605fd37_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	89
PID 4104 wrote to memory of 4936	4104	dfsvc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-29_9d1e380236434fbce89f0ca89605fd37_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_9d1e380236434fbce89f0ca89605fd37_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Users\Admin\AppData\Local\Apps\2.0\1NLWY8HT.B4J\107VXV4M.HA6\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\1NLWY8HT.B4J\107VXV4M.HA6\scre..tion_0000000000000000_0019.0004_a63d8fc83db3f236\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:4936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1NLWY8HT.B4J\107VXV4M.HA6\manifests\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b.cdf-ms
Size 14KB
SHA256 003510a57291a256d120fa49f72f2d6f17b5b913e8eefc1c9f0756111dd73680
MD5 5bd8d75b4d0f93a64729f3001103ce57
SHA1 88800f52058406dec0f0378ff339953a9344d025
SHA512 3a61e4109b30799ad9f8fbe09cf2755c131f74ddb96d2395c9b385cf19ed239438da7d47e0fb2e592fa36af76efc5b6ac0152b311d4587d5b1aa2845a8e6a7e2
SSDEEP 192:xvgwHXpAkdErTdGZDZpDdYrerererSeZIQGV67gq/+iG4:xHCkdaT4ZVpDe+++TF+F4
TLSH
T1EC62A411FBD2E833E25517739C9AC3E47232BDE51F96135B30853B2EAD702D98A23685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1NLWY8HT.B4J\107VXV4M.HA6\manifests\scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40.cdf-ms
Size 3KB
SHA256 1e744a84c42f864b0aad42caee98a99c976c54b607435af746253b00f864ccbe
MD5 92f7d9b741fb889581bf790569edb3dc
SHA1 445295619f71c91725db8097be9ee467e024a5d5
SHA512 69f2b8a172f3357456af3e9ebb9474bf2045386ffa4529babebae849281199b7a28d050a1916286136395cfdcee294406f787cdb69d67460d90d4d29e7c970bb
TLSH
T14F61C9027604DA17D9A90633ACE1D2EE2B743E83CF81860F74C47F2F7A322B656112A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a843f70.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1NLWY8HT.B4J\107VXV4M.HA6\manifests\scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a843f70.cdf-ms
Size 5KB
SHA256 21f7d269d01ed0665190a24880b2d853187149ad8f0b8648a4105c63535fad1e
MD5 56b805a99498aee8a763a069996865a9
SHA1 d752d86db3116f504be6ee1967715f6c071ac8c3
SHA512 3a0e8d15a19da47128658d6db9a2944a7e3b742b79681978e8960d2c2e7261c598a6cb0823e30a5659dbaa3f5fa619dc8448bda8702795c2f4e7f8162e912f6a
SSDEEP 96:g6fP+RxU9LTeV+Ww7mkVAR4OSVbvLCvFongnsRgu:aRxUNUJiVA5SVDQdu
TLSH
T1E6B18811B294DA27C5B90633ACD6D3DD27257E82CE42030B70D8BB6F7B322E64212195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1NLWY8HT.B4J\107VXV4M.HA6\manifests\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d.cdf-ms
Size 6KB
SHA256 52b6428666b82d8a3171bade038617c2a8375c4d91dcadd2ec6c497154e64b23
MD5 3d7416ca6e8ce7311d804d9e0efa8d10
SHA1 036c5a4d621cf4f7d91caa645c7af4be8fa2388f
SHA512 14845666459bc34c932958b014b7328cee1345724e01e7eb67add468faeec6d74badf5d4958d8d837e05f70b822d949d71f8f163386bfac0a7716aadb8debd24
SSDEEP 96:TjkhWhDM5leV+WwwU8WbzW2FAvg26v+W+xozOtnsVoeiw:cAZMMJwbXp+aK5s6w
TLSH
T12FD125127390EE17D1A90633ACDAD2DD32767E96DE43430B70C4BB2F7B322E61622095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1NLWY8HT.B4J\107VXV4M.HA6\manifests\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244.cdf-ms
Size 2KB
SHA256 10114216b8d24c89b6fa2647f0e99fd2b0e0c353052a4473409bfafa8f938ae1
MD5 645d6598d09a7c640d2e42f61ae8c4e4
SHA1 dd09b915379fe3e9c3a1836b0ccffe30c72aad80
SHA512 3c05f8d2a78311f25446fd2d9c1412fd591f27d25204edd4f306597159990044e152ca20beddfc0af500ebbf0aada8a47121bff180ea8a566524b55a7dd0b2bf
TLSH
T1AE5199057684EA67C66A0633ECD1C6D932317E82DF470307B0D0BB7F3B312D58A121A6
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_0019.0004_none_1cbe04a2ab6ffd98.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1NLWY8HT.B4J\107VXV4M.HA6\manifests\scre..tion_0000000000000000_0019.0004_none_1cbe04a2ab6ffd98.cdf-ms
Size 4KB
SHA256 e65c104d9a369bf73277ae23730cf7248591e62f33ff9880261552c40114e0ce
MD5 206253e58b9477ac1345343948545b27
SHA1 fd6d0d775e2551166535ea4c088b986cbf1b7436
SHA512 d14e3fde4fc845e095faadaa601b90c3692781a941143d64f67724ffff8324e7e01d94943bd5ee0c89edaf0428a9cf7df4f139658eb69758faa95a5a7d0347ef
SSDEEP 96:j+a+rAtEW0m5R/8UmPkHVYVROqmBXV4KOxL/s:q2VA98tqIlCA
TLSH
T178813040B740E823D6141732ACD2E2C033757DA24FEB570B34D87B3EAE367899722265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1NLWY8HT.B4J\107VXV4M.HA6\manifests\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab.cdf-ms
Size 4KB
SHA256 7ab4725e771e70f8f42c4327bc98eb1488c55a465e023fdcf0b7a246ff1e7558
MD5 ded6634db9e72c7c65b1679f710ad2a2
SHA1 bd98b75646563ed4c83f9cec37a4d2f548390bde
SHA512 8e310c4312cf475ee74e820958362b3af36207ad9fde54fe289265f967fe6976e31d48efe515154509da1135ea9eca4a3676ecf337b2f5cb3ded81c90d18c16e
SSDEEP 48:7GLCDVxldg7e6S+9ow87glW75uvW/vObV42cAvf1fTO5XnwAvUgA9f:7GLteV+Ww8U45u0O22cAvFTOtnDvUf
TLSH
T1AE916511B280ED66D6A90633DCD6C2DD3A367D82DF83070BB0C0BB2F76716DA5B12196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69WGEJZ9.PTE.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JW97TPQO.R7G\69WGEJZ9.PTE.application
Size 93KB
SHA256 6ea3e7e4148fc6b4fcc59ce9abed72247b822a6ffebba6383d623729d45c0267
MD5 1fced0998dbf1f609eaaea7526202b56
SHA1 5624b63fed9cdfa3e8936058449c557d03802b36
SHA512 b2745812745c6f36e54e8da8baf280d4859d705682a65349e21cafd665e0e6af3958af0700ec9510cc1e1d75f727b6bafd0ff207cfc6b0b23cfde1de5a1122f4
SSDEEP 1536:pkp63XmAmki10M5n76+8rJsZckAGSZNVNzWJJ29ymy:pr32AiqM5n76+syMVN6K9ymy
TLSH
T13093413A8E30F4C0477DB021D1A52D673D812B93DB730BACD90A186B0E69796EF5E65C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZVTR7XA2.5EM\HEVA8Y1E.BMN\ScreenConnect.Client.dll
Size 228KB
SHA256 9507c29ca92f850426ba5a05647214f3f6e408853a2baef97892db5f7e974a55
MD5 db64c607261db6c29852fbb235df5d44
SHA1 ef1aa54cd6a09f178eb0fe006908099bde860f86
SHA512 6710ab02207e5abc9f6f9a343894dfe654fa00aedf879759997528582011bfe7c1135896fd4f86584063913e33704c54d020b451b08616bbbb56112919fb7ac5
SSDEEP 3072:xNYrrhDXQePbEIG2hsNVFJRCcyzv5qnn44O9BexzNzn42zDvJXYd/HT:wrtD1bsI4Jjeqnng+Zz42GZ
TLSH
T1C8347F4633A64C65FBEF0AFBB49091248A72ED056153E76E8D0479FA1DB378283507E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZVTR7XA2.5EM\HEVA8Y1E.BMN\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 abedad01322bc77aaecf0e58331298f62daff9937666265931efc7995e7aa890
MD5 cb59fbfe2c4b0db2feab82b39bb41d4e
SHA1 4144d072fbd1495b70d2412d6cee9c7010bfcefd
SHA512 f1775552d4b3eb070d226db4b7e6ca17def881bc5b78dd44817426454156ad874d4efafa3cb39e9b81353efe87942c0d41b00980e33fecc80cb993ecb2acf9ae
TLSH
T108117B0181C8FA261F3341D1BEE7E021976D5B33048D194BB06968AF8F3DAE683471B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZVTR7XA2.5EM\HEVA8Y1E.BMN\ScreenConnect.ClientService.dll
Size 78KB
SHA256 81d06d6f5c4dcca630d5001425566ab976e222082612f96dfc99078f585139ed
MD5 4aaa3056c5af955a0a8c233869d7291f
SHA1 b373544d77580000e73dd09c7ef3c53a65d747de
SHA512 f0ae365f3ee4cae565dfbbbbdbe66631c12a1e381ef642bf29420366e58f7819cafc3c580a4dd7bb2e465fad7234c715927cee621cf88bcafcbb57145a770e2f
SSDEEP 1536:sOZLd94e+JBm+Xfi/N7t2DEPVQXV3lk9OIb5M7rbm:sEgtxPantQXV2hMHi
TLSH
T18E736D12A3BC8A26CDDF4E7874A1B0450F719A41D4A6FBD89DC9A4EE5F523C13A043DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZVTR7XA2.5EM\HEVA8Y1E.BMN\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 97a3af25bfd040d4b7c09d39137024e3054db3e3ffc6d70c48c8e037bc7d28de
MD5 adc9c617ac3026a6947fdf12027f9144
SHA1 6c4c468e7457e446cb9ede02348342d07df41eb8
SHA512 809c19fb85b74764cd0e6d50e6ee5620e170e24b3340c30c463dd81ae2ab69a4e85949dcd5ccdcb845112359ee9efe53a049aa62f78c95bd8148cd1e2809e106
TLSH
T15A31E90641C4FA251F3301C1BEE7E061975D5B33158E194B706959AB8F3DAA6434B173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZVTR7XA2.5EM\HEVA8Y1E.BMN\ScreenConnect.ClientService.exe
Size 93KB
SHA256 bc0b03a340d46c23a4a2f91ebd7ed4d0fcf92fc7c4323f522c86369ad483f68a
MD5 01670513447f464926e6d2c74f529162
SHA1 22627141ffec9b9317b49ca95ac9b27aa5b79ee2
SHA512 e6747fb124f5e8e3361d723cce10a1626572682b19d713278e6081611e2f55c4ee5a0680cf96cd4cfd31759fef676c242bc133677222ccd682c6d04085291388
SSDEEP 1536:jg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg0T0HMa7r/Q:MhbNDxZGXfdHrX7rAc6myJkg0T0HhHo
TLSH
T1C1935A13B5C28872D473093158E0DAB49A3FF9615E21DEAB3798022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZVTR7XA2.5EM\HEVA8Y1E.BMN\ScreenConnect.Core.dll
Size 552KB
SHA256 dc3168bfff8b8bffb36f4374da4dfce8a96786a632eb6bdb666099fc0cf16a54
MD5 d7c08ace02be7766ca7c7cd2db3f092c
SHA1 c458f768008fcf3cea1f683665a14f049aaf0da1
SHA512 e7370785050c9cb4772fd0e15f9af11b00b90b812226689603c2f44f93af220bd9a638e440935e284739220e1232993de07f264d5b2505bce8b35345168fca1b
SSDEEP 6144:ZTc03YqaaDUy3dX19jcjxrvm7zh7LZP8UllEDOb6E9GI7Ar1nb2q/QSeDTax4k4J:ZTeqafoFYkPJuolEDOuE9GWKb2IiXh/
TLSH
T164C48F11B394B66AC6BF0B37E0A084151730ED08710AE76759A4D4E83F6278F6E49EF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZVTR7XA2.5EM\HEVA8Y1E.BMN\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 701043b60905f164f8c7eacbe72a8738948409475263bc331711895950a4edc0
MD5 dfc5114133b3b1356aed7daeb3386c6a
SHA1 ac875bebb46228d56ca4f48e64a165229e0d8aea
SHA512 6d76465e8a60678f5e4cdfc7141aa00a46f63b1384aa447d6b0350c3632f920c6b70966da3d02dcf5a073893a1edf876e1d7aec550d11bd5782f6d3d90561f03
TLSH
T10121670181C8FA261F3302D2BEE7E421979E5B33188D194B7469689FCB2DAD64747173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZVTR7XA2.5EM\HEVA8Y1E.BMN\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 ff82ff2c60cebea3eb57b9d50e5ac1653009ff781d288f4b4b0c3578b2aefd30
MD5 70c1afe03b8e1787c55301c4e40a4524
SHA1 6d4f89426b36cba739ac87a116308a133ab4343f
SHA512 71f50772c6ef48fa01bbdb1c6272ab087664f77c1ae2805c30c55a9100c9de09c4b6ac00fd77bacb14b8ef3f48dc8a5d959ce3537de488e60afa99cba3fedc78
SSDEEP 24576:B5phFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTE:nphJkGYYpT0+TFiH7efPJ
TLSH
T11D85AD41E2C369F5D46B047888BF572AAA747C080324CAFB97D4BE356D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZVTR7XA2.5EM\HEVA8Y1E.BMN\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 22a7184049b2294a26e2ae97f1e52a45dae7e375bd40bcef82d28afb76628549
MD5 e7e3aeee640f9090fbf05eddbd147a95
SHA1 4ee7cb637008e348d72f8adc46a86893eb715b2e
SHA512 3f911ff1fab3935405ded38be4b7570e7e495f7595b2196013df2957a42f57065606fe74bde96256cdd3fa32f1a074c701fd044568de2ad33415402d2328b1e9
TLSH
T18F41F31281C8FA250F3301C27EEBE431879E5733158E190B74A9A99BCF29AD74747177
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZVTR7XA2.5EM\HEVA8Y1E.BMN\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 6cb34f11581e157628118bf39adc1effdc92ef81043632ad9f6b7952b85fb1eb
MD5 5291b601616078582e4448dd8f0dd03d
SHA1 734146fafa922d6fdf9adebe76b05d8747c71784
SHA512 b663aa83b020ecf0990dc2e6c28bdde5ae88f0e7fba93bbbb87420ce8add29ebb8e4845ae2bb9d5b4009edbc7de97bd4c71cdd9495a585e1496548a6a20836aa
SSDEEP 1536:hoSOs/MRZFe9aGhDvmDTyQX5E+TC7tih2syGbXe7rN:hoTsCZFe99myQOKDeH
TLSH
T1EC537D4163E84619C9FF2E7DB9F2A1141EB0AA438441DBAE0DCD65EA1E537816F203F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZVTR7XA2.5EM\HEVA8Y1E.BMN\ScreenConnect.WindowsClient.exe
Size 599KB
SHA256 0fcf040e7c627085146cbe9ca77bc61d2dec0eacc500651fd2b02f76387a0c2e
MD5 b35a60a49d6b334ab27104e72d011661
SHA1 4b7f3832da8745d35314d29405637e0eefb88994
SHA512 f4512a1e06bed58f324640d160940118df72be916e7deae095084122d2f374126dcda438e6078aafab8347df4dca6d21dd88a6c50ae862fbed57fdb08171f297
SSDEEP 12288:tdqgkJ1ws1YGO711SxLBr+b/SCNv9h+si:61Yd1ExLQb/NtSsi
TLSH
T12BD45C22737CDE7BC8AF0779A0B118245FB0F819A285E35E4954A5E90F8738A5E443F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZVTR7XA2.5EM\HEVA8Y1E.BMN\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZVTR7XA2.5EM\HEVA8Y1E.BMN\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 aface8e8210443e62021751699279663bed2007af7a86d905f2ec7ba5dfc6ffe
MD5 54e4e4a218ca37ef40fe7a66eff9169c
SHA1 6356b3e9a4b105b93fdb0f26ca6992149ceeba1d
SHA512 9060ed3ed281f8eb08efdf7fbceebf6b5e6b03c3328c8336b67185a6dece723eefba3f969341be014682fb728aabc2e7199d9cc8259c0bebef6a7be71fda6cfa
TLSH
T1CD51D41641C8FA210F3301C1BEEBE471979E5B32158E190B7099999FCF2DAA7474B177
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZVTR7XA2.5EM\HEVA8Y1E.BMN\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 360f2c32f1675fd92ea4895693de10e849cf36b21f7c9952d6af4e7090cd8421
MD5 283b73cc24c8b64544a19a0212f12f0c
SHA1 8aaf1107de02e0190a4ea0dd4e4ed05808e3df85
SHA512 54fda7d41a7ce92ee47d12ba99e6a1f43e27b6165105cf77e9d31743cc0a2f708f3d474fd13d1f42167353c4c5a7a2ebe9325f1e172f9a0f1a67df8a2ce4f370
SSDEEP 96:xWLwOhoyTvJe2wvyAkodkYkFk8kwvkpdykG4kOpQkOpXyk2AkOpD:oRReYo+d2pbpd7G9UFUX72VUD
TLSH
T192F1BC9684C0BD21573291C0FEE39924BD057F2302BE148ABC4D19BF9F765899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZVTR7XA2.5EM\HEVA8Y1E.BMN\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 14525dd6476e98c5746aefc3386768c2320d3ed802e638ad1ff49dabb983229b
MD5 fef4bfd6bdb04cbe2e2a860be8485a90
SHA1 0bbed282196b5d8dd22e327ee1c4c593b3d9f064
SHA512 f38e6cdadca4b57584c450d4662489a5fa4fbd9b612e2305c19cc7a9f3c5b9228a6b50340a03fcc6ca7f35daf61e478c2daca4032cfa40990d332c99429e9553
SSDEEP 1536:Ntyil44BzbRCI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC70t7re:OcSukLdwtH
TLSH
T17483F68235762631DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2480-11-0x0000000074422000-0x0000000074423000-memory.dmp

Download

memory/2480-1-0x0000000001570000-0x0000000001578000-memory.dmp

Download

memory/2480-2-0x0000000001590000-0x0000000001598000-memory.dmp

Download

memory/2480-3-0x0000000005480000-0x000000000550E000-memory.dmp

Download

memory/2480-4-0x0000000074410000-0x0000000074BCC000-memory.dmp

Download

memory/2480-5-0x0000000005510000-0x0000000005534000-memory.dmp

Download

memory/2480-0-0x0000000074422000-0x0000000074423000-memory.dmp

Download

memory/2480-6-0x0000000074410000-0x0000000074BCC000-memory.dmp

Download

memory/2480-18-0x0000000074410000-0x0000000074BCC000-memory.dmp

Download

memory/2480-7-0x0000000005B80000-0x000000000613A000-memory.dmp

Download

memory/2480-8-0x0000000074410000-0x0000000074BCC000-memory.dmp

Download

memory/2480-9-0x0000000005660000-0x00000000056F2000-memory.dmp

Download

memory/2480-10-0x00000000058E0000-0x0000000005A8E000-memory.dmp

Download

memory/2480-14-0x0000000074410000-0x0000000074BCC000-memory.dmp

Download

memory/4104-52-0x0000021FEFB60000-0x0000021FEFB9E000-memory.dmp

Download

memory/4104-23-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4104-70-0x0000021FEF6B0000-0x0000021FEF6C8000-memory.dmp

Download

memory/4104-13-0x0000021FEB1A0000-0x0000021FEB328000-memory.dmp

Download

memory/4104-20-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4104-12-0x0000021FD0AC0000-0x0000021FD0AC8000-memory.dmp

Download

memory/4104-19-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4104-64-0x0000021FEFCF0000-0x0000021FEFD7E000-memory.dmp

Download

memory/4104-22-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4104-17-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4104-58-0x0000021FEFD00000-0x0000021FEFD9A000-memory.dmp

Download

memory/4104-21-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4104-16-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4104-15-0x00007FF844B9F000-0x00007FF844BA0000-memory.dmp

Download

memory/4104-46-0x0000021FEFFC0000-0x0000021FF016E000-memory.dmp

Download

memory/4104-36-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4104-35-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4104-34-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4104-33-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4104-32-0x0000021FEF9D0000-0x0000021FEFA20000-memory.dmp

Download

memory/4104-304-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4104-303-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4936-302-0x00000000033D0000-0x00000000033E8000-memory.dmp

Download

memory/4936-288-0x0000000000F50000-0x0000000000FEA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads