e417460b48b8b1e3f3c40dbdcfe18f6221a5585806b433f2500e79e51eddc2bf

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 22:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_5d5578879d7fbd452c7b362a5c08afea_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Size 3.7MB
Sample260628-18v8hsft2v
SHA256 e417460b48b8b1e3f3c40dbdcfe18f6221a5585806b433f2500e79e51eddc2bf
MD5 5d5578879d7fbd452c7b362a5c08afea
SHA1 72490ef809f21d57b73436bdc21bd807e14a7cdd
SHA512 1446bde4ce05ad1e569daa4205cfc8d42e431545e32e18b70cfe969a4ad39a9371e9eb25d6b8026c7e66dc87e6ef9dad2e423a063e10eef33c5f65538cfc3cff
SSDEEP 49152:WiB06hHeGbYcEQQuvZ2JkGYYZTk+T1iH7efP1/8ZTki8ubwqB:WS061e4XRbM6efP1/2Yi8uUW
TLSH
T14206CF49BBC6A667C47E063588766315A3B0F4814763C7FB6AD4AB3D1C323D06E293C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
27	3960	dfsvc.exe
27	3960	dfsvc.exe
27	3960	dfsvc.exe
27	3960	dfsvc.exe
27	3960	dfsvc.exe
27	3960	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
3572	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\56R8RJH4.Q62\2LN5K6R7.N1Y\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_5d5578879d7fbd452c7b362a5c08afea_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0001_none_0b03d694d1d8b73f\lock!10000000fe10590ef40d0000501300000000000000000000c = 30303030306466342c30316464303734633437343238643133	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_0fdfe13b4aaaa6fe\LastRunVersion = 68747470733a2f2f73632e6673692e75732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32352e393539322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e312e32352e393539322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0001_4561645c2c77d401\appid = 68747470733a2f2f73632e6673692e75732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32352e393539322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0001_190d69dbbc603f7d\appid = 68747470733a2f2f73632e6673692e75732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32352e393539322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e312e32352e393539322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede131\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede131\lock!060000006110590ef40d0000501300000000000000000000f = 30303030306466342c30316464303734633437343238643133	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_none_0b03d694d1d8b73f\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32352e393539322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee98\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32362e312e32352e393539322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede131	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947ec9e5d\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_0fdfe13b4aaaa6fe\LastRunVersion = 68747470733a2f2f73632e6673692e75732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32352e393539322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e312e32352e393539322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_000000000000000 = 680074007400700073003a002f002f00730063002e006600730069002e00750073002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e003f0065003d0053007500700070006f0072007400260079003d0047007500650073007400260068003d00730063002e006600730069002e00750073002e0063006f006d00260070003d003800300034003100260073003d00300062003300390037006300610033002d0032006200330035002d0034003700360033002d0061006600320035002d0064003100310032003400370031006600360035003000380026006b003d0042006700490041004100410043006b00410041004200530055003000450078004100410067004100410041004500410041005100420070006a007600470031006e00760041004f007000420046007600660073006600440056004f0054004b004f004a0036006e004500550064003800620075007600370044004200660054006b006c003400470053004d005300250032006600370070006f0031006d004b006a0056005600450042006c00360070006e007700680025003200620056006c00300061004e00720052006e00350053006b006d002500320066005500480064004c005700430073005600570069007200610031003000430053004400460058004a00730043003800560037003500630046007900250032006200470053005700780068004c0064006f00760050004400500056006d00710062007a00720073006a005700460046004b004b004b005600720072004e0074007500450055006e004700550074006f00490058005200350057005300610064004800660067005500700072004400790035007500580066005a00300032003600370069007a00440045004100350067004b003800510043006a004500560072006b00460043006900640041003700430044005a006a00490047005a0042004900640075006200680042003000570067006e00500074007a00310044006b003900500051004f00390036004b0045004700360076006b003100550065006300310074003800340044007600310055003200500053007400500050004b006b00550048006d004500380057002500320066005300500050005600350036007900560052004a00500079003000790078005000670054004a007400530038006c006b003500680030004900470055004f00690073003400630064004f00250032006200750079007a00630039006c0032007000760070006b0038007a00520068006c005400340067006e00590079004f004f0038006b003900370025003200660047007200420043006e004c00320044007000690051002500320066004c006b002500320066003700710075003400260072003d00260069003d0054004f004c005500430041000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee98	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_190d69dbbc603f7d\scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1ae = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947ec9e5d\implication!scre..tion_0000000000000000_001a.0001_4561 = 68747470733a2f2f73632e6673692e75732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32352e393539322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede131	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0001_none_37ead1580b9e8b2d\implication!scre..tion_0000000000000000_001a.0001_4561 = 68747470733a2f2f73632e6673692e75732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32352e393539322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9442\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0001_none_37ead1580b9e8b2d\SizeOfStronglyNamedComponent = 747c140000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947ec9e5d\SizeOfStronglyNamedComponent = 821a1e0000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0001_190d69dbbc603f7d\PreparedForExecution = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9442\lock!12000000fe10590ef40d0000501300000000000000000000c = 30303030306466342c30316464303734633437343238643133	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3a	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee98\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede131\DigestValue = 35f136a2f6c88fcc9f53e584a7fa899602a20b17	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_190d69dbbc603f7d\scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1ae	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9442\lock!06000000930d590e780f0000c004000000000000000000006 = 30303030306637382c30316464303734633431393164313533	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9442	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede131\lock!14000000fe10590ef40d0000501300000000000000000000c = 30303030306466342c30316464303734633437343238643133	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3a\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32362e312e32352e393539322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0001_none_0b03d694d1d8b73f\implication!scre..tion_0000000000000000_001a.0001_4561 = 68747470733a2f2f73632e6673692e75732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32352e393539322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\OnlineAppQuotaUsageEstimate = "6245352"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee98\lock!0e0000006110590ef40d0000501300000000000000000000f = 30303030306466342c30316464303734633437343238643133	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_4561645c2c77d401\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0001_none_37ead1580b9e8b2d\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32362e312e32352e393539322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_190d69dbbc603f7d\scre..core_420d02d3849b7992_001a.0001_none_37ead1580b9 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3a\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947ec9e5d\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947ec9e5d\lock!0a000000930d590e780f0000c004000000000000000000006 = 30303030306637382c30316464303734633431393164313533	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee98\lock!1c000000fe10590ef40d0000501300000000000000000000c = 30303030306466342c30316464303734633437343238643133	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee98\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0001_none_37ead1580b9e8b2d\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede131\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0001_none_37ead1580b9e8b2d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9442\implication!scre..tion_0000000000000000_001a.0001_4561 = 68747470733a2f2f73632e6673692e75732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32352e393539322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_190d69dbbc603f7d\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0001_4561645c2c77d401	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_190d69dbbc603f7d	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_190d69dbbc603f7d\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3a\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3a\lock!0c000000930d590e780f0000c004000000000000000000006 = 30303030306637382c30316464303734633431393164313533	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede131	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0001_190d69dbbc603f7d	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_4561645c2c77d401	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\56R8RJH4.Q62\2LN5K6R7.N1Y\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\7Y6NTYJO.V6G\A5GB9CPY.RZP\scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3a\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4316	2026-06-28_5d5578879d7fbd452c7b362a5c08afea_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Token: SeDebugPrivilege	3960	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 3960	4316	2026-06-28_5d5578879d7fbd452c7b362a5c08afea_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe	97
PID 3960 wrote to memory of 3572	3960	dfsvc.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-06-28_5d5578879d7fbd452c7b362a5c08afea_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_5d5578879d7fbd452c7b362a5c08afea_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Users\Admin\AppData\Local\Apps\2.0\7Y6NTYJO.V6G\A5GB9CPY.RZP\scre..tion_0000000000000000_001a.0001_190d69dbbc603f7d\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\7Y6NTYJO.V6G\A5GB9CPY.RZP\scre..tion_0000000000000000_001a.0001_190d69dbbc603f7d\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:3572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9442.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\7Y6NTYJO.V6G\A5GB9CPY.RZP\manifests\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9442.cdf-ms
Size 14KB
SHA256 81f30ccdca51b5553dbdf6b22c523e3ba88e25eaa2e08179e85b2001fc269ee2
MD5 e069d8d6be634d22b306e7c1b4bf11c1
SHA1 abc776c6c519d419a1c129060f206efb4d935bbe
SHA512 186d68d49e5cb3248aabd3bf747b5e387c803787b78bfc49de20510e59f95b798579989500e8cbe16330c00912c9e971e6239deaa4e7587979a93dd7f8bd6426
SSDEEP 192:gGwwHfSWoK36LvQi8dGIG7mlRGU2mSl1V4Wl6WiK72Ca6AGGTLX3KOE4:g4jr8Qi8d1scF2R/4KMTLX3KF4
TLSH
T181620EA2FA9AE82EE3611A32DCFAD5B77F523D9A2D7120473044332E4D38355BE27145
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0001_none_37ead1580b9e8b2d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\7Y6NTYJO.V6G\A5GB9CPY.RZP\manifests\scre..core_420d02d3849b7992_001a.0001_none_37ead1580b9e8b2d.cdf-ms
Size 3KB
SHA256 f24f6cbcf6f5eadf7b11639e5474ed25909bd1fa93f2bac7145ac5c11b9054d9
MD5 0a1effb7037857e75765c1df903c4994
SHA1 a223ed4c9b3c9c2b6ddfd4c35c64b8f42cd32a69
SHA512 03b3e6c6b87906525079251e0c9b26baf5c9e468ff01813d4424c78a5f931f4dda77933a7a8e71edc885b9ed6e8fdfd44c4dccf910b84895ba223b82d9edb5a4
TLSH
T1F061DB067244DE07ED6A0233BCD2D3ED6765BE93DE41430B70C0BF2F7A322A65611295
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947ec9e5d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\7Y6NTYJO.V6G\A5GB9CPY.RZP\manifests\scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947ec9e5d.cdf-ms
Size 5KB
SHA256 0f24408b3b8a823d930bf5406c4568cf3519e482b4adadd90fd8bad28ef2794d
MD5 a072246f7fea0b4e2847fdbd833bbc83
SHA1 3511f0e897bc305def55735f698614415644ac9c
SHA512 2c4baa4df560b6fbfa8bc0e6e4f74b804f279576daaec8630b472f9b8a7d4149e957ae73de3cc67f7bce0ea9bda36aef4f19870274c7519eb916ad5fbd69c286
SSDEEP 96:tQA+RxU9LweV+Ww75IIOhF9qXNuKA0v3MgiqPMO:mRxUNfJ7I4MIjpO
TLSH
T1EBB155117290DE27D5B90633AC96D3ED3A367E92CE03430B70D4BF1F7A326D65222585
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3a.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\7Y6NTYJO.V6G\A5GB9CPY.RZP\manifests\scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3a.cdf-ms
Size 6KB
SHA256 5c1f2350faf15769dec46711de74c086b8f2165d67253aa6978a015de7f04c9c
MD5 7d547dddc2c01898bee87eaf2984a0ed
SHA1 94189aa4f279a252794ee5ccab40ee2bddbb16c0
SHA512 894a4fc0806e7cc1c5a3e3e3e7be6db8da211fbb241ae0030b5234fd61690cab6d00feb5cc842ed8211084e24deec445eeddc71714a1cc678952c1cd2e3c0228
SSDEEP 96:z6/qaunTO5meV+WwwV867OLmwz2ke60P5fsVdH47a:+CaunTOTJp79ZTxU7
TLSH
T138E14305B294EE17D9690633BC96C3EC66257EA6DF43470B70C0BF2F7A727D62212085
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede131.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\7Y6NTYJO.V6G\A5GB9CPY.RZP\manifests\scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede131.cdf-ms
Size 2KB
SHA256 6d90a18e27d937c4924437f68f7a0ff9864f89e4948d81e96da960d4ecf15f78
MD5 0e295059340b0a7865a83ea4ef18f4f6
SHA1 345d56fd16c7c19743ce3c897d8b8a44e28ab6a8
SHA512 af9b16a7a4c925e86c2a5b90fbfa46b1fc6bf265c207a7aad43326ae7b47b32c0f4d86383faec46e338caf337c8e17c9e3adb9ad66297f610671c0cf18a12002
TLSH
T19D511F013709E677E6774731AC62D6D83BBD7E83DF44120FB1C0376F1971685961609A
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0001_none_0b03d694d1d8b73f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\7Y6NTYJO.V6G\A5GB9CPY.RZP\manifests\scre..tion_0000000000000000_001a.0001_none_0b03d694d1d8b73f.cdf-ms
Size 4KB
SHA256 9d874518d5d9ac46a6b2f1e2e785e4a9b6f9e88e9700ddb38857889aa17a7841
MD5 ca65c04060122dc605944c6e06965f48
SHA1 08f71b0320d38e0480068a2d41230aa37f83d047
SHA512 c776428f8d29efaa8457b86031bc35c04122ca46265a839d73a6f98ce74cc4bd22d7007233383ae1331aa29e236d9fcfe98fcedb4f0ea12ad7dab2d57fa34ba3
SSDEEP 48:wP/mrIBZAjIvvYgY2Ru9o0m5RD7dU7gFUTUEjkcXt4sQgbmZFms4Ch+UQRcq:COU6GREW0m5R/dUm4k+QPfmvVUQRn
TLSH
T184912080B780E933E6144772ACE3D2D432367DA64FDB571B30987B2FAD363C59622265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee98.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\7Y6NTYJO.V6G\A5GB9CPY.RZP\manifests\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee98.cdf-ms
Size 4KB
SHA256 18b4e9d4f04848df1add715b8b75cd399ecca79c18c00a8fc727878ba9336ac7
MD5 aa5c7b8ea38e327720c66e92e08d2259
SHA1 b179c10cd2d14c19a3e524bc68eeb4bf36a37191
SHA512 e37ea3abff882091740d61fd6698642fd84ec35a85480b91d6a4440343df9dd682f525b83660741ee3796241c66c4c9091c208e983e7b50e0b3e391c9199f864
SSDEEP 96:RQxSONeV+Ww8V4cdO0G4huCvuNhKqszTDKuniV:7JHd5UC2NnsDoV
TLSH
T18BA1F0417385EE6BE5651633ACE1C3ED7A6ABD46DF02120B70C47F2F3A311D56722096
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\7Y6NTYJO.V6G\A5GB9CPY.RZP\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9442\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f603cf8fe05911f40778cf7bf9225b8967383b0f693014399074a50743a6a0cd
MD5 0d0f702f513525211398d6611e31f9c8
SHA1 4e063af05b5bd55f4d2cfa13b8ea8695f17f6805
SHA512 908a5423f0d00c33db79b31d1d133b4fac611e65e0cb360e2f7f5d3bb97d3d501afc374587ad855e818915a47276265ff1e666b02ff8833a037d06af0cb626b9
SSDEEP 1536:7g1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoT0HMG73:0hbNDxZGXfdHrX7rAc6myJkgoT0Hfj
TLSH
T18E935B13B5C28871D573093158E0DAB09A3FF9615E21DEAB3788022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\7Y6NTYJO.V6G\A5GB9CPY.RZP\scre..tion_0000000000000000_001a.0001_190d69dbbc603f7d\ScreenConnect.WindowsClient.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\56R8RJH4.Q62\2LN5K6R7.N1Y\ScreenConnect.Client.dll
Size 631KB
SHA256 3d1a0640eba8589ccbf85665b9b785daa3846ea4d68f5be3bc652d939661752f
MD5 210645b24bcb6fa4a6cb6e71647bd6b6
SHA1 35f136a2f6c88fcc9f53e584a7fa899602a20b17
SHA512 f30448e20bce0ecc02cf322e85182fec8f9813047157206a1c6108ccf0c4f4920b74a8338817b32e9822d7cd596ee784b6eb994b0a84f5e3a43530e95d8bf6b2
SSDEEP 12288:OYm5rp0NwZ0XS/7g3vzHTEavSW7OQninhaFXJp:OYmZp0PS/7W7zEn8qnhapH
TLSH
T10BD4BF4EAB59A92BF93E0B33E5D26614DAF17C8A8957E30F0D24767D4D723D027881C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\56R8RJH4.Q62\2LN5K6R7.N1Y\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 5ced1c162b04ebfd3c02f1da7cd9745397c64a8fcc129577e5b7057e3b203b87
MD5 88b5e766f1c9a1fb3d2ff2940b62f239
SHA1 3f29e470c5cac35d68d5360cb95c812e9ceee4ea
SHA512 083ce488ba1d54026437922ba61086153c52d06ecbeac7e331e2c88c146658737946369950eca54a6afd9ec6be7b08e7ee02f181837130cde8dd75f6c11fa1f6
TLSH
T1E5117B0191C4FA362F3342D1BEE7E420676E5B37058E194BB069685F8B29AD783470B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\56R8RJH4.Q62\2LN5K6R7.N1Y\ScreenConnect.ClientService.dll
Size 183KB
SHA256 b5f87442f0e3914a14ed47727adf078548aa90801c27ca948a23111080b61d54
MD5 28edb53dbeaf4a32c5c0508823f9a1c9
SHA1 5e986aacdb0de413e568f7b7a6caf597ea567db9
SHA512 95832a0fb11734244295b8c509e35288d56bb33563102011c0906c9d260ec80d01debe58b9c9ee8190546dcf7d788708e686bdb45e04e6f181e9f4bec336a6d9
SSDEEP 3072:h5wL+J+dn2yWuPkCemj2GDiLbT3lk3tqHUDwxd9zRQjVcY29bwMS:jzmzGGDine3tq/BdYT
TLSH
T1CE04BF87FB8DD866D59F0E3AE492B21002B1B457EAE7D34B7C8462DE1E557C42E083C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\56R8RJH4.Q62\2LN5K6R7.N1Y\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 8fa5969ebfeaa633f480ab3e86f51bb83ea23e779daaa7004f7c1f8565f4ff97
MD5 7b850e4beeb2b028eaaea5c484e96ac1
SHA1 867179291d5dcc888d7a3c7f11c426f64c7724e0
SHA512 337cf21cd0274161a48d1e164006aed6d09aef61199d3d201c2391fdcc3a97bb66ccec59f6ac6bc59a47c5059eb2cfa82e30781f8c965c8bf99df6e77ca47d98
TLSH
T1C931F60191C4FB351F7302C1BDE7E4609B9E5722158E290BB059695FCF29A97834B073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\56R8RJH4.Q62\2LN5K6R7.N1Y\ScreenConnect.Core.dll
Size 1.3MB
SHA256 55c4eb24d332b4b7a1151481ec45e560045f0f8d4d4452c62fe82cd982b4d5c8
MD5 09b9fd6e53a560f548dea157a42695b4
SHA1 215d116989a24b56ed8a06532f605c263eb505fc
SHA512 74ac45d64632fe9403301826510ef1477551cc30aaa00a9fddac36623258def5de834f1260f6602062090d1ceaab53b6efade77b0fe025bfa7f557b98ce20dd1
SSDEEP 24576:0iBZOvn6A4RJ3MfpSNVFpnnzyyLNTjtyggbFo9p/aAtCQHwu2H:0iB06hHeGbYcEQQua
TLSH
T1E255AD4E3F99A727C9BD067784606204A7B0E0E25B23D79B39A4E73D4C853E87D492CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\56R8RJH4.Q62\2LN5K6R7.N1Y\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 c7daae6b34b0c1727e757dfb293f767ee3d8eebd062a3b5906b555b215ccf402
MD5 2eec36964e2182d45c624fca370e5a75
SHA1 b5bf5421233c1e56fd254675f7c553b968bd9d29
SHA512 71a11cde25c748942a9c46ecbfe9c5a4dddd1eccc86854d2a88817e986a7489faca1ee14f339cadc39c8c0efe6404970d8883c73e6f14e66f067a48b397a6d08
TLSH
T1A5216A0181C8FB261F3302D2BDE7E42197AE5733148D194B7069685FCB1DAD24747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\56R8RJH4.Q62\2LN5K6R7.N1Y\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 4156c38f37d80a676438d9e419ebc835bcffd40625f160ab40df3b800c8c35e9
MD5 a9d69e85b4c9d20fc2e64df45f731508
SHA1 24ce79e6f91ea7cb4359032f9f1fd8029963cf17
SHA512 75771492157d30aff75a7393e769953894c206875a21f5e6c0d1e772e4ccda6245b1dcc757f950c383b84469f302df1d97fb42624e54ba2750413832c12e46ab
SSDEEP 24576:uKtoKFKXukRjJH2Fj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1ip:yZ2JkGYYZTk+T1iH7efP1/8B
TLSH
T10595AD81E6C364F6D46F047888BE632AA7743C040355CBFB97D4AA396D33BC09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\56R8RJH4.Q62\2LN5K6R7.N1Y\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 74a763d51639e87b910148dcdb95dd9ea6f0c45c8338b1e4c529d91948883492
MD5 e0f4a6663efdeef3d122d2605223c0cf
SHA1 977888d2955c1722e44cadc83597bbe7149e7ae7
SHA512 befc3a95f2cf098ed8d230c66fb09a732e0f1db5c9507240d63a5a13dca28154d637248b86aa4e9957f2dadc97f2b437b491911353346a47c0680c259e20ca3b
TLSH
T16041F11181C8FA251F3302C2BEEBE431979E5723158E190B70A9AD8BCF29AD78747067
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\56R8RJH4.Q62\2LN5K6R7.N1Y\ScreenConnect.WindowsBackstageShell.exe
Size 137KB
SHA256 ae78d3c99eb77618d73cb533d3123cf714f6ed383332d6cf039992c798f9819f
MD5 e0439380fe09f6027064cbea4d1bad74
SHA1 1ee565ac8c74d835bfc77c5ab6fa8060eaa33424
SHA512 e274271b30423757197cfb82d8a67f2dad51ea4a7266e5a623647713aca960d0ad6b1d6517a8a91a6c56bd476b1c24c88300227061e57528d7e73a01aecc39c7
SSDEEP 1536:VCztffhjm8NHUtDlsIEBOqb3/CZbsZIH1owNm4j8lKn4gCBpfvlDIxlKXywH+TCL:VSbRNHSYmZYZCoDWCBp+xlKClGpv
TLSH
T1C8D3AE407B59D626DABE0D3BA4E2B70146F0B493C9D7CB5E3D88267D2E04BC26F542C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\56R8RJH4.Q62\2LN5K6R7.N1Y\ScreenConnect.WindowsClient.exe
Size 1.5MB
SHA256 4cc8e2e708a2a3a4e7e385861ea1e20ff0ca674ba8829579d0a5ea255c76aa13
MD5 80d8ce7fb4bfbb0396bd19ffa44ca552
SHA1 aa6cb489ac6446f11f0bf5eed6d234dd6dc2755e
SHA512 a427c7cc494ce4aa5ad440a9180c47b193abe115942f52dc9a59ade613d832f4d2e87a2ee1cb6458b619af9f53fa184348548948d1822051422aafc3f19d785f
SSDEEP 24576:O0GVT0QuQKiD7KDTYzXcn2UhnNsDYT+GUkF:OMQzcxxqa
TLSH
T101759C5D7AC5EE2BC95E0B3A90612104B7F094A18F77CB43ACA4B77E6D513C06D18ACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\56R8RJH4.Q62\2LN5K6R7.N1Y\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\56R8RJH4.Q62\2LN5K6R7.N1Y\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 8f854476419cddfaec5635f8c527f64ee0972f1375f5487bbcf4913f7bb2a2cb
MD5 c99424e498ffdcd6d3350eff402e99f8
SHA1 4662daccb54b9ed33d77fc898cdcb3fa98d1b4dc
SHA512 0f567c111f3f46d08765ea8eb0b744620d517f17d4370b34afb118ba8d3409b75b5d542303e12aaffae3e126a3ec37f0b613ad700d48ea8036adae6130b3f6e1
TLSH
T1A951D31191C4FB351F7302C2BEEBE4709B9E5B23158E190B7099A98FCF29A97474B067
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\56R8RJH4.Q62\2LN5K6R7.N1Y\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 8f1a7c857af7cc3718e7fe14b0ad0c785a3f96a9235ded727aa9caee1ba1cbb8
MD5 05baf8761213075437e5335b41b63351
SHA1 fe6714901e4f5af2e8c2487b7247a6d5f16e7a09
SHA512 77e3817bd1a6dcd69e16cbfe5c3e66b9626aadabb405263f81d271d2f48d0e6b85c0326c9b95ad1c39950471c0453630c2fffd330aac2eb1550c6be15d5424ba
SSDEEP 96:xWLwOhoyTa+e2wvyAkay8Vk2fkak0sko5qkiSukD4kOpQkOpPDkeAkOpD:oRJeYay8m2sz05wnPD9UFUQeVUD
TLSH
T177F1AB9684C07D21573381C0FEE39924FD15BF63026E148E7C9D19AF9FA25899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\56R8RJH4.Q62\2LN5K6R7.N1Y\ScreenConnect.WindowsFileManager.exe
Size 118KB
SHA256 fd62d5929fae7835e8e9a70ff364fae4668abe06d0fcffee6dc917373edbc227
MD5 9f190ae9f42bcf259e63957724d259b3
SHA1 01fb8d64117099471e076fdaeb8cc48454846851
SHA512 240233a011da262ecf67274bf70d15a093cc0d77a5d62c110cf4202e51c3b38ea5e6290c6c62e4df7cbfe8da7f0c5f24df4d858ab10a32813bb9c811ec310c31
SSDEEP 1536:fn1sYu9j8dZgOItZhjviBBQS7g/DlcSKbI5BLP+VVVVVVVVVVVVVVVVVVVVVVVVd:P1ZAj8dZePhjsM/DeuBLNULCC
TLSH
T1B6C3295135256231DF85C433A452E9B099337F6607FEC6BE38A1BA3A29F03943E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

J7G5MDP2.NV7.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\EGTTO7PX.OB7\J7G5MDP2.NV7.application
Size 107KB
SHA256 cdc9c99ebd4253b95ce6c9fdc2db03455ba3692f871187a08286ef473f93546f
MD5 9d6da4706388881b47304283b4c47cc6
SHA1 b70404eddb6a1f0751477e1d2a07a38ef5012c8d
SHA512 cc864d414400c98a5d12512659312a5ed886127724a5d62d6d48f4376c0fd6ac6769c4ab309c0eecfe6fd41dec22a627ccea01e3e89d23671de8b43b326be5b1
SSDEEP 1536:A/ESd7y/iBHhe2WCRSmQfn4/5EHSZ5GE/uLTvooycuK+9uNbyIKQ/IuKE:A/r7y/YHhlWCRbW22XOcuK+9qeIX1
TLSH
T187B3943A8E30F4C0477D7021D1A92D673DC11B93DB730BACE90A196B0E69796EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3572-360-0x000000001B450000-0x000000001B482000-memory.dmp

Download

memory/3572-342-0x0000000000520000-0x00000000006A6000-memory.dmp

Download

memory/3960-13-0x00000236A78D0000-0x00000236A78D8000-memory.dmp

Download

memory/3960-58-0x00000236C68A0000-0x00000236C6942000-memory.dmp

Download

memory/3960-15-0x00000236C1E80000-0x00000236C1E90000-memory.dmp

Download

memory/3960-52-0x00000236C6B10000-0x00000236C6C96000-memory.dmp

Download

memory/3960-14-0x00000236C1F10000-0x00000236C2096000-memory.dmp

Download

memory/3960-17-0x00000236C1E80000-0x00000236C1E90000-memory.dmp

Download

memory/3960-30-0x00000236C6660000-0x00000236C66B0000-memory.dmp

Download

memory/3960-46-0x00000236C6A90000-0x00000236C6BDA000-memory.dmp

Download

memory/3960-358-0x00000236C1E80000-0x00000236C1E90000-memory.dmp

Download

memory/3960-40-0x00000236C67F0000-0x00000236C6822000-memory.dmp

Download

memory/3960-64-0x00000236C6BC0000-0x00000236C6DA4000-memory.dmp

Download

memory/3960-341-0x00000236C1E80000-0x00000236C1E90000-memory.dmp

Download

memory/4316-11-0x0000000006360000-0x0000000006544000-memory.dmp

Download

memory/4316-8-0x0000000005900000-0x0000000005992000-memory.dmp

Download

memory/4316-7-0x0000000005DB0000-0x0000000006354000-memory.dmp

Download

memory/4316-6-0x0000000005510000-0x000000000557E000-memory.dmp

Download

memory/4316-5-0x0000000005180000-0x00000000052CA000-memory.dmp

Download

memory/4316-4-0x0000000005070000-0x0000000005080000-memory.dmp

Download

memory/4316-3-0x0000000002840000-0x000000000284E000-memory.dmp

Download

memory/4316-2-0x0000000005070000-0x0000000005080000-memory.dmp

Download

memory/4316-1-0x0000000001030000-0x0000000001038000-memory.dmp

Download

memory/4316-9-0x0000000005070000-0x0000000005080000-memory.dmp

Download

memory/4316-10-0x0000000005070000-0x0000000005080000-memory.dmp

Download

memory/4316-12-0x0000000005070000-0x0000000005080000-memory.dmp

Download

memory/4316-0-0x0000000005070000-0x0000000005080000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads