82d485cb8b980a3cec1d197f29b65492f465d6c925c7c22d202c893faae6258b

Analysis

max time kernel
149s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-05_b509ec7b8e1d4e44b1a54e6b8cffe40b_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Size 2.4MB
Sample260605-mag2caex2k
SHA256 82d485cb8b980a3cec1d197f29b65492f465d6c925c7c22d202c893faae6258b
MD5 b509ec7b8e1d4e44b1a54e6b8cffe40b
SHA1 b86505c4f09e08832181b32cdbb1ea68a0ce3f84
SHA512 3ab934d59b8d0d28ef34541f522d4e04902e48995dd2c696e96322c3731f6a6b8cf21357df3a35cd08a2c8cd9c3694202b5b3aa5f8a71c10a5e45c3abc68e672
SSDEEP 24576:QphXBJF/sEEznSRpiFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTC:ahRDO4piJkGYYpT0+TFiH7efP1Q9Oho
TLSH
T135C5BD02B3D656B5C47F0678987A961AAB70BC040316CBFB57D4AAB92D337C04E357A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
2	612	dfsvc.exe
2	612	dfsvc.exe
2	612	dfsvc.exe
2	612	dfsvc.exe
2	612	dfsvc.exe
2	612	dfsvc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\9HTWH6PX.Q5B\MQDE2MNH.THE\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-05_b509ec7b8e1d4e44b1a54e6b8cffe40b_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf\implication!scre..tion_0000000000000000_0019.0008_1a8 = 68747470733a2f2f626b64322e616d626b3236302e72752f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_none_1cf80910917bd01a\implication!scre..tion_0000000000000000_0019.0008_1a8 = 68747470733a2f2f626b64322e616d626b3236302e72752f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0008_none_f3caa247ba01622d\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_e1bdac30d28dd4e1\scre..vice_4b14c015c87c1ad8_0019.0008_none_f3caa247ba	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0008_none_46eee1e0609011f2\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf\DigestValue = 5ba95918731df980a71a036b1d5a38a60291070f	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0008_none_f3caa247ba01622d\SizeOfStronglyNamedComponent = e451010000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d1339154c6\lock!080000003013590e64020000680600000000000000000000 = 30303030303236342c30316463663464343435316639363831	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_none_1cf80910917bd01a\lock!040000003013590e64020000680600000000000000000000 = 30303030303236342c30316463663464343435316639363831	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0008_none_46eee1e0609011f2\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0008_none_427709ff2441fec2\Files\ScreenConnect.Core.dll_b96889d378047e27 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_e1bdac30d28dd4e1\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_1a838af9e7370e0a	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_e1bdac30d28dd4e1\scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d133	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 54007200750065000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0008_none_f3caa247ba01622d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_e1bdac30d28dd4e1\lock!110000003013590e640200006806000000000000000000009c11a = 30303030303236342c30316463663464343435316639363831	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 0000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d1339154c6\implication!scre..tion_0000000000000000_0019.0008_1a8 = 68747470733a2f2f626b64322e616d626b3236302e72752f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0008_none_f3caa247ba01622d\implication!scre..tion_0000000000000000_0019.0008_1a8 = 68747470733a2f2f626b64322e616d626b3236302e72752f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_00000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_none_1cf80910917bd01a\SizeOfStronglyNamedComponent = 7c9e010000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d\Files\ScreenConnect.WindowsClient.exe.config_f7f = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf\SizeOfStronglyNamedComponent = f98f090000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0008_none_427709ff2441fec2\SizeOfStronglyNamedComponent = 73b8080000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0008_none_427709ff2441fec2\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d1339154c6\SizeOfStronglyNamedComponent = 1f50060000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0008_none_f3caa247ba01622d\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d1339154c6	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0008_none_f3caa247ba01622d\lock!100000003013590e64020000680600000000000000000000 = 30303030303236342c30316463663464343435316639363831	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_e1bdac30d28dd4e1\scre...exe_0000000000000000_0019.0008_none_6f725b0891 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0008_none_46eee1e0609011f2\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d\Files\ScreenConnect.ClientService.exe_e781b1ee36 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d1339154c6\Files\ScreenConnect.Client.dll_fc1d7bd48553fcab = 01	dfsvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\OnlineAppQuotaUsageEstimate = "3815523"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_none_1cf80910917bd01a	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_1a838af9e7370e0a\scre...exe_0000000000000000_0019.0008_none_6f725b0891 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0008_none_46eee1e0609011f2\Files\ScreenConnect.Windows.dll_fc0d83aff7df0b5b = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_e1bdac30d28dd4e1\implication!scre..tion_0000000000000000_0019.0008_1a838af9 = 68747470733a2f2f626b64322e616d626b3236302e72752f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0008_none_46eee1e0609011f2	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "C8OT957X4P0X4MBLZXTB9MP9"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 680074007400700073003a002f002f0062006b00640032002e0061006d0062006b003200360030002e00720075002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006d0061006e00690066006500730074000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_none_1cf80910917bd01a	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0008_none_f3caa247ba01622d\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0008_none_427709ff2441fec2\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d1339154c6\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d\Files\ScreenConnect.WindowsBackstageShell.exe_89 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_e1bdac30d28dd4e1\scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d133 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\NonCanonicalData	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\9HTWH6PX.Q5B\MQDE2MNH.THE\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\C8OT957X.4P0\X4MBLZXT.B9M\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2704	2026-06-05_b509ec7b8e1d4e44b1a54e6b8cffe40b_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Token: SeDebugPrivilege	612	dfsvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 612	2704	2026-06-05_b509ec7b8e1d4e44b1a54e6b8cffe40b_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-05_b509ec7b8e1d4e44b1a54e6b8cffe40b_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-05_b509ec7b8e1d4e44b1a54e6b8cffe40b_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  PID:612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\C8OT957X.4P0\X4MBLZXT.B9M\manifests\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d.cdf-ms
Size 14KB
SHA256 4a6b538a92c3936d6b95230097ab7495afa236f91da37912ecd7b748af1e099c
MD5 31a5aa7886340dea38165404dc73538c
SHA1 031af55e8c4f13ddd6e375004909694675d88993
SHA512 95a2610a23b4ea59d15b867dc377dc2b1841602cad4d8bcfbee9c3244cd0a85a607b781ae98b1166fba26dc920740f77f06ae8a436ac86524640fdd1ab855af0
SSDEEP 192:ydzwHH/JmOD3RW/l9eTVrOsV0rxrhKOCS3EH17g5/WH4:yinhfD3RWN9eB2h9PWH4
TLSH
T1BB62B601B7D2E837E2551733DCE6C2E47232BCE55F96135B30853B2EAD302D98AA3695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0008_none_427709ff2441fec2.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\C8OT957X.4P0\X4MBLZXT.B9M\manifests\scre..core_4b14c015c87c1ad8_0019.0008_none_427709ff2441fec2.cdf-ms
Size 3KB
SHA256 004f271434723a5148d34edd91ca61736ebf1b17d16276ed4be1c9a2f6d7bcac
MD5 26331fa274904fb8e84cbe65e3e90d07
SHA1 34ea9993f08c03320a0fcb8c0029a744c1fc508d
SHA512 1a7cad9b9de04af6f75dd930180cdec800d4043cc0a93061e63048985f116ae9fdbc84d5db5b722c48259432689a7195ddb4c3f0bc0e365fe47e440aa429a45c
TLSH
T12861AB02B644EA13CAA90273ACD5D2EE77747E83DF82460B74C4BF2F7A316F656111A1
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0008_none_46eee1e0609011f2.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\C8OT957X.4P0\X4MBLZXT.B9M\manifests\scre..dows_4b14c015c87c1ad8_0019.0008_none_46eee1e0609011f2.cdf-ms
Size 5KB
SHA256 072454a895e516552a6407de1f343f76c452d9458940d9aadd0d855773896715
MD5 348cbbc886b9f03339d6b43830df747e
SHA1 b988e332716cbb48e494fd1bb70876268ca843cb
SHA512 20baa71e3cf6b581adfecdbfde26cc7ebf796152bf31ede9ca2731abaae311c518c642ae9c0f6dfb84ff7816449060ca9edf49a5ae54ca990e565f538d01f831
SSDEEP 96:iqP+RxlQheV+Ww7SWk/WGgyHmzSNp9QHAz2+8oZaV1nngnsR6O:CRxlxJDvOMrvOAX8oZaHnQzO
TLSH
T1CEB121117304D917D5B90633ACA9C3ED2B287D53CE83461B30D8BF6F76326EA4721165
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\C8OT957X.4P0\X4MBLZXT.B9M\manifests\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf.cdf-ms
Size 6KB
SHA256 de8f6b40607112434f1c33bf51e4409f274ca82fa2b475c6452f2c0bdddbc043
MD5 501e2b4e3e7da888f1ee4812f33793b0
SHA1 bfa38aecc5a2d75eb91cf71b3876c33f25cbfeb6
SHA512 a745b69115d17b7afa14f0275f488b1af8ca24b303f2933100544f3900feb0af68b8b254546d0f04744ac03556f282ed89b802e8ad3d5876bb9b317f590abd8d
SSDEEP 96:wMWhDMPP/p/eV+WwwSE8WG2TOt0O6gG56OL6rsrHFrlz+tnsVoeb:aZMPP/+JK4GZ0QG56OOMFh65sT
TLSH
T195D1ED227304EE17D5B90A33AC9AD3DE27687D56DE42470B70C4BF6F7A322A61722191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d1339154c6.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\C8OT957X.4P0\X4MBLZXT.B9M\manifests\scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d1339154c6.cdf-ms
Size 2KB
SHA256 13cf91f9aae6c5dca3b4e1ebf00bdb29c53b33f2924f4cc377b21b9848a34c9c
MD5 13eca91f33c5fbc2f4d5deb7863f3bbe
SHA1 532ba2c37dbd0ab6c8f365fd886438033b8d97a3
SHA512 de6a701f12908d71fef656a36b8ca71388c761e0c8862f00806b73223ead0a2017870f9815387c3268a9c0e34ac9ea4bfb10188ef6f9eb8eaa38f655d07edb34
TLSH
T14051D0003648EA67CA6A0632ECA1C2DD32757E86DF460307B1C07B7F6E312D54B530E2
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_0019.0008_none_1cf80910917bd01a.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\C8OT957X.4P0\X4MBLZXT.B9M\manifests\scre..tion_0000000000000000_0019.0008_none_1cf80910917bd01a.cdf-ms
Size 4KB
SHA256 eb3215f208116d6f0d132388790c20f767173ab4a67d29b6488e29dcccd3d8c5
MD5 d8f4c05093e85a0bf2d2ccd2d2f4ff3f
SHA1 0dca5e991c2b0a10b08a62bd8ca25baf26f7d9d4
SHA512 ca7922ae689882535c78631d7d7e6cccc3bed9836fd2f957080b662703da431b1e283e14ec8cd1a5c430b51b1b0b7b9d9144ce4bb498c2c32e5ef7add77aa54f
SSDEEP 48:IP/mrIgAqzIve9gRRu9o0m5RD7L9U7gFUTUEekKfYsQgbmZFms4Ch+UQRcchd:6OUOGTEW0m5R/L9Um9kMQPfmvVUQRtL
TLSH
T113911E80B780E823D6144733ACD3D2D032357DE60FD6971770887B2FAD367869622666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0008_none_f3caa247ba01622d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\C8OT957X.4P0\X4MBLZXT.B9M\manifests\scre..vice_4b14c015c87c1ad8_0019.0008_none_f3caa247ba01622d.cdf-ms
Size 4KB
SHA256 34c443990787db646aa338843d6525ae3fdb25da3e3ffbaece50ebaf75677726
MD5 4b95f9a37373a25cd3a43c2ad047c0f2
SHA1 2c6062820ab3a1dc540c5d2abaccb558eea09086
SHA512 8aa626338d25d3c18bfcff4369093a40c71c43afc1974e253e61904310d0dbac70f7edc7be380d7ce1392d193e0d462f28efa2d1b0a865d04e83408e5d9028c7
SSDEEP 96:cdQeV+Ww8SE45uaO+AWEPquimcWznDvuf:iJ6LuaiW2lzDm
TLSH
T194910D12B340E967D5B90333EC86D2CE6B31BD83DE82460B71C07F6F76716AA4B111A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\C8OT957X.4P0\X4MBLZXT.B9M\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d\ScreenConnect.ClientService.exe
Size 93KB
SHA256 63ae8c708ab99e4795298c68e3fc57a414f929f5914abd8c57232ca37f8c88e6
MD5 9f78d93eceb6287ec6556a55cb7637d1
SHA1 543f355e12862711931184e1c77a47883e40be39
SHA512 a0da5bf1014ec9fc03af6d19e5e9d850740bad03858bb30cb6673b97e8f5c9891e4debef1acc10fe1cd5e264b40cb1597afff17924461390546f5a6dc4a7993b
SSDEEP 1536:bg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg8U0HMG7Xxd:UhbNDxZGXfdHrX7rAc6myJkg8U0HHVd
TLSH
T163935B13B5C28872D573093158E0DAB09A3FF9215E61DEAB3788022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\C8OT957X.4P0\X4MBLZXT.B9M\scre..tion_0000000000000000_0019.0008_e1bdac30d28dd4e1\ScreenConnect.WindowsClient.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

G3R6C90L.HRV.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0XR0596R.X2Q\G3R6C90L.HRV.application
Size 99KB
SHA256 e0f9f259bc4c87536387843bb5b626781e0cb8aacacda1a017349e8a3e01d7cd
MD5 dde0fb76c074a4d1c1420d0cb8337baa
SHA1 15646327c97bd5f73030b8a7124e7d4e873c901f
SHA512 e76acb3dd7373beadf5eb140a01e54340fa861de372fb3ab9d22437ca85faaffc6a6abe528b430ad6960678cab9bd6f65ee9c6480a318a9982632219967c632e
SSDEEP 1536:I4Bp875Amki10M5n76+8rJsZckAGSZNVNzWJJ29ymgoUbyV:I975AiqM5n76+syMVN6K9ymD
TLSH
T186A3423A8F30F5C0477DB021D1A52D673D811B93DB730BACDA0A186A0E69796EF5E64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9HTWH6PX.Q5B\MQDE2MNH.THE\ScreenConnect.Client.dll
Size 400KB
SHA256 c8901f627cb7a5502d6726792c56aff9a94d2c2be0411ac53c8a5b75cbe37dcc
MD5 a3c43d75e1b611e607ebe91fbe5cd7ed
SHA1 3eae8d3f27f5f2f5fab3d015b8ed6d3a45b9fd6e
SHA512 087ada3a0207ce88757d35a3ab563a26d42cedba021be44c7d550266039e2be33d7f8c296958f610acea6b77c51c55ea9b188e2c97fbb5576d216904d982f43f
SSDEEP 6144:7MSiC+YXJN9ZvH8ETEavHy+vd7JPYIYyqQni65/PG+:gSF+45HHTEavSW7OQni3+
TLSH
T1F594CF85B3B44D2DFEAF0A37F46081258E739C456552F66D0E44B9F80AB37A28644FE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9HTWH6PX.Q5B\MQDE2MNH.THE\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 88fd90d366adc732fb776a8840ef28bacdf70724c9513ff21605c6c0c7509e6f
MD5 2059b0cb6c221a1a6ea9341b27af954f
SHA1 699865a6e5a53e3622f8beed2bc1d06f829176ef
SHA512 6414c1c24db740c7db12ab0b1914992d4b28d11aec640a2393cf16d7b165d243db33c2d05c0957b5c38487ca2648a12e6a537671bf59b77aab29921318b6fd12
TLSH
T1A0115C0181C8F9261F3301D1BEE7E021A76D1B33048D1547B069686F8B29AD74347173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9HTWH6PX.Q5B\MQDE2MNH.THE\ScreenConnect.ClientService.dll
Size 78KB
SHA256 badd627ff97136084e9c811a5400d32e9584eaebc9209a65333aea7f5153d480
MD5 3aded48ac715aee952d445a81b051843
SHA1 1485daaae9b3ec2dc1e03c1229cd156b70b34ccd
SHA512 0528999dbca8e1636f384d8eaa015ba1b1a3b0e9e3e46008f5d754d607eb166748583e00385ede1b2dd99513da228529cbb126265fd1bd922137c37818de414b
SSDEEP 1536:r7nnFxZ5/ZSXj+LFOPB8PrHwEkRQXV3lTH2obPFw7NI:r7nZ5/ZSXjgFqKPrL+QXVFHFwu
TLSH
T128734C42E3BC4E26C9DF4F38B465B0450FB09A0294A2F7E99DCDA4F61B467C12A143DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9HTWH6PX.Q5B\MQDE2MNH.THE\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 8147e5d137a6684ff7114ce382eb5fa23125882b04ea497d2e9f3192b688571c
MD5 2859234383f70894445dd360faa6b3cd
SHA1 523af10a8e3f1841bf91d5b1ce3f08ee8298c6f4
SHA512 2ed4f41ace3bf12d5dbe2aa068f855bc30d7dd1ba4b6120d31cd9e072ef66d362ab92e8d4aabb1d13b6440d5fc9c57b776d413a644151469663b9ed148c9d09c
TLSH
T10931E90641C4FA251F3301C1BEE7E061976D1B33158E19477059599B8F2DAA7438B177
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9HTWH6PX.Q5B\MQDE2MNH.THE\ScreenConnect.Core.dll
Size 553KB
SHA256 4dc65c2ec967f80c61d98fe5734869c6e9debaa99c063cf56086740aa4a072c9
MD5 be19cbe04549a8cf605a5aa37dd3b2da
SHA1 de7b86e45f09d1d5ae0d55e3cc6dcc07ad09d8a6
SHA512 8ae256df5b4878ae0bf76ea29119cdcc3e9a1b84ba3b3386f75b0810f7b16bb1ae9c102f20bb5076e2c6b5ab996307e737f472c17eec605d0a11ad5059e8316e
SSDEEP 12288:tx6Uvha0XYZB2N/R6qIs22VF/sbbGHEznIX:FhXBJF/sEEznk
TLSH
T12FC46C1333E8873AC67F0BBAF120D9154A71E911B30AE75B1A99F4E52D823894D4C7E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9HTWH6PX.Q5B\MQDE2MNH.THE\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 d25ba6b9e5247ed772b247f70c1df44070d7de2a2d81d495c590fd9fbd8d6f4c
MD5 0141148aba6e1e515e2e898902a87535
SHA1 3577b62bb9439b6a7931c15fae11e05b42aac677
SHA512 3d22666adfe978f9d0a94b7912a6dd5acbe811e6b953d229f9a0a1a5e81c27a590e4a4206571a91c5dc5625beb53e4826819856c75d84ac224713b8eb601a4f4
TLSH
T11721670181C8FA261F3302D2BEE7E42197AE5B33188D194B7469689FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9HTWH6PX.Q5B\MQDE2MNH.THE\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 4913381885979aed0233ac2a3401eb597b8c0ef37ac3f96b497901f95f251d26
MD5 9a3d026f2549ad04bb14102ccc94d633
SHA1 38c137f1584e4797e39a85439f3ece01a192bd39
SHA512 3cf1c7b5b095473ded49edf4aa646a17f06fee480fcd1a3c2334cf5d98925f4c79e61193466434a33585b57121066853d3a1c319265995a98904bef86859f734
SSDEEP 24576:9RpiFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUT8:DpiJkGYYpT0+TFiH7efPt
TLSH
T17185AD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE356D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9HTWH6PX.Q5B\MQDE2MNH.THE\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 de921e4e98c8fc3d976a482dbcf0f2a3df270b27cb4942026958c453d88de1e9
MD5 a0dda458757bc089901f40b07b1c6549
SHA1 f6f97d3c71df1873fa06b066628c422cff1d14af
SHA512 fb24e22c6e0d1020a5871d76e570fbd459cb3c4872f41c5cb095c21fa1a331ee47d9508fe0c9606ad38ba686e1a503b5f3d71d9bc6e3a560962b3ea8bb4d2595
TLSH
T19B41D31281C8FA250F3301C27EEBE431979E5733158E194B7499A99BCF29AD74787037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9HTWH6PX.Q5B\MQDE2MNH.THE\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 0dd3250f1e179a89ce0b8ed3eac64c7513ac5cfbba2f6d43fb9aa98887086f3d
MD5 664718a968e0f697cdfeb600baecd10f
SHA1 aa7f417852ee1471a4e751046face0d4571c808f
SHA512 c94016d328584a82f137b2693cf55955ab14c7650da0b43a2e88a132a89e0df86788f8025aac078c1259344f95a3c18ed118bb76282732e85ed1a351c304ce83
SSDEEP 1536:6oSOs/MRZFe9aSNDvmDTyQX5E+TC7Eh2syGbYK7wC:6oTsCZFe9NmyQOOcK7
TLSH
T10C538E4163E84615C9FF2E7CB8F2A1141EB1AA439441EBAE0DCD65EA1E537816F203F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9HTWH6PX.Q5B\MQDE2MNH.THE\ScreenConnect.WindowsClient.exe
Size 603KB
SHA256 57dfe3b0a64a84102d4113d3b21fa49d961d55cdaba5be263dcd850f6c31fa47
MD5 906624dc96dd029a7d16fddc0cb7f56d
SHA1 5ba95918731df980a71a036b1d5a38a60291070f
SHA512 ae24c5b1770c891db3057c9389446bee8856712577beea2c9b4d342681bb286ff151bb6138c07f2f7c0c4518ee31ef640f26d2ccb713b32cb7fe21d6853910c7
SSDEEP 12288:UmREZ5mKf2cQF7t590iglIUGrpDk+n0zT5gSTX:imKfo2StDj03iSTX
TLSH
T157D46C22737CDA3BC8BF07B8B0F3182457B4EC056685E79E4940A5EA0DD73899A543E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9HTWH6PX.Q5B\MQDE2MNH.THE\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9HTWH6PX.Q5B\MQDE2MNH.THE\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 259d2e52d727b7154b29f598e6437b9e51fe47fffd92de3af22bc497e7244339
MD5 caa9ac16ace0682a0c702aa321c25ee9
SHA1 1063153e85f2c5da89d10a2f4efba9a2db2dd5c7
SHA512 1cea0465e44442e9be9ebb3ebb498352908816b646b449a1817a75eb59ce51430928115b909f488c36c84d262e6f7698634fad9d457bef327f9cf281843ee8fa
TLSH
T19251B40641C8FA210F3301C1BEEBE471979E5B32158E19477099999FCF2DAA7478B137
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9HTWH6PX.Q5B\MQDE2MNH.THE\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 646c8a503886dec81c74db3c0365aa116a8548ad38564d4063ae037b9d3dcc9b
MD5 532579d5fbed70f6a29447ba291ae8cb
SHA1 e9d36ea53aa9fae3b88de24694b04bc0516b94e5
SHA512 d81165d53a41095836ec8364b2acf87fc3d327e961dc2c3d0223589cf452a6cdc313704d58eba1fb2421810d5cc2a098f6ef0da631dfe9b9288299f85888d654
SSDEEP 96:xWLwOhoyTjHe2wvyDk/rkvkK8k4kaqkh9kW4kOpQkOprkOAkOpD:oRreP/AcKp9cheW9UFUAOVUD
TLSH
T1D4F19B9684C0BD21573291C0FEE3D924BE157F3302AE148ABC4D19AF9F765499B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9HTWH6PX.Q5B\MQDE2MNH.THE\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 794fe19e18b99187b3a6c69f5c11e6f977304363f07028d4a498f647ddc7c497
MD5 b73f9c75e19ef9778eac3235b35299a9
SHA1 737e5a024bc4ece16c96518b037c88aa0538be81
SHA512 5bd6165ef6ca6b5ddbc8aa0492adbcf768d62aee7a0631ec70b30c0e9a45c037bb757569d027b0538e002b628c2d1b47a73f4c8ab04ad41c3310293d3c366bef
SSDEEP 1536:HtyGl44DzbmI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7bZ72:EA2ukLdnZa
TLSH
T10583E58235762231DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03443A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/612-50-0x000001B93D990000-0x000001B93DA2A000-memory.dmp

Download

memory/612-11-0x000001B939140000-0x000001B9392C8000-memory.dmp

Download

memory/612-56-0x000001B93D980000-0x000001B93DA0E000-memory.dmp

Download

memory/612-44-0x000001B93DC50000-0x000001B93DDFE000-memory.dmp

Download

memory/612-62-0x000001B93D960000-0x000001B93D9C8000-memory.dmp

Download

memory/612-40-0x000001B91D890000-0x000001B91D8A0000-memory.dmp

Download

memory/612-39-0x000001B91D890000-0x000001B91D8A0000-memory.dmp

Download

memory/612-36-0x000001B93A690000-0x000001B93A6A8000-memory.dmp

Download

memory/612-31-0x000001B91D890000-0x000001B91D8A0000-memory.dmp

Download

memory/612-25-0x000001B91D890000-0x000001B91D8A0000-memory.dmp

Download

memory/612-24-0x000001B93A4D0000-0x000001B93A520000-memory.dmp

Download

memory/612-15-0x000001B91D890000-0x000001B91D8A0000-memory.dmp

Download

memory/612-10-0x000001B91D440000-0x000001B91D448000-memory.dmp

Download

memory/2704-12-0x0000000005290000-0x00000000052A0000-memory.dmp

Download

memory/2704-0-0x0000000005290000-0x00000000052A0000-memory.dmp

Download

memory/2704-13-0x0000000005290000-0x00000000052A0000-memory.dmp

Download

memory/2704-9-0x0000000008190000-0x000000000833E000-memory.dmp

Download

memory/2704-8-0x0000000005290000-0x00000000052A0000-memory.dmp

Download

memory/2704-7-0x00000000054A0000-0x0000000005532000-memory.dmp

Download

memory/2704-6-0x0000000005950000-0x0000000005EF6000-memory.dmp

Download

memory/2704-5-0x0000000005270000-0x0000000005294000-memory.dmp

Download

memory/2704-4-0x0000000005310000-0x000000000539E000-memory.dmp

Download

memory/2704-3-0x00000000014B0000-0x00000000014B8000-memory.dmp

Download

memory/2704-2-0x0000000005290000-0x00000000052A0000-memory.dmp

Download

memory/2704-1-0x0000000001480000-0x0000000001488000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads