c3963bf30eb6de6647a890ef827a306ca0637a99e41341bc753b6e7ed2a91051

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_593cd92a44ac7e0cb904f2dde1bfcea1_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Size 2.5MB
Sample260702-v7abrsaz21
SHA256 c3963bf30eb6de6647a890ef827a306ca0637a99e41341bc753b6e7ed2a91051
MD5 593cd92a44ac7e0cb904f2dde1bfcea1
SHA1 6349ff89cd8bfe73fda0c36e9945e2e692b3ec7b
SHA512 ff22b6a7e9e5c734c0fcf4903cd85fc2a1b1b24ae6749e3924a6148885075a984025293e35447256ad1e397e09f3fb03cdda84c8e55db24ca0116bb93791e305
SSDEEP 24576:kE9zm+OBbV5Z56jMK9jf5UNXFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+Rft:LcZEUNXJkGYYpT0+TFiH7efP7Dg
TLSH
T13FC5BE01F3D695B6C4AF0578D47A921A6770BC040366CBFB67C4A9B62D33BC09E357A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
12	2608	dfsvc.exe
12	2608	dfsvc.exe
12	2608	dfsvc.exe
12	2608	dfsvc.exe
12	2608	dfsvc.exe
12	2608	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
2612	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\B7LEWZBW.371\JPL2NTX7.8Z8\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_593cd92a44ac7e0cb904f2dde1bfcea1_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4\lock!01000000bbc0580e300a00009c0f00000000000000000000 = 30303030306133302c30316464306134393737316634643036	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4\lock!0400000010c5580e340a0000c80900000000000000000000 = 30303030306133342c30316464306134393764353633373436	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4\Files\ScreenConnect.WindowsFileManager.exe_0e21f = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_049eef78126018ca\scre..dows_420d02d3849b7992_001a.0003_none_3c7eaff348 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_049eef78126018ca\scre..vice_420d02d3849b7992_001a.0003_none_e95a705aa2 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_049eef78126018ca\scre..ient_420d02d3849b7992_001a.0003_none_ce1c35e41b	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0003_none_994db135f551829c\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0003_none_994db135f551829c\lock!140000002fc5580e340a0000c80900000000000000000000 = 30303030306133342c30316464306134393764353633373436	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_00000000000000 = 68747470733a2f2f73637265656e636f6e6e6563742e737566666f6c6b69742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 30000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0003_none_994db135f551829c\implication!scre..tion_0000000000000000_001a.0003_2e1 = 68747470733a2f2f73637265656e636f6e6e6563742e737566666f6c6b69742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0003_none_3806d8120c6d9f8f\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_eaf1fa2dc68b78cb\LastRunVersion = 68747470733a2f2f73637265656e636f6e6e6563742e737566666f6c6b69742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 68747470733a2f2f73637265656e636f6e6e6563742e737566666f6c6b69742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 680074007400700073003a002f002f00730063007200650065006e0063006f006e006e006500630074002e0073007500660066006f006c006b00690074002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320036002e0033002e00310031002e0039003600350030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320036002e0033002e00310031002e0039003600350030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e00330032000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0003_049eef78126018ca\implication!scre..tion_0000000000000000_001a.0003_2e1325e3 = 68747470733a2f2f73637265656e636f6e6e6563742e737566666f6c6b69742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_049eef78126018ca\scre..core_420d02d3849b7992_001a.0003_none_3806d8120c = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_eaf1fa2dc68b78cb	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_0000000000000000_57051d5779c6eb7e\LastRunVersion = 68747470733a2f2f73637265656e636f6e6e6563742e737566666f6c6b69742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0003_none_3c7eaff348bbb2bf\Files\ScreenConnect.Windows.dll_fc0d83aff7df0b5b = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0003_none_ce1c35e41bbcf593\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_049eef78126018ca\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2 = 01	dfsvc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0003_none_3806d8120c6d9f8f\DigestValue = 8d0c7997341a323e8a227a569613433cfa4fb7b2	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0003_049eef78126018ca\lock!1d0000002fc5580e340a0000c8090000000000000000000017d68 = 30303030306133342c30316464306134393764353633373436	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 680074007400700073003a002f002f00730063007200650065006e0063006f006e006e006500630074002e0073007500660066006f006c006b00690074002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006d0061006e00690066006500730074000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0003_2e1325e3efb0a9ec	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0003_none_3806d8120c6d9f8f\implication!scre..tion_0000000000000000_001a.0003_2e1 = 68747470733a2f2f73637265656e636f6e6e6563742e737566666f6c6b69742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_2e1325e3efb0a9ec\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_049eef78126018ca\scre..ient_420d02d3849b7992_001a.0003_none_994db135f5 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0003_none_994db135f551829c\lock!08000000b5c1580e300a00009c0f00000000000000000000 = 30303030306133302c30316464306134393737316634643036	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_049eef78126018ca\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0003_none_3c7eaff348bbb2bf	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0003_none_3806d8120c6d9f8f	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_049eef78126018ca	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_049eef78126018ca\scre..core_420d02d3849b7992_001a.0003_none_3806d8120c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0003_none_e95a705aa22d02fa\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0003_none_e95a705aa22d02fa\Files\ScreenConnect.ClientService.dll_e781b1c636 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0003_none_3c7eaff348bbb2bf	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0003_none_0b1fdd4ed2a7cba1	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0003_none_994db135f551829c\lock!0600000010c5580e340a0000c80900000000000000000000 = 30303030306133342c30316464306134393764353633373436	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0003_none_e95a705aa22d02fa\implication!scre..tion_0000000000000000_001a.0003_2e1 = 68747470733a2f2f73637265656e636f6e6e6563742e737566666f6c6b69742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0003_none_e95a705aa22d02fa\DigestValue = 5e318a1a25a1f24a0dcc114239c3ec9efb081fbb	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0003_none_994db135f551829c\SizeOfStronglyNamedComponent = fcb40a0000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0003_none_3806d8120c6d9f8f	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_eaf1fa2dc68b78cb	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_none_0b1fdd4ed2a7cba1\SizeOfStronglyNamedComponent = 9399010000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0003_none_e95a705aa22d02fa\SizeOfStronglyNamedComponent = 4f88010000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0003_none_ce1c35e41bbcf593	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0003_none_ce1c35e41bbcf593\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0003_049eef78126018ca	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Software	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\B7LEWZBW.371\JPL2NTX7.8Z8\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\V95DYHYP.BZJ\BALTLK9O.6LZ\scre..ient_420d02d3849b7992_001a.0003_none_994db135f551829c\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4520	2026-07-02_593cd92a44ac7e0cb904f2dde1bfcea1_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Token: SeDebugPrivilege	2608	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 2608	4520	2026-07-02_593cd92a44ac7e0cb904f2dde1bfcea1_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe	90
PID 2608 wrote to memory of 2612	2608	dfsvc.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-02_593cd92a44ac7e0cb904f2dde1bfcea1_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_593cd92a44ac7e0cb904f2dde1bfcea1_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Users\Admin\AppData\Local\Apps\2.0\V95DYHYP.BZJ\BALTLK9O.6LZ\scre..tion_0000000000000000_001a.0003_049eef78126018ca\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\V95DYHYP.BZJ\BALTLK9O.6LZ\scre..tion_0000000000000000_001a.0003_049eef78126018ca\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:2612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\V95DYHYP.BZJ\BALTLK9O.6LZ\manifests\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4.cdf-ms
Size 14KB
SHA256 890655dee3febc91b9dfa10102c57f91b4d4aeb4bd21314fb74debe4df8bf4d7
MD5 b2037c1769372c5bcb8a6e4b0c7dd2a4
SHA1 07d5d4e08f75319d0fa49ce1b716ab1fe7fcc729
SHA512 c22ae0fe1e0fc7f0edc4a741de19a1efb50b6af5ea7d3183f2b8762cf6bd78bd80858f57f01c96063d098205e835d620ccc4cd670131257a1271259f61cf0925
SSDEEP 192:nwswHnAo6GFiTVPXjrerererSrZIQGVy7g4c4:nCgoTFmVn+++ao4
TLSH
T18A62A601BBD5E932E2511773DCDAC3E47232BCE55F96135B30843B2EAD702C98A23695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0003_none_3806d8120c6d9f8f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\V95DYHYP.BZJ\BALTLK9O.6LZ\manifests\scre..core_420d02d3849b7992_001a.0003_none_3806d8120c6d9f8f.cdf-ms
Size 3KB
SHA256 148b394354749210d67707fceba401a2990de209f3640d711cdeeb10cbc1fb76
MD5 965501f69d39238d8d9c17c2890842de
SHA1 116a1388438abf0747d3924fd8062d6681481981
SHA512 69ddbfb73de71673ac8323c24141317e9e31091fd94f5927ed833ea4e43cd8799a6cc8326dbc45001e822e81aa7424110dec97b22c02fc8c5b8d133c248dd845
TLSH
T1D06145027260DE17E96A063BACD7D2E926757E839E42430B7684FB3F7A312E55212151
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0003_none_3c7eaff348bbb2bf.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\V95DYHYP.BZJ\BALTLK9O.6LZ\manifests\scre..dows_420d02d3849b7992_001a.0003_none_3c7eaff348bbb2bf.cdf-ms
Size 5KB
SHA256 b139924570605fc080d6dc7076153a48ddd0f63a5e6de29ae0abc99af9544b3b
MD5 30013ec531bf3c304824f134f79afab0
SHA1 a307dd143b5ec62d96e0570a58598e4559f04c0c
SHA512 1658024f391b429e394cb28116f2ef1ef5644b219ab4fa7bd9ca607b089ffd3ca18b06fa0887474c3790ee8a5053c75c33abad50288485188daa351767efa9ae
SSDEEP 96:EM3iW+RzfaLUeV+Ww7dIgOr2WAXezoZkv4/wnr+8F:wRzobJnglF6t7F
TLSH
T11EB124117290DD17E5B90633AC96D2ED3A76BE92DE03030B70D4FF1F7A326D65222195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0003_none_994db135f551829c.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\V95DYHYP.BZJ\BALTLK9O.6LZ\manifests\scre..ient_420d02d3849b7992_001a.0003_none_994db135f551829c.cdf-ms
Size 7KB
SHA256 af2b1b2a46269bb9f5dedc062e662f3b671962397c10c49a3b584ad0e01ea248
MD5 77260582b9c837ae7ed8527f29d06ad7
SHA1 bf36879228cc1ecbed4dc3703e899ee0fa2fdd8c
SHA512 039fb3c1aa1eef25abe2b5c60a4a38750360e26a11f8d0746b722c06b0db092afffb6fb1c848a9f255f02ff9588afcf1c5acb911b069416b57e1ba0e1306f34f
SSDEEP 96:UpOO/ln4ka8eV+WwwB862BqXLe3nv+WaOoMKCllqfTbN6:UoOn4BJVasOWNse6
TLSH
T1B8F156027690ED16E5AD46339CDAC3ED3639BE96DE43130B71C4BF2F76326E61222095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0003_none_ce1c35e41bbcf593.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\V95DYHYP.BZJ\BALTLK9O.6LZ\manifests\scre..ient_420d02d3849b7992_001a.0003_none_ce1c35e41bbcf593.cdf-ms
Size 2KB
SHA256 6e794c9347808b74c5242667d375a74a6abb69a877e435d996ab0bb04b76aaf7
MD5 6abe60fd7dc833c820d139339225bb41
SHA1 3bcdfcc27f10f807f266230c7925ab65c012ea1b
SHA512 bc60db3e808c4a9dd2222700da60bffd01335475c4cf446d3d4fdcb34f9f5d6f6dc4d1a90203ac48e3492bc7cbdc49b752bbe5e71f559117a54d0118b15d42df
TLSH
T19C5179053684EE67E56A0233EC95D3D932357E83DF07031BB190BF6F3A716C59612092
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0003_none_0b1fdd4ed2a7cba1.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\V95DYHYP.BZJ\BALTLK9O.6LZ\manifests\scre..tion_0000000000000000_001a.0003_none_0b1fdd4ed2a7cba1.cdf-ms
Size 4KB
SHA256 005edb9d6e986961190168b7eb59f7f0240ba315598d1a3ab4483875d620f532
MD5 88f713f86d9e38d709fd3d61a7ac3e7d
SHA1 5459349362510ef6c67eab27e38892a6c7648fde
SHA512 dc38d0fd7409c809fa03a49935478ebb84cd5c8dba5ad3ac141b3758711a21d8cda2c2c2e386437ab7cc3159f9b01b9d5871b98f3f45985289bd48d9c3bcd955
SSDEEP 48:IP/mrIRAjIvDeGgBRu9o0m5RD7xU7gFUTUEVkMXt4sQgbmZFms4Ch+UQRc3:6OU0GUEW0m5R/xUm2kuQPfmvVUQRq
TLSH
T17E913F80B780E823E61457329CE3D2D033357DA60FD6971B70987B2FAD367C59722266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0003_none_e95a705aa22d02fa.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\V95DYHYP.BZJ\BALTLK9O.6LZ\manifests\scre..vice_420d02d3849b7992_001a.0003_none_e95a705aa22d02fa.cdf-ms
Size 4KB
SHA256 8ae9b99770514283628fef02aef0a36b51cf1d9930a8dfec4ce144e3d83cc865
MD5 8a803ec7e0df80520f2090183622ccea
SHA1 cdd2b3bbcf8adf4a2ddd4e28e553c1ca8f00d7c2
SHA512 1b9a3dc8cdbf140adee98ced62e8c0acd811df2ef2b94cd4cb5fb0fcc8a323428a4c8794e64ff279dd9bc4be1362ba926c08d5b70832ae87228ebcb874444a05
SSDEEP 96:qQHZOyeV+Ww8B4woGYHXjrIwXfvPiCYxQV:MJDoXj5frlV
TLSH
T1A0A1FF027340E917E5AA0233AC66C3ED3A79BD92DE42510BB1C47F3F75721EA43261A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\V95DYHYP.BZJ\BALTLK9O.6LZ\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4\ScreenConnect.ClientService.exe
Size 93KB
SHA256 0f07715d8f303e3986005939334adf6868a9d6a2e4043f75c672e4997fffcf16
MD5 78eead5b916f78738a8684a97ac4410e
SHA1 040d62cd0802927eb6ba358c92042b130bdd2ffb
SHA512 6c3f8943f2996c92363cc4795c1ebfebfdcfd7b2c3dece7aad7e57cea06552357741e30f34cc4d2b2f022893fafaa49453605e24fd200854d86e3e01c29bcac9
SSDEEP 1536:ug1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgkT0HM979ja:/hbNDxZGXfdHrX7rAc6myJkgkT0HwRa
TLSH
T1F9935B13B5C28871D573093158E0DAB09A3FF9615E61DEAB3788022E4F742C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\V95DYHYP.BZJ\BALTLK9O.6LZ\scre..tion_0000000000000000_001a.0003_049eef78126018ca\ScreenConnect.WindowsClient.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\V95DYHYP.BZJ\BALTLK9O.6LZ\scre..tion_0000000000000000_001a.0003_049eef78126018ca\app.config
Size 925B
SHA256 ff4c175092f10d11785acd01ac5fbe7f8a1c6dd3f396dfd69ca523dbbfeec973
MD5 9e5aeb3641da6b3e188a5015ab774a11
SHA1 7b62c41647ee31e5c7a724f2812fb0839812d57b
SHA512 21cc8aefe628c56d2afab8eb52d64be74ee3c57f7925ed7674fb97c7275cb5a5abe7cf2e0389d19b56ab9b867ee82dc47b5c2c4231a0b6af8e52b6d2ee6c6c1c
TLSH
T12E11736DB5C0AE8906B35632E6314280EC7059335165B4E478EF22776F30ED907F32A9
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\V95DYHYP.BZJ\BALTLK9O.6LZ\scre..tion_0000000000000000_001a.0003_049eef78126018ca\user.config
Size 520B
SHA256 cef220c0678fd60393034df1b7279f99f748ffcd639f6dfbc9c83e560959d75f
MD5 1e78b54393688282a43f2569e8c22b7e
SHA1 c7ecc510237d24fe0ccdf3d03dd12ac3a8332c71
SHA512 4477f2017ea4921bec6607f5f3a5bded94edf77c1ec6e6e7217f308669b810e7caeece5f37c765166642e0c29dc4cc7946aa43ea4827fb0ebe50e6c1f3e7b18c
TLSH
T187F0E9A131846E5703635E23C9114741EE72569F0551209874AF623A6F315CF03A32CE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\V95DYHYP.BZJ\BALTLK9O.6LZ\scre..tion_0000000000000000_001a.0003_049eef78126018ca\user.config
Size 677B
SHA256 68d8da618acd30462f4354dc140b8c507569e90b0219ed827074946a6bdd3f9d
MD5 3faac2cbc3cd6835fa61d8dd562e3892
SHA1 448570d469979f0111d6b5b849f3e9c284c60cf0
SHA512 4ad681745a19b01ee8b1efda065b8b4121bb0f3e87008acdf6e7d4f78a64901e0eed7fbd141ab282dafbf5f250307ba88e8247e5099838519f6d28bd7a4f8fea
TLSH
T12F012D6571C49E5B03731E33C6214745FE71569B016520D874AE223B6F305DF07E32DA
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B7LEWZBW.371\JPL2NTX7.8Z8\ScreenConnect.Client.dll
Size 412KB
SHA256 dd73e93a5cb9af55ba0161d7166f277885d5ab64aafd1c99b406589448d7cbbf
MD5 6b58e99ddcaab8eddfdb1fe140329d9e
SHA1 adbabe9dc84f77d386f83bda92e0f2087a3453bc
SHA512 46a37b16f8b0e231900a111c4b40c377c0265cacbf7600e1e96e5ce873733f92a333e26a422a2ef659f2b8b45a98ce26b18194255d9abfc5384d0192e367da49
SSDEEP 6144:WS59LDc+cH1vpy2Y5sD8ETEavHy+vd7JPYIYyqQni65/PTL:tpc22xDHTEavSW7OQniOL
TLSH
T1B394CF8163E85D6EE9AF1F73F0A1A1344E72BC056182F2EE0D0475F51A7B7828B546E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B7LEWZBW.371\JPL2NTX7.8Z8\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 9756b394e791c8c4adc81f0145065067bc4b359a44cb65a878fc518107d5e313
MD5 aa30c5cea510f2e7e4a93b7ad43244d9
SHA1 913e99dbd5dffa92714639a960da85fb174335ec
SHA512 ab0b99071073359d161cc535b5a89e4597e5af203f8666ec93862d96868f2d594b253b4a9af2d2b99a0274305aec3d853955813a8461b32e748a31b401dca501
TLSH
T1E7117B0191C4FE361F7341D1BEE7E420676D5B37048E194BB0A9A89F8B29AD743470B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B7LEWZBW.371\JPL2NTX7.8Z8\ScreenConnect.ClientService.dll
Size 91KB
SHA256 da7e34b666c7f314507747d198fbe350dffbaa1cdd0f12b77f6b6cf4a0752a70
MD5 b74b170e0fc61885868f3ea11e0e71cd
SHA1 5e318a1a25a1f24a0dcc114239c3ec9efb081fbb
SHA512 3db2e999470629a40f0202d318222c8ce76864b2ddd411c35dfb5b527f1c3f4183c610e2ea320030790d72f3233a0ed4823780f3d85f7344b61d3923ab720c2b
SSDEEP 1536:dz0NAdGN6i9C4+Cm49qAqGWZa+QOV+eLD0GUazxDa91g0fI7v:dz2pz9Eyt0QOVFDtUazxDa91gyIr
TLSH
T1C1936E0293BC993AC9EF1E34B461F1A106B1B913D4E6EBD8AD9820DA2E553C11F543DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B7LEWZBW.371\JPL2NTX7.8Z8\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 3c1bbc973bf04d381254de977c233d0bf684c626cdf5ae6331011b5ef1d4f916
MD5 00fcab2ac7a8cff5547ab96c1b1c1ceb
SHA1 91fec1fcd9cdbffd461b6a2e6d72951d119379fe
SHA512 17bf9f8a81cd230c113ce8988c281a607413c795677b418de76376dc737faf7b243c9d9ee0718676929150d5062e0ac821d4551335e11443b00657703150b605
TLSH
T12831161191C4FA351F7302C1BEE7E0609BAD5732148E194BB099A99FCF29AD7434B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B7LEWZBW.371\JPL2NTX7.8Z8\ScreenConnect.Core.dll
Size 577KB
SHA256 17e195a714e72ee8652dc30bd22c0a25daa912d2bd105ba16dfd4411d2910118
MD5 4503f6c7cd6d3674b8ed6863737e4193
SHA1 8d0c7997341a323e8a227a569613433cfa4fb7b2
SHA512 dae4d0a0eefdcd0df4f2067a301a5563717b22a0ad9492faaf78390469d4456c076319f575cd53e749443870424979c4f10e67d641853a5e687660994f289bde
SSDEEP 6144:6Jv2GNGf5J8vWxUpiWKHSznYN/sbj+ymBbVEBKOS0om8lrArArb2iS/ChwDTax4L:+2Qq/G4PSzm++ymBbV50QlrFrb2iEMm
TLSH
T1BAC46C597394C677C9DF177DE03091560670E80464ABE3BB3AD4E9EA2C63F8C9E442A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B7LEWZBW.371\JPL2NTX7.8Z8\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 84195d6f58f5aa7a6dd8fbbb1460de14902cd509abfc6922608b510f0c3be314
MD5 696316a43e1105564ef59bc40f07f627
SHA1 92cdf78155c1925c9d58578f69e83ead98e8b270
SHA512 dd4ee326ef2dc2bce69fd2768104194998bad9ee440b018f4bd36413996cd272effcd47e0416d35a98576a508183befc2d92d08e350be7a1e96db5e1cf650fb0
TLSH
T18B217C0181C8FA261F3302D2BEE7E42197AE5733148D194B70A9AC9FCB1DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B7LEWZBW.371\JPL2NTX7.8Z8\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 ae0c7c3521b905606367a8e8cb7f105b2eacb84ae86db4a5766b9b97caa4c196
MD5 ecdcf1ab52f84e0e15ab3c7347c61718
SHA1 6e19865b53edefa758ed8947b8b97d9cc82349f9
SHA512 d3dd7d4f08ea85836fc0971b619cb4eee33e9fa2e6a30fc72a8db410b378cb280d32a59bf0f0af158eeecb9d688dfd1fbf4fdbb4279bbf49c8418ee14fb32c04
SSDEEP 24576:G9jf5UNXFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPy:mUNXJkGYYpT0+TFiH7efPL
TLSH
T1EB85BD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B7LEWZBW.371\JPL2NTX7.8Z8\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 3e29cb9bb7b2ba80e5e1e2c2501defc32326e98eb0411917d19296e638cc2899
MD5 814208d979bf651c8d802ebbb9568604
SHA1 95e016f207de96c05fcc24e0b2a7ad57c3c85735
SHA512 12258dede4efb675f24004bae8ac4f0759d853db2ab144e6e5df02c6affcd9c08afc29193028e5528bf8bfb039725b324735e7b9b35344779e85114af5c838a7
TLSH
T15C41D01281C8FA250F3302C2BEEBE431979E5733158E194BB499A99BCF29AD74747077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B7LEWZBW.371\JPL2NTX7.8Z8\ScreenConnect.WindowsBackstageShell.exe
Size 71KB
SHA256 3cbde2a13ea662f8f3c7a79ab01c47943b548491aac2a649c5f9337eb24bb9a1
MD5 a88164f766e7a3a5653dffa846db7855
SHA1 a6ea26a589ceec21626a237950bdd4201d15a804
SHA512 134f3750d6417e14c145e89b803a254960f4f8b767febe5779155977b81559ee1ab3816745c92964eb8bd54e3f6788e669f00105a6e594a33351d8dfb2fb3a8c
SSDEEP 768:yTzlYsf/wCdOBti13kDeuRsUQHjSz+dvmDSmBsuMQX5E+TCMXESsl3q7sBYiDLkM:qRYKtd739PD9dvmDqfQX5E+TC7BusB7p
TLSH
T1C5637D5023ECD525E9FE1E34B1E1F6200AB3BA63C8E1D7D92DA821DA5E137C14F64396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B7LEWZBW.371\JPL2NTX7.8Z8\ScreenConnect.WindowsClient.exe
Size 675KB
SHA256 70e5d853c9f666153eaa43c15f2111b5dfdab48e4465a93ce948a913d7e2d564
MD5 c8f9f546232495591184e618a5b5a378
SHA1 0c6e965a101dfa8c974f1b77c88e63776607610e
SHA512 cefd6157539b433a5a05d2dc78320a78b418bdb94e030b8b13f34b8357e819c7823816659e741b326585a63718d508caa0d8447059831fefc42a44d54434081a
SSDEEP 12288:Z4RAIx8hUz6R9OtLlmXvKklQwshBLoEnXF:GNxlLupmh5HnXF
TLSH
T130E48D1133BC9BFBD4AF4B3AB067091457B4E8027185D78ED944A4EA1E827C49E463BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B7LEWZBW.371\JPL2NTX7.8Z8\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B7LEWZBW.371\JPL2NTX7.8Z8\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 801cb4737f452dd96a317ab34a8895effb0b19d83643d95b5e2c41e2fb49f3f6
MD5 1803bd303ad8d22a1099fd52b581a45d
SHA1 def2ade59d114059fe8c66f3fc7237b195efb81f
SHA512 4dcdf9e52b89492b2fe8ddca66458a82d7cb75be8be688f957a67a0f79ed518884d776ba1a082ba2fc12e25fe6238935505441d20b09e230343d2bf81059cf8d
TLSH
T1F051C41251C4FA350F7302C1BEEBE4709B9E5732158E194BB099A98FCF28A97474B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B7LEWZBW.371\JPL2NTX7.8Z8\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 7d55f486bb4f70873ae66500123b3f991128796d4df97f31ffebf22d5c52b98e
MD5 d5325009588decb43517df3e098d1f88
SHA1 43be9857a0755c248d0116ad30dae9c7c1065ae0
SHA512 74c44f48c198b639fead399dcf123ca70f6148c3d6ce8d5c590a67b9124602765e1636ca4802e0fe7cc31433ac3d5b4f1efa8553f23d0167477c7ad3b8f00ae0
SSDEEP 96:xWLwOhoyTuie2wvyJkqokSk3kekQqkXMykA4kOpQkOphykrAkOpD:oRRefqNbUfWXM7A9UFUh7rVUD
TLSH
T145F1CB9688C07C21573281C0FEE3D924BD157F33026E148EBD8D59AF9F625899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B7LEWZBW.371\JPL2NTX7.8Z8\ScreenConnect.WindowsFileManager.exe
Size 91KB
SHA256 97decee82b05c7dc063731e99b8a98e72850260db636f36c9b2b893bce30b3f7
MD5 f8f5e67bcb066267ea83e530e54ac958
SHA1 cb002b475554e961aa74f21e6ea70fe39f3065d8
SHA512 c8d4926e438c1df83515dfc5d4560e6d5f7c73d101176d2cc0b081f54111ca576f13cdf320168717076d97ddec3504a9d1e618a6b840614caf0c32e7431c88ce
SSDEEP 1536:2UMOI1lP4oypI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVdiXj7HB4:1IHuukLC8jjB4
TLSH
T1D493E55235266231DEC6C033A492E9B19C337F6207FDC5BD28A1BA3639E03943E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1XVJYPXQ.3OE.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MMVPT79E.YNJ\1XVJYPXQ.3OE.application
Size 98KB
SHA256 5bd9cf23d8fab31f4b690995c24c4b3bdb8ee3d568a1071ff5cfbf0138651f11
MD5 c991038fe1e65ac1562ef1049b177f66
SHA1 a657affb8502df3d6d13e5f6fa4abf6f608e87b5
SHA512 5b7135738c15d6d38bfc0d67e9219273e6484edca0eda12d02e6f34dcb953b307923c72fb871e4c84f6a06a070eb0c9922cf8b46709eb4894992b9d92293cf68
SSDEEP 1536:K/eK+zuLD4UABnjRnfduUW5Ab4KpSE5GP/uLTvooycuXKQ/IuKE:K/8uuBn1nfdvg2XOcuXX1
TLSH
T1A3A3613ACE30F4C0477DB021D1A92D673D811B93DB731BACD90A186B0E69796EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2608-12-0x00000193A2B50000-0x00000193A2B58000-memory.dmp

Download

memory/2608-47-0x00000193C0E20000-0x00000193C0E3A000-memory.dmp

Download

memory/2608-59-0x00000193C1340000-0x00000193C13EC000-memory.dmp

Download

memory/2608-35-0x00000193C1280000-0x00000193C1314000-memory.dmp

Download

memory/2608-25-0x00000193C0E50000-0x00000193C0EA0000-memory.dmp

Download

memory/2608-128-0x00000193A4990000-0x00000193A49A0000-memory.dmp

Download

memory/2608-41-0x00000193C1540000-0x00000193C16F0000-memory.dmp

Download

memory/2608-16-0x00000193A4990000-0x00000193A49A0000-memory.dmp

Download

memory/2608-14-0x00000193A4990000-0x00000193A49A0000-memory.dmp

Download

memory/2608-13-0x00000193BD090000-0x00000193BD216000-memory.dmp

Download

memory/2608-53-0x00000193C1250000-0x00000193C12BC000-memory.dmp

Download

memory/2608-332-0x00000193A4990000-0x00000193A49A0000-memory.dmp

Download

memory/2612-340-0x0000000000DC0000-0x0000000000E6C000-memory.dmp

Download

memory/4520-8-0x0000000001B70000-0x0000000001B80000-memory.dmp

Download

memory/4520-9-0x0000000006550000-0x0000000006700000-memory.dmp

Download

memory/4520-10-0x0000000001B70000-0x0000000001B80000-memory.dmp

Download

memory/4520-7-0x00000000059E0000-0x0000000005A72000-memory.dmp

Download

memory/4520-6-0x0000000005EA0000-0x0000000006444000-memory.dmp

Download

memory/4520-5-0x00000000058C0000-0x00000000058E8000-memory.dmp

Download

memory/4520-4-0x0000000005830000-0x00000000058C4000-memory.dmp

Download

memory/4520-11-0x0000000001B70000-0x0000000001B80000-memory.dmp

Download

memory/4520-0-0x0000000001B70000-0x0000000001B80000-memory.dmp

Download

memory/4520-3-0x0000000001990000-0x000000000199C000-memory.dmp

Download

memory/4520-2-0x0000000001B70000-0x0000000001B80000-memory.dmp

Download

memory/4520-1-0x0000000001970000-0x0000000001978000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads