9645275ee0951f572268d5570b8e7b80f84a5c22de7486e9d780b0b3705e44a0

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 08:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_002e7a458791e327290ad744c5eb1743_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 2.4MB
Sample260909-kbjv8adn21
SHA256 9645275ee0951f572268d5570b8e7b80f84a5c22de7486e9d780b0b3705e44a0
MD5 002e7a458791e327290ad744c5eb1743
SHA1 8f68b673ef93ebed7b81558685706e27212867f1
SHA512 e5631241a131847a9a686cc5aad7cab0e850f948d22cfd4ae116758003912883ea854e0e6e46f7410b9f222516e0e9dd1a3a355558ee03be181a4bb0e18814bd
SSDEEP 24576:lrWg44vFOEznjdp4Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFN:hWWjpp4JkGYYpT0+TFiH7efPkQ98ze
TLSH
T165C5AD02F3D656B5C47F067898BA521AA770BC081315CBFB56D4A9793E337C08E367A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
11	4548	dfsvc.exe
11	4548	dfsvc.exe
11	4548	dfsvc.exe
11	4548	dfsvc.exe
11	4548	dfsvc.exe
11	4548	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
5080	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\WPK031VN.GNW\4N2RREC5.9NN\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_002e7a458791e327290ad744c5eb1743_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669\lock!0c0000001b97580ed8130000940f0000000000000000000 = 30303030313364382c30316464343033346436353561383261	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_961dce6c950e9006\pin!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\Files\ScreenConnect.ClientService.exe_e781b1ee3 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\SizeOfStronglyNamedComponent = f31a190000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\lock!01000000d592580ec411000008080000000000000000000 = 30303030313163342c30316464343033346366383932323130	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 680074007400700073003a002f002f0073007500700070006f00720074002e007600690072007400750061006c00690074002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e003f0065003d0053007500700070006f0072007400260079003d0047007500650073007400260068003d0073007500700070006f00720074002e007600690072007400750061006c00690074002e0063006f006d00260070003d003800300034003100260073003d00330061006100650035006400360034002d0066003600300031002d0034006500340030002d0061003400650063002d0033003900380035006100380037003400630031006300330026006b003d0042006700490041004100410043006b0041004100420053005500300045007800410041006700410041004100450041004100510041004c004d004d0071006f006a0038006b004d00710054004f0034004f004900750062006f0039006b004c00360076003300750054007900510037006f006f0045007100560041005000450036006100450057004c00740031004700610070005700750050004900710059004d0068005a004800590066005600460045006c00610067005a0041004c006e0061005900430061004f0056006e006800380038005a0045006700430034004b006100390057004300730073006e00510065006c0067006a00690062006d00470077004d00460047004f0070005a00610079006b003400370025003200620043007600650077005a006b006100340039004b0062004d0072004600310053003000570077006c0030004600570025003200620049007800630074005a006600460051004700580055006d0049006e00430079006a0030004f005000690036003100500077007600710069006500380077004600780062003900680036004a0047005a0049006d004c0052006500610065005600510056004b0069007a0033004d0069007a00250032006600250032006600720078006500350061006b004e0070006400620057002500320066006c004b0056006700250032006200580055006a0048005a0036006c0069003200560030004900790025003200620044006700740066005300660034004d004600410067006a00560034007500530047005100700030006e00620049006b00370045007200480031003200340079006c00460044005a007000490074007800640057007a0073006c0051006d006e00380036006f00740036004600610058007000630058003100420064003300730072003100660079006300560048002500320066006a00390057005800670038004800760061007300610078005200250032006600440032006b00590070006b00550070006b00780053004900750030006d0035006b00350075006f00440071002500320062007300350033004300260072003d00260069003d004c00430041000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_961dce6c950e9006\scre...exe_0000000000000000_001a.0006_none_5d04069fb	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\scre..ient_420d02d3849b7992_001a.0006_none_98b7888ed = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d\lock!08000000de93580ec411000008080000000000000000000 = 30303030313163342c30316464343033346366383932323130	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_0000000000000 = 68747470733a2f2f737570706f72742e7669727475616c69742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\Files\ScreenConnect.WindowsBackstageShell.exe.c = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "EDEKOC80Z9WCM3724EMTZ26C"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 0000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\DigestValue = bd93fe00076b27b18cefe634ff0bc86463d4b667	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\Files\ScreenConnect.Windows.dll_fc0d83aff7df0b5 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b\lock!100000002a97580ed8130000940f0000000000000000000 = 30303030313364382c30316464343033346436353561383261	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\SizeOfStronglyNamedComponent = 09c7050000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\lock!06000000de93580ec411000008080000000000000000000 = 30303030313163342c30316464343033346366383932323130	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\lock!080000001b97580ed8130000940f0000000000000000000 = 30303030313364382c30316464343033346436353561383261	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b\implication!scre..tion_0000000000000000_001a.0006_96 = 68747470733a2f2f737570706f72742e7669727475616c69742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\Files\ScreenConnect.WindowsFileManager.exe_0e21 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4\SizeOfStronglyNamedComponent = 4b0a030000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\lock!120000002a97580ed8130000940f0000000000000000000 = 30303030313364382c30316464343033346436353561383261	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d\Files\ScreenConnect.Client.dll_fc1d7bd48553fcab = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_961dce6c950e9006	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\Files\ScreenConnect.WindowsFileManager.exe.conf = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\scre..ient_420d02d3849b7992_001a.0006_none_98b7888ed	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "47K48DJ6MO69D2GTDTPGD6AV"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 30000000	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\WPK031VN.GNW\4N2RREC5.9NN\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\47K48DJ6.MO6\9D2GTDTP.GD6\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2504	2026-09-07_002e7a458791e327290ad744c5eb1743_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	4548	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 4548	2504	2026-09-07_002e7a458791e327290ad744c5eb1743_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	84
PID 4548 wrote to memory of 5080	4548	dfsvc.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-09-07_002e7a458791e327290ad744c5eb1743_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_002e7a458791e327290ad744c5eb1743_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Users\Admin\AppData\Local\Apps\2.0\47K48DJ6.MO6\9D2GTDTP.GD6\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\47K48DJ6.MO6\9D2GTDTP.GD6\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:5080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\47K48DJ6.MO6\9D2GTDTP.GD6\manifests\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e.cdf-ms
Size 14KB
SHA256 fa56dd2ad4849f38a22d668198ed0dbfedc35b8afdc1846b45e863baba56b1c8
MD5 d5a1cebbd01a6ea07ff6a94051f1e86c
SHA1 d0c2341f5eede674feb3f74bdb2f4b3deafb3b59
SHA512 37e7fa553b8b765fbdf7f3a757465a51c016fbf8234cd57d4225cd0b26fa73f928d36769b5b1f9dfb54cb06e1f0c0cf6258d8c3205da867697674c299a6bbf72
SSDEEP 384:1Qrmh6Y/dvNYNYoIoIoIoIoIoIoIoIoIoIoIoIoIoIoIoIoIoIoIoIoIoIoIoIoa:1QfcFYH4
TLSH
T14562A411B791E932E25517339CA6C3D47232BDA55EA7135B38843B3EBC312C94B226E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\47K48DJ6.MO6\9D2GTDTP.GD6\manifests\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669.cdf-ms
Size 3KB
SHA256 eb05407968ae20191fb7d96ef5a792ae7aab8f9fdd5b6161dc998f5209880a8e
MD5 7253f5d68efcb507a2a883d027ef42ef
SHA1 382e22107522bf50f8afb6d264662f2651fdb492
SHA512 e3521e480688661a2f1bb4d3e1bba8a243ff87dd3899f3dcf548025da4b63e0cedaa57ce2d6c3afaabe125218fb6257a6984989595b2056497bb6d81a27cc0b0
TLSH
T17961DB017644EE13D9690633ACD6D2ED23747E83DF42920B74C0BF2F79722F69621295
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\47K48DJ6.MO6\9D2GTDTP.GD6\manifests\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999.cdf-ms
Size 5KB
SHA256 93adad4ccde4311ef0db031fb7ae1dc120d299211894e3cd5edd3e64aedffc75
MD5 4f53508992c6cd8e819e0be2b2e00f96
SHA1 f1d34ead583aa9c2adbbe99f5c1aed6e8f2ade84
SHA512 468b5b105cc8644602f9677a4d7956b90f5b8d34373b94b80afe8d095cd4a04a05d80ad94c63a97b082de57b39dd4c9f782a2c1d9b24f94563294bb6b7af0f25
SSDEEP 96:4BW+RzgtheV+Ww7OLFIuJPlVUX3kkAcv59wimdR:YRzgkJfauTKUkpe
TLSH
T183B142117290DD1BD5B90633AC96C3ED2A36BE93DE03030B70D4BB1FBA326D65222095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\47K48DJ6.MO6\9D2GTDTP.GD6\manifests\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976.cdf-ms
Size 7KB
SHA256 f56d08ce5b568670533e1bdf581a863d1c6cf459b8e9f590913a0e2cdbf6248a
MD5 8cd1fefe30c3815532f3e6c2718b0c9e
SHA1 a5e40e4a2ec424a6732ddfa1c55e2141666192c6
SHA512 5847c09cb7515030f24103ef43fa3db4607b309cb9b78a48ee484213596839887bcbfb88e50c890b9d473cd174c82b73bd8a77382277e7c237ad998581531c17
SSDEEP 96:qEjOONY6gnxfq4BqeV+WwwOL586q+/z702D6WJfdmVJeu7vVCk8mhxyBOxlsx9kz:AvnJDBlJ4lqs7HD6WNdyLVCCxyBy2Kz
TLSH
T160F11E22B301D523E5FA4B325CB3C3CD2B687DA7CD52510BB0C07B6F697225797252A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\47K48DJ6.MO6\9D2GTDTP.GD6\manifests\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d.cdf-ms
Size 2KB
SHA256 57d45592796d32b45ac9c6be66d9a1daa42bf8fdbbc91ae80178e0597237ae9a
MD5 32e8af885379e7681a874911004a14b4
SHA1 4e128d20e9dad5e3327178b02ff9bc5cf9c6847f
SHA512 b1cef436f8f98ab2bbda985fae9e3992319cbefaa6c3e84a85b98a0085e88c18b32aefe4c019a3ce6d8d2256c44274821271a842302277704569ac0633f1664a
TLSH
T1A55179057684EA67E57A0233EC92D2D933357E83EF07031BB190BB7F3A716C65612096
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\47K48DJ6.MO6\9D2GTDTP.GD6\manifests\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b.cdf-ms
Size 4KB
SHA256 5ca179550aaf71e77bda0fd887680d046a1b4104e65dbd9b09aa46607d168ee7
MD5 fecf9daef8c19a0256f21473ff62dedf
SHA1 de062b0d4c95f54ddf0313b563683cb1cc8e3267
SHA512 5edd7fc0a04275021d002c36039887d1d0fe6cac4fcf6ac90d20e28324a018ff1f6e53fe2c1e4eb8f306b0da094c2918afece115aa558c739a641c0a365a748f
SSDEEP 48:+P/mrIIAqzIvtTegERu9o0m5RD7J2U7gFUTUETkIf4sQgbmZFms4Ch+UQRcy:8OUWGsEW0m5R/cUmIkKQPfmvVUQRr
TLSH
T1A3912E81B780E833D61447329CE3D2D032357DA64FD6971B70987B2FAD367C597222A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\47K48DJ6.MO6\9D2GTDTP.GD6\manifests\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4.cdf-ms
Size 4KB
SHA256 ecd8af76e37a5bac19fd799171f425c4f72491ce7d5e99d7c591f9accb70636c
MD5 3f87bc3c6815129e910764a238f7bd83
SHA1 ca835e3a60d7f5b5da14e851043f70ccadbba247
SHA512 4af61364918a855cb4f8ae738a06c729b6e19a95cf517248b82eeeb6ac8824555ac07f2a8ec3bf91631f5b33c40bebcb4dd8ba76b626d352daf70b09e543d949
SSDEEP 96:pQItR7eV+Ww8OL54cSGYHXUrI10j/X+3EkyFc6C:DsJoTSXUC0CXV
TLSH
T138A1DD027340E927E5A90633AC96C2ED2B787D83DE42460B71C47F2F75726E6533619A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\47K48DJ6.MO6\9D2GTDTP.GD6\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\ScreenConnect.ClientService.exe
Size 93KB
SHA256 11072e4f7638f29f832d53e7e67c7b84ab069c7542ff066dee3bfb0430c7cf95
MD5 2cfecd2152493f50533c75530a9bb1c0
SHA1 7e58398edc4a9843c9ef3f0e0dc15f6d3a9f2c6b
SHA512 fef16aeec510fce456230238b99ba2e00c6d507f3a205879277444e801b12658b021a40544d63004f2db5fa0a805e3eceb8b2b19ed38509b6392ca1e00b2c32f
SSDEEP 1536:+g1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoU0HMB7FrBYN:PhbNDxZGXfdHrX7rAc6myJkgoU0HkRN2
TLSH
T1B3935B13B5C28872D473093158E0DAB09A3FF9615E61DEAB3798022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\47K48DJ6.MO6\9D2GTDTP.GD6\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\ScreenConnect.WindowsClient.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\47K48DJ6.MO6\9D2GTDTP.GD6\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\app.config
Size 655B
SHA256 c8091d2dc3e0a838d00cec820d15bca9c92673fda1d41a4d14aafce836a8136e
MD5 234f628603b3ed94022d33c5d1116366
SHA1 d6549e35d28247abb5eff0d067852aed5e219707
SHA512 66b725ce929e28c1d16da76b8b1917a36515ad32a8be806f1a2efcd102062d6897896826717033c4833f1e29161980587dcfad7b3a337eb453f449225ebe4027
TLSH
T150F0812871C4BD5A1AA31E33E6234600ADB05DA31216786C74EE213BEB76AD513F33D6
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\47K48DJ6.MO6\9D2GTDTP.GD6\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\user.config
Size 520B
SHA256 4095dde09a9b2dfaf8d9372a4f967cd0de3ed2f53efcaf2378b7c08151dfc406
MD5 2b937595b9a53c1ddb412c8473527934
SHA1 4d5d2ddb93215e52ef09c9e5e8fcab637ba1f9ea
SHA512 fa94e2cd88319e2a5cf63fd54599ac15daf423ac3a03a03e5abd0f1b5741e5174ded8d07a35f35526272143376db021f0fc9b1c4fc787c222fc0d9165dd4262e
TLSH
T189F0E9A131846D4713635E23C5114741EE72669B0551209874AF613A5F315CE03A31CE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\47K48DJ6.MO6\9D2GTDTP.GD6\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\user.config
Size 666B
SHA256 bfc5933b6f24fe0c9e6610d4cbdeae40bc09441b9d1b46b8bcabddc69d2e7a7a
MD5 576b55d705ba8ebe683e187d2540daad
SHA1 8682152a003ce9583a241f98fbabb356a75b7533
SHA512 33a623e3fb9a38adca8d7703f4805e4c8f4f3b66258e4b7b00bbc9517f02c10ba2bac05913d0f457eb8deafd2f5b8062c8c38baf59b72d717934a448cc04a8cc
TLSH
T17001286971C4AE8B13736E33D6214742EE715A97056560D874AE223B6F304DE07A32CE
MD5 SHA1 SHA512 TLSH

Submit Download

AJ5RGQ52.WYW.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\J1LMG0LX.D09\AJ5RGQ52.WYW.application
Size 97KB
SHA256 6ed2bd7ac0085f3e266ad39da9dabce3bc55bdd78e2157973430fd1f081fc27a
MD5 341f83f757d38f92336e081292a75417
SHA1 8f75415dfbbd6b6b4a584ea38a60c98c4445b14c
SHA512 0876ea064106cf0673d16f70166c2485986c49f2d39a7f88355c6137a94656035d579fc82071566f9c31b65146e424a856f728b2e88231a294f79496b61db388
SSDEEP 1536:0/JK+zuLD4UABnjRnfduUW5Ab4KpSE5GP/uLTvooycupKQ/IuKE:0/duuBn1nfdvg2XOcupX1
TLSH
T128A3613ACE30F4C0477DB021D1A92D673D811B93DB731BACD90A186B0E69796EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\WPK031VN.GNW\4N2RREC5.9NN\ScreenConnect.Client.dll
Size 640KB
SHA256 308b5b099ce6546f0821f59431575d6ca3a855a3d78552b7b46182ca8630625d
MD5 b96b26da3e1a3010b088d9179a50ce1f
SHA1 89ca6b6a65a72763c998015e9dce5b2cac0947f0
SHA512 00933dcf465cccfd6ea4a51386a8ef5bc35bfee778307e2a32e02b2bf0b66f51333e222953203d954faccf6d837610de49a3ce3616b8fa2842f27693d13ee2a0
SSDEEP 12288:HUFzTYpQ8UMzHTEavSW7OQniuMXaMktH5FMbZ:HUxTYdhzEn8quMTktH5FM9
TLSH
T137D4D089A794A93AE96E0B33F5613620EAF16CC69987D70F1D64377D0C323C82E4D5D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\WPK031VN.GNW\4N2RREC5.9NN\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 8929cfa8bbea4aa718881c3a63e629417df02a709acc8528bf7b8ba18c3ca06c
MD5 019356a9dbbfd64a3b4053b525c82b1b
SHA1 94c617d66698691ac8c48b91b16edf6c4f2a2500
SHA512 4bca960c60f45896defda926e0de61a7c944a0271f5d7587ed26be93f4ba0cbac970aeaf6e8102ba2cdff5a12c20445221de03a4d307f28d963a5c2ef51cde65
TLSH
T16B117B0191C8FA361F3341D1BEE7E420676D5B33058E194BB06A689F8B29AD743470B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\WPK031VN.GNW\4N2RREC5.9NN\ScreenConnect.ClientService.dll
Size 188KB
SHA256 fe49ae2df0eec94e5757375a1c2d1f99a544482ea9621e6cfb971faba25a9fea
MD5 c88fc99fcd94b679a1a7256bdb6de8da
SHA1 a2376e76a962abe941125ad0d8ead0c5614c7eb0
SHA512 4f2e1b149cadf413cba1ee956f8ad8100730d9b2d39d01251e32ecd7a8e051b3fa7ada4436e6774162e519eae629a1b84ef6825db1368dd5d5f09f6b6d892213
SSDEEP 3072:/TV7Zf8zEOyVZhUNby04J44yEYv4F6HvfYT7MHzVQNVzIjHLgRT:/TVXZhCHJ1gF6wQJ0IzW
TLSH
T1DA14AF49BB6AE966C89F093BA461B32143F0A043DDE6D34F6CD862DE5E553D41F083C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\WPK031VN.GNW\4N2RREC5.9NN\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 c39d1fc54f7937e8b62fc70bdaf42e165b1fe4a19c54f84e8cf9d922b2de6c48
MD5 a10c6c6900ef5832dfcf74c2b49f8d10
SHA1 df5de264304a3f83b9fbac0279743397dcb0ed72
SHA512 c70b3cb7f21a70a8d59b016e286a6670e23f3c9db9e3757ac687f679c15fa380b9a6ffa025035552f164c03925dbe2681a8fee006276ef99f750fce37b0648fe
TLSH
T1DE31261591C8FA350F7302D1BDE7E0305B9D5B32158E194BB05AA99FCF29A97434B073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\WPK031VN.GNW\4N2RREC5.9NN\ScreenConnect.Core.dll
Size 1.3MB
SHA256 0d0a9a35bf8a71b58c83119605cb0bf2f21bd9a87d74b5531450af91aa23229f
MD5 de090c1e694a07a4a3e81f50160b7bd0
SHA1 3f96eb339f3769d7db59bf4c887a34568890dc5c
SHA512 a00faf5829d213595524ebd1c34215318cb38ec84720b5a183b8f2cc74c6628d379e2cea6d40d295d24837c96990cc902892c7ae54314247fdbc573873aeebd8
SSDEEP 24576:k8PuuKZjnbHbB4VejG/e53RRpLqKa/rvLTAXIrSKAsjIiZI460UL1XJf1V/QjU+4:vuXBJk9UtN/Qj/4
TLSH
T15D558DCE7B9AA637DD7D067B8050120067F0E1D25B23D71B6AA0B73E1C593E8AE452CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\WPK031VN.GNW\4N2RREC5.9NN\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 5bef6c316992b20a446529d90cf9eacd76882ae8c8ccbb5a48e082255a714589
MD5 f0d61fa6e938195134f7a6b8bcde1d0b
SHA1 9e9385362ebc6e63990b8b09742b12de51364550
SHA512 7d73511dc473509a01e816530d13425b2beb0e5f02caaa7310e8293fda5f7f88b4b76393d2251e10245e1a61bc4dd7ccc592835c905ef95b89e2055e18cd8eb6
TLSH
T189216A0181C8FA261F3302D2BDE7E42197AE5B33148D194B7069689FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\WPK031VN.GNW\4N2RREC5.9NN\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 4c5b99950f819b3ad0fec363f32518cda5650a5e9b2ec1b6733157d50b135441
MD5 ff20b828b0d6a1be49c7747bdca06713
SHA1 bd93fe00076b27b18cefe634ff0bc86463d4b667
SHA512 bc550215362db36506472a2447781ccfad52fd364aacda38bbf1c568941a965f733a541258fd691406cba3b20744931f59ee49eeea982f07db82250461d34f3b
SSDEEP 24576:aIAkEFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKPTsUT:sfJkGYYZTk+T1iH7efPiqU
TLSH
T1F895AD45E6C769F6D42F043888BE632AB6743C040355CBFB97D4AA392D33BC09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\WPK031VN.GNW\4N2RREC5.9NN\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 69469980fdc8b3c31191ec79ab23efe0803f49bc3d27d73637ffed5beda29765
MD5 963bb2ae3f64f0fb46e388b361350539
SHA1 e6b47be9925bed2bb0f07a6b0e92e86fe7acd4e1
SHA512 da84be8c06310d47aa63b393076b1e124165782cf2488c9d668fd67d0e0289c3d50c4517d576c9d74ca53b8748193c7a0a121add3c679c6896bf89a6562f71b5
TLSH
T16041F11181C8FA250F3302D2BEEBE431979E5733158E194B7099AD8BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\WPK031VN.GNW\4N2RREC5.9NN\ScreenConnect.WindowsBackstageShell.exe
Size 135KB
SHA256 d5610f23a250076a7cf18072cc3bc4636f6c19e63dd610fa7c2c00d287f603ba
MD5 a48bf18ed0aafb9cb7da2e147f9f60d7
SHA1 df39c67872d1c5935c0ef36643494507c8afb9a2
SHA512 b7ed9ccdbd2fee963ccfa22ede9c757b5a35e7312806986d7cf8735de3fa82d331873fa155e52e27c3c529bc6e6513204d5520cb7725cac989c5e9be03e0f148
SSDEEP 3072:m8vtZItvjBXoAXgclK3QHk/dwDQP2xenAKh/xKVxu9RZg:m8vXcpsrFK/4Aqx09
TLSH
T1D6D39D40BB99E426D9AF0D3A74A1B32086B2F493C9D7C70B2CD422BD7F18BD15B942D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\WPK031VN.GNW\4N2RREC5.9NN\ScreenConnect.WindowsClient.exe
Size 1.6MB
SHA256 6f7675112b5845dd77d74edd8f898050bcb1cfc6fd1bf71e0a579ffcd1494040
MD5 ab60dcfd15ddd85484d8e8d791c4f2ef
SHA1 da8af7b1c5a781fed2fdb027415d0986bb52fffc
SHA512 970084e9fa60b150ec95affc0e7d9d32269a43c66f716703962f7a80c26e80f40aee77b5344d39f1e5d35af4ddf8170f41768f66dd28b21532b8f9bc823ae6f3
SSDEEP 24576:288NzZ9GFGKXqogokt83xWGPQc8JPHv++Vwl18BdkPW:2BziTm4WG4c89v+jEp
TLSH
T137759E897FE4EE67C95E077B98612204B7F094908F23DB076494B77E1C8A3846E489DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\WPK031VN.GNW\4N2RREC5.9NN\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\WPK031VN.GNW\4N2RREC5.9NN\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 996eb91b8f7546a582d532ad83a708588f609c816015ebd84c567c86ee558691
MD5 f1e58ca6c858d80aa38c823d6d018bbc
SHA1 5af4bc04d78609ec78207a909cb8bf703f6b82e9
SHA512 f9bcb306e12a165ed5d4b05f56b79e77934a04bbb6ef1e8fc795be2eca263623dee418703445bcdf4b54d08bd62c4f9b71d3ba5e1d256765908ce16d62d1eb19
TLSH
T12651071551C4FA310F7302D1BDEBE070979E4B32158E194B7099998FCF2DA97478B027
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\WPK031VN.GNW\4N2RREC5.9NN\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 5b42323ecbbf2dc83623170c80852eb16b65ea5838385a48e7b02b7e20885c05
MD5 1cb1008b9efdceeb275e52921c4d264c
SHA1 3e7584005bf23e17f72a8a90a4f4bbc12a78f53e
SHA512 ca09cbbe4bad2483285a0a386bce6827fe1ca234d1cb2ee19374fc250dcd3b604ce0e5773245aa80d9fa6ac3242b3ef32e1448ad56bbc8a8bfc9fc33e65c99aa
SSDEEP 96:xWLwOhoyTqUe2wvyjkok2kCkRkkHqkDCkbi4kOpQkOpPDkIAkOpD:oRpePNnrRhDDrbi9UFUQIVUD
TLSH
T154F19C9684C0BD21573381C4FEE39924BD157F73026E148ABC4D19AF9FB25899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\WPK031VN.GNW\4N2RREC5.9NN\ScreenConnect.WindowsFileManager.exe
Size 118KB
SHA256 59d332f0b0309afef899b02ca63d39bc9cd526cc0df9bca752e328b6284354f5
MD5 f2ad9d783759a68b5edd7299632652d7
SHA1 968a139a1253377e45a018d52972842e813bfcae
SHA512 d0375844ff9fc322b1301307b5164b3e46c58f12836ccf471e5f83762a40c067dfd0dcbee06db8376995247abaa66a4ade189ea07b981a498c12fa5c738eb75c
SSDEEP 1536:IQjh69C6aeMhAljM7F/8NV/s5YjzI5BLP+VVVVVVVVVVVVVVVVVVVVVVVVVSgkDV:IydeJliF8VmezuBLNhDRH
TLSH
T169C3295235256231DF89C433A452E9B099737F6607FEC6BD28A1BA3A38F03943E59D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2504-6-0x0000000005FB0000-0x0000000006554000-memory.dmp

Download

memory/2504-7-0x0000000005AA0000-0x0000000005B32000-memory.dmp

Download

memory/2504-0-0x00000000059F0000-0x0000000005A00000-memory.dmp

Download

memory/2504-8-0x00000000059F0000-0x0000000005A00000-memory.dmp

Download

memory/2504-5-0x0000000005970000-0x0000000005994000-memory.dmp

Download

memory/2504-4-0x00000000058C0000-0x000000000594E000-memory.dmp

Download

memory/2504-9-0x00000000087B0000-0x000000000895E000-memory.dmp

Download

memory/2504-12-0x00000000059F0000-0x0000000005A00000-memory.dmp

Download

memory/2504-3-0x0000000003260000-0x0000000003268000-memory.dmp

Download

memory/2504-2-0x00000000059F0000-0x0000000005A00000-memory.dmp

Download

memory/2504-1-0x00000000019F0000-0x00000000019F8000-memory.dmp

Download

memory/4548-13-0x0000019BD1230000-0x0000019BD1240000-memory.dmp

Download

memory/4548-25-0x0000019BD1230000-0x0000019BD1240000-memory.dmp

Download

memory/4548-56-0x0000019BD1230000-0x0000019BD1240000-memory.dmp

Download

memory/4548-53-0x0000019BD5A50000-0x0000019BD5A82000-memory.dmp

Download

memory/4548-47-0x0000019BD5F30000-0x0000019BD6114000-memory.dmp

Download

memory/4548-41-0x0000019BD5CB0000-0x0000019BD5D54000-memory.dmp

Download

memory/4548-35-0x0000019BD5E80000-0x0000019BD6014000-memory.dmp

Download

memory/4548-60-0x0000019BD5E00000-0x0000019BD5F54000-memory.dmp

Download

memory/4548-24-0x0000019BD57C0000-0x0000019BD5810000-memory.dmp

Download

memory/4548-372-0x0000019BD1230000-0x0000019BD1240000-memory.dmp

Download

memory/4548-15-0x0000019BD1230000-0x0000019BD1240000-memory.dmp

Download

memory/4548-11-0x0000019BD12C0000-0x0000019BD1446000-memory.dmp

Download

memory/4548-10-0x0000019BB6CC0000-0x0000019BB6CC8000-memory.dmp

Download

memory/5080-339-0x00000000007C0000-0x0000000000954000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads