9645275ee0951f572268d5570b8e7b80f84a5c22de7486e9d780b0b3705e44a0

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 08:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_002e7a458791e327290ad744c5eb1743_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 2.4MB
Sample260909-kbjv8adn21
SHA256 9645275ee0951f572268d5570b8e7b80f84a5c22de7486e9d780b0b3705e44a0
MD5 002e7a458791e327290ad744c5eb1743
SHA1 8f68b673ef93ebed7b81558685706e27212867f1
SHA512 e5631241a131847a9a686cc5aad7cab0e850f948d22cfd4ae116758003912883ea854e0e6e46f7410b9f222516e0e9dd1a3a355558ee03be181a4bb0e18814bd
SSDEEP 24576:lrWg44vFOEznjdp4Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFN:hWWjpp4JkGYYpT0+TFiH7efPkQ98ze
TLSH
T165C5AD02F3D656B5C47F067898BA521AA770BC081315CBFB56D4A9793E337C08E367A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
2	4956	dfsvc.exe
2	4956	dfsvc.exe
2	4956	dfsvc.exe
2	4956	dfsvc.exe
2	4956	dfsvc.exe
2	4956	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
1092	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\4EEYH518.4BM\BA13PYMN.G8X\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_002e7a458791e327290ad744c5eb1743_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\implication!scre..tion_0000000000000000_001a.0006_961d = 68747470733a2f2f737570706f72742e7669727475616c69742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\Files\ScreenConnect.Windows.dll_fc0d83aff7df0b5b = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b\lock!020000008b2b590e44040000fc0f00000000000000000000a = 30303030303434342c30316464343033346438343438356262	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_000000000000000 = 460061006c00730065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_000000000000000 = 680074007400700073003a002f002f0073007500700070006f00720074002e007600690072007400750061006c00690074002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320036002e0036002e0035002e0039003700340032002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320036002e0036002e0035002e0039003700340032002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e00330032000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\SizeOfStronglyNamedComponent = 09c7050000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\identity = 68747470733a2f2f737570706f72742e7669727475616c69742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\scre...exe_0000000000000000_001a.0006_none_5d04069fbb3	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_000000000000000 = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_000000000000000 = 32003000320036002f00300039002f00300039002000300038003a00320035003a00350039000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b\implication!scre..tion_0000000000000000_001a.0006_961d = 68747470733a2f2f737570706f72742e7669727475616c69742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\Files\ScreenConnect.WindowsBackstageShell.exe.con = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_961dce6c950e9006	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4\Files\ScreenConnect.ClientService.dll_e781b1c636f = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669\DigestValue = 3f96eb339f3769d7db59bf4c887a34568890dc5c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\HasRunBefore = 01	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d\DigestValue = 89ca6b6a65a72763c998015e9dce5b2cac0947f0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4\lock!1c0000009a2b590e44040000fc0f00000000000000000000f = 30303030303434342c30316464343033346438343438356262	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\lock!160000009a2b590e44040000fc0f00000000000000000000f = 30303030303434342c30316464343033346438343438356262	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d\lock!140000009a2b590e44040000fc0f00000000000000000000f = 30303030303434342c30316464343033346438343438356262	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\SizeOfStronglyNamedComponent = 7c1e1e0000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c310	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\lock!11000000d529590e5c13000094110000000000000000000048d221 = 30303030313335632c30316464343033346430333237343130	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\SubstructureCreated = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d\implication!scre..tion_0000000000000000_001a.0006_961d = 68747470733a2f2f737570706f72742e7669727475616c69742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\Files\ScreenConnect.WindowsFileManager.exe.config = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_000000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_000000000000000 = 68747470733a2f2f737570706f72742e7669727475616c69742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_000000000000000 = 0000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "YB9X332PW3PLBN1B8XLQ7H1W"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\appid = 68747470733a2f2f737570706f72742e7669727475616c69742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_a097bb8afac7ef3f	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_961dce6c950e9006\scre...exe_0000000000000000_001a.0006_none_5d04069fbb3 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\Files\ScreenConnect.WindowsBackstageShell.exe_898 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_000000000000000	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Apps\2.0\TT4ZWEAZ.QEQ\T28MAQ2R.3L5\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\4EEYH518.4BM\BA13PYMN.G8X\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3480	2026-09-07_002e7a458791e327290ad744c5eb1743_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	4956	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 4956	3480	2026-09-07_002e7a458791e327290ad744c5eb1743_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	89
PID 4956 wrote to memory of 1092	4956	dfsvc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-07_002e7a458791e327290ad744c5eb1743_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_002e7a458791e327290ad744c5eb1743_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Users\Admin\AppData\Local\Apps\2.0\TT4ZWEAZ.QEQ\T28MAQ2R.3L5\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\TT4ZWEAZ.QEQ\T28MAQ2R.3L5\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:1092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\TT4ZWEAZ.QEQ\T28MAQ2R.3L5\manifests\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e.cdf-ms
Size 14KB
SHA256 b59d457b2085e31751ef7eba681e93aaae801b379415593499b86d32c3cefcb3
MD5 6ccf17cbb5322d60aaaeeb60b2fd64ff
SHA1 dc1bdc18154c22826e9799b7fa7d2fad6f16ded1
SHA512 efc236f3efeaf13f11bc5437299e933dba7e0f6d457c16c550a2d0d482b33173fd78ed027a8781b43d47f755f7aa5278ad9fcedf9accfe534cfe4b188af598fa
SSDEEP 192:F33wHfSCi+76h61EEcemo9AbrerSrZIQGV67gql4:FQHifh611W3+aL4
TLSH
T11F62E901F7D6E833E2511733DCAAC3D47232BDA55E96135B34843B2EEC712D98A32695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\TT4ZWEAZ.QEQ\T28MAQ2R.3L5\manifests\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669.cdf-ms
Size 3KB
SHA256 44b6b52ddda1df5134138e9bed933037917b4634a3fe56fddecdb8c6c1f77497
MD5 a7f4c30a94b85d9ee5349cabf09c7d81
SHA1 a0cafce138f8d1e40708cca9eddb7a6bfbe3cb89
SHA512 a22851357199f4a8e3d3fad7aa31823f95af36e06046c184d2e145cb35c37422123c6aaedf00458694036e92334ac37a05fa83a8547c23017bd6334d4929c77d
TLSH
T10A617442B684EE17D9A90273ACD6D2ED37747E83DF42420B75C4BF2F7A322E55222191
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\TT4ZWEAZ.QEQ\T28MAQ2R.3L5\manifests\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999.cdf-ms
Size 5KB
SHA256 d48c8a11f776e791a9ec82c7bc90d6dbf1f94978b383f2dea467d7f9299a804c
MD5 aa91d0fa9c55e70d9a6007cc0817a01d
SHA1 3f04ccdee6d3e52d274ad361e6e141779452cf80
SHA512 997eb2b00565e90064e737dd7cfdc36aa306c4c93703e2a19c1b14ae953b20088c57f3581cfa76b4131ea414e433d200c90872d92e7af8c691f440ae50bf5ffd
SSDEEP 96:MBW+RzgtheV+Ww7OLFIuOQlVXXezcpviCwimdR:MRzgkJfauNB6Me
TLSH
T142B142117290DD1BD5B90633ACA6C3ED2B36BE92DE43030B70D4BB1FBA326D65222195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\TT4ZWEAZ.QEQ\T28MAQ2R.3L5\manifests\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976.cdf-ms
Size 7KB
SHA256 095ccdfc4884abdef70fee36e20c2071730f402f56ac8d8de1aaab6424cb05f6
MD5 d53c4a248352070533920f82d82cadff
SHA1 51925c3877dd26d3eb09056c8e221d9f3266de18
SHA512 844f61d6382e745e4c353f793573e5c977c7a2a8d6c7d96b3fd4be0baed5d56818eac0d8f0e0987436dfbc656c7d5c19bbe55477dac6f46f1aa938d83cf98089
SSDEEP 96:FOONY6gnxfq4qFeV+WwwOL586gpweBla6haqe+ksVGvYy:8vnJDqaJ4lgpP7VMJz
TLSH
T14FF16702B298EA13D5AA46339C96C3ED27667DD2DF43070B72C4BB3F76322D61312195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\TT4ZWEAZ.QEQ\T28MAQ2R.3L5\manifests\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d.cdf-ms
Size 2KB
SHA256 6171de421dbe6c5961f5a7745866c5817c420c9f38486be886396c570abaf490
MD5 c6a0720f3c552c2cb444a281d0bf2d46
SHA1 011a09c4ab7e01e734ead1b384e6edd940e78131
SHA512 b86be6ee8a364bf694438e23cefa10aa72ca5d501c21bed6e81a43496fc91b40089e06c903acf4b84ce7ba74df505606c4f65d680d6aed3d77686f149902da28
TLSH
T17D51C0057788EA67D6650632AC62D3F936767E42EF46031BF1C0BB3F2A716C946120D5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\TT4ZWEAZ.QEQ\T28MAQ2R.3L5\manifests\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b.cdf-ms
Size 4KB
SHA256 feff4faefb50e1cea0e57db58c8ad840545f12487a69b3f08f76da2d4dee4381
MD5 46aa09ec648667548df2de1ee83dbe57
SHA1 1c212317f4c7b66910136283ee6c5ffdd8bae493
SHA512 8297838605ce6d80f06b18793b7b9a66ceb4e39c86fc8ee3ca9ff1fb5a689ba76be7cb3a1d08d4e181963df229a3043fc9178dffdf6c9be4df040082eff559d3
SSDEEP 48:iP/mrIIAqzIvtcngERu9o0m5RD7J2U7gFUTUETkIf4sQgbmZFms4Ch+UQRcy:QOUWGQEW0m5R/cUmIkKQPfmvVUQRr
TLSH
T1A6912E81B780E833E61447329CE3D2D032357DA64FD6971770987B2FAD367C69622266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\TT4ZWEAZ.QEQ\T28MAQ2R.3L5\manifests\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4.cdf-ms
Size 4KB
SHA256 2c9dbc6ca014a862e208d1bc36a16583aeb26aa24d3d49e5f96d22888a6e8e3d
MD5 6fa2ba033e1be74b4f4a76f363942896
SHA1 d0704f162d5397ea6f4bb74ddd2d342070890824
SHA512 26f0f49676ae67c864be3dec3af8361d1ecb20351e20a99b2615e204838bb5f6ab4e36df6325f61660b4a0be065a6c04e7f47d9d18f88f304c14d15efd555701
SSDEEP 96:vQItRqeV+Ww8OL54cSGYHXUrI10j/X+3tkyFc6C:xlJoTSXUC0CKV
TLSH
T1FAA100027340EA27E5A50633AC96C3ED3B787C82DE42420BB1C47F2F75726E65326196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1p4jmqti.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\TT4ZWEAZ.QEQ\T28MAQ2R.3L5\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\1p4jmqti.newcfg
Size 666B
SHA256 bfc5933b6f24fe0c9e6610d4cbdeae40bc09441b9d1b46b8bcabddc69d2e7a7a
MD5 576b55d705ba8ebe683e187d2540daad
SHA1 8682152a003ce9583a241f98fbabb356a75b7533
SHA512 33a623e3fb9a38adca8d7703f4805e4c8f4f3b66258e4b7b00bbc9517f02c10ba2bac05913d0f457eb8deafd2f5b8062c8c38baf59b72d717934a448cc04a8cc
TLSH
T17001286971C4AE8B13736E33D6214742EE715A97056560D874AE223B6F304DE07A32CE
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\TT4ZWEAZ.QEQ\T28MAQ2R.3L5\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\app.config
Size 655B
SHA256 c8091d2dc3e0a838d00cec820d15bca9c92673fda1d41a4d14aafce836a8136e
MD5 234f628603b3ed94022d33c5d1116366
SHA1 d6549e35d28247abb5eff0d067852aed5e219707
SHA512 66b725ce929e28c1d16da76b8b1917a36515ad32a8be806f1a2efcd102062d6897896826717033c4833f1e29161980587dcfad7b3a337eb453f449225ebe4027
TLSH
T150F0812871C4BD5A1AA31E33E6234600ADB05DA31216786C74EE213BEB76AD513F33D6
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\TT4ZWEAZ.QEQ\T28MAQ2R.3L5\scre..tion_0000000000000000_001a.0006_3aa9ecd2fe9e78be\user.config
Size 520B
SHA256 4095dde09a9b2dfaf8d9372a4f967cd0de3ed2f53efcaf2378b7c08151dfc406
MD5 2b937595b9a53c1ddb412c8473527934
SHA1 4d5d2ddb93215e52ef09c9e5e8fcab637ba1f9ea
SHA512 fa94e2cd88319e2a5cf63fd54599ac15daf423ac3a03a03e5abd0f1b5741e5174ded8d07a35f35526272143376db021f0fc9b1c4fc787c222fc0d9165dd4262e
TLSH
T189F0E9A131846D4713635E23C5114741EE72669B0551209874AF613A5F315CE03A31CE
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4EEYH518.4BM\BA13PYMN.G8X\ScreenConnect.Client.dll
Size 640KB
SHA256 308b5b099ce6546f0821f59431575d6ca3a855a3d78552b7b46182ca8630625d
MD5 b96b26da3e1a3010b088d9179a50ce1f
SHA1 89ca6b6a65a72763c998015e9dce5b2cac0947f0
SHA512 00933dcf465cccfd6ea4a51386a8ef5bc35bfee778307e2a32e02b2bf0b66f51333e222953203d954faccf6d837610de49a3ce3616b8fa2842f27693d13ee2a0
SSDEEP 12288:HUFzTYpQ8UMzHTEavSW7OQniuMXaMktH5FMbZ:HUxTYdhzEn8quMTktH5FM9
TLSH
T137D4D089A794A93AE96E0B33F5613620EAF16CC69987D70F1D64377D0C323C82E4D5D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4EEYH518.4BM\BA13PYMN.G8X\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 8929cfa8bbea4aa718881c3a63e629417df02a709acc8528bf7b8ba18c3ca06c
MD5 019356a9dbbfd64a3b4053b525c82b1b
SHA1 94c617d66698691ac8c48b91b16edf6c4f2a2500
SHA512 4bca960c60f45896defda926e0de61a7c944a0271f5d7587ed26be93f4ba0cbac970aeaf6e8102ba2cdff5a12c20445221de03a4d307f28d963a5c2ef51cde65
TLSH
T16B117B0191C8FA361F3341D1BEE7E420676D5B33058E194BB06A689F8B29AD743470B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4EEYH518.4BM\BA13PYMN.G8X\ScreenConnect.ClientService.dll
Size 188KB
SHA256 fe49ae2df0eec94e5757375a1c2d1f99a544482ea9621e6cfb971faba25a9fea
MD5 c88fc99fcd94b679a1a7256bdb6de8da
SHA1 a2376e76a962abe941125ad0d8ead0c5614c7eb0
SHA512 4f2e1b149cadf413cba1ee956f8ad8100730d9b2d39d01251e32ecd7a8e051b3fa7ada4436e6774162e519eae629a1b84ef6825db1368dd5d5f09f6b6d892213
SSDEEP 3072:/TV7Zf8zEOyVZhUNby04J44yEYv4F6HvfYT7MHzVQNVzIjHLgRT:/TVXZhCHJ1gF6wQJ0IzW
TLSH
T1DA14AF49BB6AE966C89F093BA461B32143F0A043DDE6D34F6CD862DE5E553D41F083C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4EEYH518.4BM\BA13PYMN.G8X\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 c39d1fc54f7937e8b62fc70bdaf42e165b1fe4a19c54f84e8cf9d922b2de6c48
MD5 a10c6c6900ef5832dfcf74c2b49f8d10
SHA1 df5de264304a3f83b9fbac0279743397dcb0ed72
SHA512 c70b3cb7f21a70a8d59b016e286a6670e23f3c9db9e3757ac687f679c15fa380b9a6ffa025035552f164c03925dbe2681a8fee006276ef99f750fce37b0648fe
TLSH
T1DE31261591C8FA350F7302D1BDE7E0305B9D5B32158E194BB05AA99FCF29A97434B073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4EEYH518.4BM\BA13PYMN.G8X\ScreenConnect.ClientService.exe
Size 93KB
SHA256 11072e4f7638f29f832d53e7e67c7b84ab069c7542ff066dee3bfb0430c7cf95
MD5 2cfecd2152493f50533c75530a9bb1c0
SHA1 7e58398edc4a9843c9ef3f0e0dc15f6d3a9f2c6b
SHA512 fef16aeec510fce456230238b99ba2e00c6d507f3a205879277444e801b12658b021a40544d63004f2db5fa0a805e3eceb8b2b19ed38509b6392ca1e00b2c32f
SSDEEP 1536:+g1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoU0HMB7FrBYN:PhbNDxZGXfdHrX7rAc6myJkgoU0HkRN2
TLSH
T1B3935B13B5C28872D473093158E0DAB09A3FF9615E61DEAB3798022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4EEYH518.4BM\BA13PYMN.G8X\ScreenConnect.Core.dll
Size 1.3MB
SHA256 0d0a9a35bf8a71b58c83119605cb0bf2f21bd9a87d74b5531450af91aa23229f
MD5 de090c1e694a07a4a3e81f50160b7bd0
SHA1 3f96eb339f3769d7db59bf4c887a34568890dc5c
SHA512 a00faf5829d213595524ebd1c34215318cb38ec84720b5a183b8f2cc74c6628d379e2cea6d40d295d24837c96990cc902892c7ae54314247fdbc573873aeebd8
SSDEEP 24576:k8PuuKZjnbHbB4VejG/e53RRpLqKa/rvLTAXIrSKAsjIiZI460UL1XJf1V/QjU+4:vuXBJk9UtN/Qj/4
TLSH
T15D558DCE7B9AA637DD7D067B8050120067F0E1D25B23D71B6AA0B73E1C593E8AE452CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4EEYH518.4BM\BA13PYMN.G8X\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 5bef6c316992b20a446529d90cf9eacd76882ae8c8ccbb5a48e082255a714589
MD5 f0d61fa6e938195134f7a6b8bcde1d0b
SHA1 9e9385362ebc6e63990b8b09742b12de51364550
SHA512 7d73511dc473509a01e816530d13425b2beb0e5f02caaa7310e8293fda5f7f88b4b76393d2251e10245e1a61bc4dd7ccc592835c905ef95b89e2055e18cd8eb6
TLSH
T189216A0181C8FA261F3302D2BDE7E42197AE5B33148D194B7069689FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4EEYH518.4BM\BA13PYMN.G8X\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 4c5b99950f819b3ad0fec363f32518cda5650a5e9b2ec1b6733157d50b135441
MD5 ff20b828b0d6a1be49c7747bdca06713
SHA1 bd93fe00076b27b18cefe634ff0bc86463d4b667
SHA512 bc550215362db36506472a2447781ccfad52fd364aacda38bbf1c568941a965f733a541258fd691406cba3b20744931f59ee49eeea982f07db82250461d34f3b
SSDEEP 24576:aIAkEFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKPTsUT:sfJkGYYZTk+T1iH7efPiqU
TLSH
T1F895AD45E6C769F6D42F043888BE632AB6743C040355CBFB97D4AA392D33BC09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4EEYH518.4BM\BA13PYMN.G8X\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 69469980fdc8b3c31191ec79ab23efe0803f49bc3d27d73637ffed5beda29765
MD5 963bb2ae3f64f0fb46e388b361350539
SHA1 e6b47be9925bed2bb0f07a6b0e92e86fe7acd4e1
SHA512 da84be8c06310d47aa63b393076b1e124165782cf2488c9d668fd67d0e0289c3d50c4517d576c9d74ca53b8748193c7a0a121add3c679c6896bf89a6562f71b5
TLSH
T16041F11181C8FA250F3302D2BEEBE431979E5733158E194B7099AD8BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4EEYH518.4BM\BA13PYMN.G8X\ScreenConnect.WindowsBackstageShell.exe
Size 135KB
SHA256 d5610f23a250076a7cf18072cc3bc4636f6c19e63dd610fa7c2c00d287f603ba
MD5 a48bf18ed0aafb9cb7da2e147f9f60d7
SHA1 df39c67872d1c5935c0ef36643494507c8afb9a2
SHA512 b7ed9ccdbd2fee963ccfa22ede9c757b5a35e7312806986d7cf8735de3fa82d331873fa155e52e27c3c529bc6e6513204d5520cb7725cac989c5e9be03e0f148
SSDEEP 3072:m8vtZItvjBXoAXgclK3QHk/dwDQP2xenAKh/xKVxu9RZg:m8vXcpsrFK/4Aqx09
TLSH
T1D6D39D40BB99E426D9AF0D3A74A1B32086B2F493C9D7C70B2CD422BD7F18BD15B942D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4EEYH518.4BM\BA13PYMN.G8X\ScreenConnect.WindowsClient.exe
Size 1.6MB
SHA256 6f7675112b5845dd77d74edd8f898050bcb1cfc6fd1bf71e0a579ffcd1494040
MD5 ab60dcfd15ddd85484d8e8d791c4f2ef
SHA1 da8af7b1c5a781fed2fdb027415d0986bb52fffc
SHA512 970084e9fa60b150ec95affc0e7d9d32269a43c66f716703962f7a80c26e80f40aee77b5344d39f1e5d35af4ddf8170f41768f66dd28b21532b8f9bc823ae6f3
SSDEEP 24576:288NzZ9GFGKXqogokt83xWGPQc8JPHv++Vwl18BdkPW:2BziTm4WG4c89v+jEp
TLSH
T137759E897FE4EE67C95E077B98612204B7F094908F23DB076494B77E1C8A3846E489DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4EEYH518.4BM\BA13PYMN.G8X\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4EEYH518.4BM\BA13PYMN.G8X\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 996eb91b8f7546a582d532ad83a708588f609c816015ebd84c567c86ee558691
MD5 f1e58ca6c858d80aa38c823d6d018bbc
SHA1 5af4bc04d78609ec78207a909cb8bf703f6b82e9
SHA512 f9bcb306e12a165ed5d4b05f56b79e77934a04bbb6ef1e8fc795be2eca263623dee418703445bcdf4b54d08bd62c4f9b71d3ba5e1d256765908ce16d62d1eb19
TLSH
T12651071551C4FA310F7302D1BDEBE070979E4B32158E194B7099998FCF2DA97478B027
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4EEYH518.4BM\BA13PYMN.G8X\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 5b42323ecbbf2dc83623170c80852eb16b65ea5838385a48e7b02b7e20885c05
MD5 1cb1008b9efdceeb275e52921c4d264c
SHA1 3e7584005bf23e17f72a8a90a4f4bbc12a78f53e
SHA512 ca09cbbe4bad2483285a0a386bce6827fe1ca234d1cb2ee19374fc250dcd3b604ce0e5773245aa80d9fa6ac3242b3ef32e1448ad56bbc8a8bfc9fc33e65c99aa
SSDEEP 96:xWLwOhoyTqUe2wvyjkok2kCkRkkHqkDCkbi4kOpQkOpPDkIAkOpD:oRpePNnrRhDDrbi9UFUQIVUD
TLSH
T154F19C9684C0BD21573381C4FEE39924BD157F73026E148ABC4D19AF9FB25899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4EEYH518.4BM\BA13PYMN.G8X\ScreenConnect.WindowsFileManager.exe
Size 118KB
SHA256 59d332f0b0309afef899b02ca63d39bc9cd526cc0df9bca752e328b6284354f5
MD5 f2ad9d783759a68b5edd7299632652d7
SHA1 968a139a1253377e45a018d52972842e813bfcae
SHA512 d0375844ff9fc322b1301307b5164b3e46c58f12836ccf471e5f83762a40c067dfd0dcbee06db8376995247abaa66a4ade189ea07b981a498c12fa5c738eb75c
SSDEEP 1536:IQjh69C6aeMhAljM7F/8NV/s5YjzI5BLP+VVVVVVVVVVVVVVVVVVVVVVVVVSgkDV:IydeJliF8VmezuBLNhDRH
TLSH
T169C3295235256231DF89C433A452E9B099737F6607FEC6BD28A1BA3A38F03943E59D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MZ31RJOK.1PA.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\N5BDJKPP.2WQ\MZ31RJOK.1PA.application
Size 97KB
SHA256 6ed2bd7ac0085f3e266ad39da9dabce3bc55bdd78e2157973430fd1f081fc27a
MD5 341f83f757d38f92336e081292a75417
SHA1 8f75415dfbbd6b6b4a584ea38a60c98c4445b14c
SHA512 0876ea064106cf0673d16f70166c2485986c49f2d39a7f88355c6137a94656035d579fc82071566f9c31b65146e424a856f728b2e88231a294f79496b61db388
SSDEEP 1536:0/JK+zuLD4UABnjRnfduUW5Ab4KpSE5GP/uLTvooycupKQ/IuKE:0/duuBn1nfdvg2XOcupX1
TLSH
T128A3613ACE30F4C0477DB021D1A92D673D811B93DB731BACD90A186B0E69796EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1092-290-0x0000000000A10000-0x0000000000BA4000-memory.dmp

Download

memory/3480-0-0x00000000748C2000-0x00000000748C3000-memory.dmp

Download

memory/3480-11-0x00000000748C2000-0x00000000748C3000-memory.dmp

Download

memory/3480-6-0x00000000034B0000-0x00000000034D4000-memory.dmp

Download

memory/3480-1-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Download

memory/3480-3-0x00000000748B0000-0x000000007506C000-memory.dmp

Download

memory/3480-5-0x00000000748B0000-0x000000007506C000-memory.dmp

Download

memory/3480-14-0x00000000748B0000-0x000000007506C000-memory.dmp

Download

memory/3480-4-0x0000000005AC0000-0x0000000005B4E000-memory.dmp

Download

memory/3480-7-0x00000000748B0000-0x000000007506C000-memory.dmp

Download

memory/3480-8-0x00000000061B0000-0x000000000676A000-memory.dmp

Download

memory/3480-9-0x0000000005C90000-0x0000000005D22000-memory.dmp

Download

memory/3480-2-0x0000000001DC0000-0x0000000001DC8000-memory.dmp

Download

memory/3480-10-0x0000000005E20000-0x0000000005FCE000-memory.dmp

Download

memory/3480-17-0x00000000748B0000-0x000000007506C000-memory.dmp

Download

memory/4956-57-0x0000026F7A890000-0x0000026F7AA74000-memory.dmp

Download

memory/4956-51-0x0000026F7A610000-0x0000026F7A6B4000-memory.dmp

Download

memory/4956-13-0x0000026F5D7B0000-0x0000026F5D938000-memory.dmp

Download

memory/4956-12-0x0000026F5B6E0000-0x0000026F5B6E8000-memory.dmp

Download

memory/4956-15-0x00007FFB193CF000-0x00007FFB193D0000-memory.dmp

Download

memory/4956-70-0x0000026F7A760000-0x0000026F7A8B4000-memory.dmp

Download

memory/4956-66-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-63-0x0000026F7A370000-0x0000026F7A3A2000-memory.dmp

Download

memory/4956-20-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-16-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-18-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-22-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-21-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-19-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-45-0x0000026F7A7E0000-0x0000026F7A974000-memory.dmp

Download

memory/4956-35-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-34-0x0000026F7A320000-0x0000026F7A370000-memory.dmp

Download

memory/4956-25-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-24-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-23-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-321-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-322-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-323-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-324-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads