f5e1a7d8cbbbb5ed5766a62b2306fb5bff99da188d759c9650855249b58b1892

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_7fb12818390b17996bda11530caa6cf4_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Size 2.4MB
Sample260706-mcdrpshw9k
SHA256 f5e1a7d8cbbbb5ed5766a62b2306fb5bff99da188d759c9650855249b58b1892
MD5 7fb12818390b17996bda11530caa6cf4
SHA1 0ebf0918c3b0faa3599532e312c1a5a374ccb1d4
SHA512 0714018dbd081a205d7cb366ec4fabf3b63ad3d5f485c2bc7bcba26bd93f30f72afe8b44184387ec0374750fb8f427da916529f0c3c32027bbe7d82a92db0ec2
SSDEEP 24576:o20QdxKAy9/fGRp7Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFu:H0/AW8p7JkGYYpT0+TFiH7efPrQgWxJ
TLSH
T1F3C5BE01F3D65AB6C4AF0538D87A861AAB70BC040315DBFB56C8A9792E337C05E357A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4460	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\ZHP4HDRG.W3W\AGAQYP4V.9HW\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_7fb12818390b17996bda11530caa6cf4_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0009_none_4132bc53271caf23\implication!scre..tion_0000000000000000_0019.0009_f8 = 68747470733a2f2f736f706f7274652e68656c6973612e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e392e392e393533332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0009_none_f286549bbcdc128e	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_e465b983995b2a5d\scre...exe_0000000000000000_0019.0009_none_6e2e0d5c9 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_0000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0009_none_f286549bbcdc128e\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0009_none_45aa9434636ac253\SizeOfStronglyNamedComponent = 7cb21a0000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0009_e465b983995b2a5d\lock!1100000091ad580e9c150000bc1b000000000000000000002f6d = 30303030313539632c30316464306433306466323133393635	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_0000000000000000_57051d5779c6eb7e	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_e465b983995b2a5d\scre..vice_4b14c015c87c1ad8_0019.0009_none_f286549bb	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0009_none_f286549bbcdc128e\Files\ScreenConnect.ClientService.dll_e781b1c63 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0009_none_45aa9434636ac253\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0009_none_6e2e0d5c949b5d7e\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0009_none_6e2e0d5c949b5d7e\Files\ScreenConnect.WindowsFileManager.exe.conf = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0009_none_6e2e0d5c949b5d7e\Files\ScreenConnect.WindowsClient.exe.config_f7 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0009_none_f286549bbcdc128e\lock!0c00000091ad580e9c150000bc1b0000000000000000000 = 30303030313539632c30316464306433306466323133393635	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0009_none_a279957710009230\lock!0800000091ad580e9c150000bc1b0000000000000000000 = 30303030313539632c30316464306433306466323133393635	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 680074007400700073003a002f002f0073006f0070006f007200740065002e00680065006c006900730061002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e003f0065003d0053007500700070006f0072007400260079003d0047007500650073007400260068003d0073006f0070006f007200740065002e00680065006c006900730061002e0063006f006d00260070003d003800300034003100260073003d00620035003300660036003500620031002d0033003900370036002d0034006300390031002d0038003200620065002d0032003400330063006300300039003900320030003000610026006b003d0042006700490041004100410043006b004100410042005300550030004500780041004100670041004100410045004100410051004100520053004d004e005300610070004d0041005200490035002500320066004e006f004a003100360075007a0063006c0079006900700068004c0033005700670053006f006400460054005000590042004e00640047007a004700320066006b00460044006c0025003200620038006400530058004900420075006b0062006f00560063006c007300630047006a0056004900760058007100390046006d0041006d00700054004a006d007300560061006c005a0079004700750025003200660041002500320066005a006700580034007a006c003800320059004a0056004e0025003200660052003600250032006200490046003400590078005800610039005900550050006f003100380074007800520056006c0079004e0056006c0049004a0045004b00730047005100560074006200570034004100380074003400350064004d00430044004100760031005a0049004b0032004c00530036007400660078006600410054004f0042007800720047006a004b00670067004f006f003000370064006100390052006200510032006400320070006700770043005a003700670030003000310058004500420070006b006900490045002500320062005900780044003800640066004a0055005600360064006a00300079007200750046005a0059006300460077004400700031007400450059005600790064007a0072005200610056005100630070006a00750045004900740070004700470046006900350077004d004800250032006200330058007800770062003800350032006f00670071007200730025003200660071003900430079004b00690071005a004700620044005900660063007400790071004b0061004100310049005300590047004d0078006b00440063006400560025003200620071006d0036003500560076004c0069004600300033004800720056006900760043004a00560047004d004700690048005200380061006c00460071003200260072003d00260069003d0057004f0052004c00440025003200300056004900530049002500630033002500390033004e0025003200300043004f004d00500041004e00590053002500320030005300410053000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0009_none_1bb3bb649456807b	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_f8efb7c89dbdd3a5\scre...exe_0000000000000000_0019.0009_none_6e2e0d5c9	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0009_none_6e2e0d5c949b5d7e\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0009_none_6e2e0d5c949b5d7e\Files\ScreenConnect.ClientService.exe_e781b1ee3 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0009_none_a279957710009230\Transform = 01	dfsvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\OnlineAppQuotaUsageEstimate = "3857467"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0009_none_d7481a25366c0527\lock!0e00000091ad580e9c150000bc1b0000000000000000000 = 30303030313539632c30316464306433306466323133393635	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0009_none_4132bc53271caf23\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32352e392e392e393533332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0009_none_6e2e0d5c949b5d7e\Files\ScreenConnect.WindowsFileManager.exe_0e21 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0009_none_4132bc53271caf23\DigestValue = eed419b0aa7b36649588a0e212f74eeae90da57f	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0009_none_6e2e0d5c949b5d7e\lock!0600000091ad580e9c150000bc1b0000000000000000000 = 30303030313539632c30316464306433306466323133393635	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_c355230915c020de	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_0000000000000 = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d002200680074007400700073003a002f002f0073006f0070006f007200740065002e00680065006c006900730061002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320035002e0039002e0039002e0039003500330033002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320035002e0039002e0039002e0039003500330033002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e00530065007400200063006c006100730073003d002200530079007300740065006d002e00530065006300750072006900740079002e005000650072006d0069007300730069006f006e0053006500740022000d000a00760065007200730069006f006e003d002200310022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d00220028006800740074007000730029003a002f002f0073006f0070006f007200740065005c002e00680065006c006900730061005c002e0063006f006d002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300030003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_e465b983995b2a5d\scre..dows_4b14c015c87c1ad8_0019.0009_none_45aa94346 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_e465b983995b2a5d\scre..core_4b14c015c87c1ad8_0019.0009_none_4132bc532	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_e465b983995b2a5d\scre...exe_0000000000000000_0019.0009_none_6e2e0d5c9	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0009_none_45aa9434636ac253\lock!0e0000004cae580e6c11000064110000000000000000000 = 30303030313136632c30316464306433306536386465393739	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0009_none_f286549bbcdc128e\lock!0a0000004cae580e6c11000064110000000000000000000 = 30303030313136632c30316464306433306536386465393739	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0009_none_1bb3bb649456807b	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_c355230915c020de	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0009_none_45aa9434636ac253	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0009_none_6e2e0d5c949b5d7e	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 460061006c00730065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0009_f8efb7c89dbdd3a5\pin!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0009_none_1bb3bb649456807b\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e392e392e393533332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0009_none_4132bc53271caf23\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0009_none_a279957710009230\SizeOfStronglyNamedComponent = f995090000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0009_none_f286549bbcdc128e	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0009_f8efb7c89dbdd3a5\appid = 68747470733a2f2f736f706f7274652e68656c6973612e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e392e392e393533332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0009_e465b983995b2a5d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0009_none_d7481a25366c0527\implication!scre..tion_0000000000000000_0019.0009_f8 = 68747470733a2f2f736f706f7274652e68656c6973612e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e392e392e393533332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0009_none_a279957710009230\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_e465b983995b2a5d\scre..ient_4b14c015c87c1ad8_0019.0009_none_a27995771	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0009_none_4132bc53271caf23\lock!160000005cae580e6c11000064110000000000000000000 = 30303030313136632c30316464306433306536386465393739	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0009_none_6e2e0d5c949b5d7e\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e392e392e393533332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0009_none_45aa9434636ac253\DigestValue = c0f5e641a5745bd7248cc50ab161e88e5f61b8d6	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0009_none_4132bc53271caf23\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0009_none_a279957710009230\DigestValue = e178ae799b442971e4fcbe261591b8195f2e7b06	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "XM4JXTCDCY4KBVOP6GK0Y1RN"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0009_none_45aa9434636ac253\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0009_none_d7481a25366c0527\SizeOfStronglyNamedComponent = 1f4c060000000000	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\ZHP4HDRG.W3W\AGAQYP4V.9HW\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\XM4JXTCD.CY4\KBVOP6GK.0Y1\scre..ient_4b14c015c87c1ad8_0019.0009_none_a279957710009230\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6628	2026-07-06_7fb12818390b17996bda11530caa6cf4_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Token: SeDebugPrivilege	5532	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6628 wrote to memory of 5532	6628	2026-07-06_7fb12818390b17996bda11530caa6cf4_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe	89
PID 5532 wrote to memory of 4460	5532	dfsvc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-06_7fb12818390b17996bda11530caa6cf4_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_7fb12818390b17996bda11530caa6cf4_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6628
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5532
- - C:\Users\Admin\AppData\Local\Apps\2.0\XM4JXTCD.CY4\KBVOP6GK.0Y1\scre..tion_0000000000000000_0019.0009_e465b983995b2a5d\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\XM4JXTCD.CY4\KBVOP6GK.0Y1\scre..tion_0000000000000000_0019.0009_e465b983995b2a5d\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_0019.0009_none_6e2e0d5c949b5d7e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\XM4JXTCD.CY4\KBVOP6GK.0Y1\manifests\scre...exe_0000000000000000_0019.0009_none_6e2e0d5c949b5d7e.cdf-ms
Size 14KB
SHA256 538c3a63695186099a720b9aad839ca3318779e0e9e0dae529a6034a422650ea
MD5 2666cbd4ef4b0ef077e43ad7733a1bf5
SHA1 55000d99a710ed5055c6e4018419281a1ec2a35b
SHA512 c8cacfe8928d765952ba8ccf3bdcee5f8dfe2d45cd5d4ff19e7e4572a2afdcd29d7593291dd2db1a617b860cc38b9780e84ebd269e6bb37f26d688426a09b988
SSDEEP 192:YYzwHH/JnACtGr1njcNyLNE1ZqqSfbLg9R3J3zxmNGLreXHINuHGlyM4:YlnhnATr1oNyLNEkzStPCmlyM4
TLSH
T1F3620D1AB649F077E1501A32ACF6F6B932157D659FB6207B7480373D7F322558F22281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0009_none_4132bc53271caf23.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\XM4JXTCD.CY4\KBVOP6GK.0Y1\manifests\scre..core_4b14c015c87c1ad8_0019.0009_none_4132bc53271caf23.cdf-ms
Size 3KB
SHA256 bcf0a6b984f193fc79542c01b1503c5b1ade50858883b2d7f126d3f56deccd3b
MD5 79f10e496ccefd02c2c134cf0645e277
SHA1 5fa4af3e63a31b31abbe57569b88d2a80a0f1b66
SHA512 d957c42c8b02cbe4a22b90eaf2bfa00665099a5435b7cbf368b8f2071962a045da2412320716422173b564cd1032db8f2b0339266fa082ae8828cfd68b1da9c2
TLSH
T11C616442B644EE13D9690273ACD6C2EE36B47E83DF82460B74C4BF2F7A322E54612191
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0009_none_45aa9434636ac253.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\XM4JXTCD.CY4\KBVOP6GK.0Y1\manifests\scre..dows_4b14c015c87c1ad8_0019.0009_none_45aa9434636ac253.cdf-ms
Size 5KB
SHA256 4851b34b0d47f8b59cac422e3d0cdd14084960e5e8cd131aa0ecbf20316ec555
MD5 02e0503f6d7eaed5f079561003a620ab
SHA1 969d6cd1c2e4b2db9740b0f6456322552208192e
SHA512 c7213fa74e68af66efb72333d6ab0de1ada1c468fa79f69a7e6dc3e7322c50a3cf0cfcabb6084bbc84943a6a7d9d23cab9c506447ef1fb4de8feeb9a275d942d
SSDEEP 96:p1P+RxlDheV+Ww72kKOr2WAXBzPZk74EngnsROO:+RxlSJkKlF9GQfO
TLSH
T101B15411B284DD17D4B90633ACD6C2ED3B32BE92CE43430B70D4BB6F7A326E64622195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0009_none_a279957710009230.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\XM4JXTCD.CY4\KBVOP6GK.0Y1\manifests\scre..ient_4b14c015c87c1ad8_0019.0009_none_a279957710009230.cdf-ms
Size 6KB
SHA256 8e9e5ac06d8995377e0dd9a4816637665211180ae0828e7046e779dc8a0b769b
MD5 3f310c65800f4e0b4abd5d68fd38c658
SHA1 57fba82e8e022c3c9af6266a32c352c4eefaf494
SHA512 19da1c04823293856c8ef938a6033d38d3f490ac3086046e467d35cce216a08cad13b21baed831f25a278b72171899a6c5fa47d6fbd870c48fa9e734069b7650
SSDEEP 96:cPWhDMPP/pMeV+Wwwk8Wm2TOtNO6gh6OL6v8rZRjD2PInsVoewWQ:TZMPP/BJwmZNQh6OO6gIszQ
TLSH
T1BCD1BB127344EE17D5A90A33AC9AD3ED33683E56DE42470B70C4BF2F7A322E61722191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0009_none_d7481a25366c0527.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\XM4JXTCD.CY4\KBVOP6GK.0Y1\manifests\scre..ient_4b14c015c87c1ad8_0019.0009_none_d7481a25366c0527.cdf-ms
Size 2KB
SHA256 6c89b0d080eca57ff1707f61d76332a4edaee7ef675681fd08a02bec5879aa3d
MD5 6e82ac4ac811da0b4236ecd1191efc3d
SHA1 eafe59dc68897ab49b2e49120e50421258e66fa2
SHA512 ed3d37d66bc91c4842bf47b06623ba5ebff3f8d92ef1c06250e6bb7cecdd8fa7f28c832757e13118b2d4e1ce529de8b3b449311040e5cdbe3fb05d49f445d0b4
TLSH
T1A55110017748D667DA2A0331ECA2C1CE7BB83E43CE95510BB0C0377F5E71BE59A2A1A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_0019.0009_none_1bb3bb649456807b.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\XM4JXTCD.CY4\KBVOP6GK.0Y1\manifests\scre..tion_0000000000000000_0019.0009_none_1bb3bb649456807b.cdf-ms
Size 4KB
SHA256 673112d1e4981d7eabf8c3bf37d89688928fabd4e55b025f5b948985fc558cf2
MD5 8d381d090e4e5684d40985d78d7e9c7a
SHA1 e9bea74c321d490902837f0c17e3928d124dd118
SHA512 73a9a599988caca4d4eb579e218872e47f259ef759324d445c5fd12581e9b6b2aae3f499acba97e0971eaba8e4157ab844381b6083a0da12f0b9b37df3d2ce3a
SSDEEP 48:npP/mrIHAqzIvXtRXgORu9o0m5RD7uU7gFUTUEekwY8f4sQgbmZFms4Ch+UQRcv:ntOUHGXtEW0m5R/uUm9kHuQPfmvVUQRu
TLSH
T10A913E80B740E823E61447339CE3D2D032357DA64FDB971B70987B2FAD367C596222A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0009_none_f286549bbcdc128e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\XM4JXTCD.CY4\KBVOP6GK.0Y1\manifests\scre..vice_4b14c015c87c1ad8_0019.0009_none_f286549bbcdc128e.cdf-ms
Size 4KB
SHA256 029eb7b427007922be5f1c2cccba95db82c1f5b8824400b5f732ae705c29ccb4
MD5 10727c21126730946c84fff7190de544
SHA1 b3e922e7904926f9ad34f7167ed384f19b6680d7
SHA512 59862fa957d807ec36f3e0c11df4ce10e41465d868257f9623f9a82e2abe92b6c22526023168e98fbb6643d26f20cc004b9428d5d003b83f92c180b228fa8109
SSDEEP 48:YzAcCDVxldg1e6S+9ow87gjXW75uvxhMXGdVLTrUALiEnwAvUy4A9f:YUcPeV+Ww8k45uLldVzf9nDv3df
TLSH
T17791FF127244EDA6E5A50633ECA7C6DD2A77BD92DE42060B70C03B3F7A313DA5B21191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NO24CKD5.GH6.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LZO4L9N3.992\NO24CKD5.GH6.application
Size 139KB
SHA256 e049618290bb7ef525a2233bb48f5042f2ca0e2516d73f84d8e1d0b0541efa4b
MD5 fdd2067219b56d91618da1f6326c0eea
SHA1 5645596b1942c4ba833c737491fe0955f48fdd98
SHA512 3b47f6c6971af8c78630e6174a8d19c6b1fc55170325d1bd7e140b0a2d7c3d6b1ad031424540198db01ecd5a9c5cc4553ef057650921f8727df4765f53a32bc8
SSDEEP 1536:r/iBHhe2WCRSmQfn4/5EHSZ5GE/uLTvooycuzKQ/IuKBCg2Yezt85kexwg:r/YHhlWCRbW22XOcuzX42YOg
TLSH
T1D4E3613A8E30F0C0877DB421D1A52D673DC11B93DB731BACE90A18670E69796EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZHP4HDRG.W3W\AGAQYP4V.9HW\ScreenConnect.Client.dll
Size 399KB
SHA256 96dadc1c6b6b5cb56e6acb55f52357e52ed3877790e103d4ec9804b8ffa66c1d
MD5 88ebf60207ac75610e1b58f48d0c05ea
SHA1 f2442ad05baaff449b4f1e1109129163e9c609d7
SHA512 2288cea5346e90a73766beb29c4da9cf4c80b7772b0412203c081c6f650d278e7849a429317851a31fd629ac890960a4efadda0cbdff046dfbb0347f5ad5ba66
SSDEEP 6144:yMq4l+fvJNHZvD8ETEavHy+vd7JPYIYyqQni65/PGN:F5+f5DHTEavSW7OQni3N
TLSH
T1A494CF86B3A44C6DFB6F0A77F45041299E73AC456552F26D4E04B8F90AB3BD28740BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZHP4HDRG.W3W\AGAQYP4V.9HW\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 b1827e6f0105476ea43157a5c7a2939623e2ce1c74810fb1b7346dbd6ce11593
MD5 59fa8644d0e205086755adba9d8d1fe9
SHA1 f1d8da33e4b8503d41e6d3f1f405f0d381cbed5a
SHA512 4b5e6e562240c1c912e24b1eb5fd6ebc9e717f95e1674b0a852a9fab673adb741f48332ac7c01957198b77a84b2b257291f91f60db5058bf19035c5ff0aaff19
TLSH
T147117F0181C8FA261F3301D1BEE7E021A76E1B37048D1547B069686FCB2DBD6474B173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZHP4HDRG.W3W\AGAQYP4V.9HW\ScreenConnect.ClientService.dll
Size 78KB
SHA256 7510a3270807d5ac03b28937ec7c7fa485a49e3b6c36e63c30d664e191d81caa
MD5 f47a957d9c3bc2ef45e94594d1017c69
SHA1 a471c52cc3c586084131350f9af8a8f7d90f1c7e
SHA512 7806b0973fffe72fd0c49f02fcd8866ba0e4d0cbb1279d8e25c54cbb4761a6ee2d2c2e858d1cffb7250896c899b82eea9ed31fd3ed5098f482201dc0de9850c1
SSDEEP 1536:27xQmiDHn5f2yoI4vn3R0as97k/QQV3lTkmkbPmM47i:27xQmKH5eygf3R0L0QQVFkUM4m
TLSH
T111734C41E3AC5E26C9DF5F387465B0450F709A02E4A3FBDD9D8EA4EA1B563C12A043DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZHP4HDRG.W3W\AGAQYP4V.9HW\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 637528deb39d79072423518b78a8df62711d48233739aac9dfc688ee435270e8
MD5 57b455ace9acbe156a6735f0c4f31d45
SHA1 77b75667b2ce18092b15a0794ce9dee3eaba145b
SHA512 73c359880a00d98da488468b9cd5e732490c44e046c9837d7e212e28176cb17e1588e23ceae46c7988da0b321e410f6a18d435719613ccd236f3fca516a4cef8
TLSH
T18631E70681C8FB251F3302C1BEE7E0619BAE1B33158E1947B099599BCF2DAA6474B173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZHP4HDRG.W3W\AGAQYP4V.9HW\ScreenConnect.ClientService.exe
Size 93KB
SHA256 a5c75fdc9bceecbf9a873a1c66eec3dcc87f66f5e973d9dd9937b8a5d7a3c603
MD5 260e414c2f7e6b561239ab39494db4bb
SHA1 ebe65591697197d54c6c4cfc356f2f45acfcb91e
SHA512 1b644b8e0254a89a44f476b7c6a9e815bbc1b964a113e0fe3937630923e60489f0f244b81df7bd764eec429ddcbd997f98def04836eda709d3aaf8d6689aaa4c
SSDEEP 1536:3g1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgcvU0HMq7M:whbNDxZGXfdHrX7rAc6myJkgcvU0HHo
TLSH
T111936B13B5C28872D573093158E0DAB09A7FF9215E21DEAB3798022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZHP4HDRG.W3W\AGAQYP4V.9HW\ScreenConnect.Core.dll
Size 553KB
SHA256 c14f8d29d5d0ff8d63a3a37608e4f886486f9fc8484082496d9aefc51865c758
MD5 efe5ff11be1d2629c9319a37fc811a27
SHA1 eed419b0aa7b36649588a0e212f74eeae90da57f
SHA512 054b677b1da8e324171ddd876ca29b4ffde553151c0f3521117805304b21fa7c16cb33db0d8d9fd574852872e905161877aece20fc8f76d602c5969720cf3ede
SSDEEP 12288:f+IY2aqte5exGY7FwVzP/DVzeCXV8VNNveAppEt/byEX/fpM:90QdxKAy9/fC
TLSH
T1E6C46D5233D88B36C5AF0B3AE860D6151B70E905B01AE75B29DEE4E91E837455E0C3FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZHP4HDRG.W3W\AGAQYP4V.9HW\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 28bff8e33bf544606596c065d8e1a6ce0dc5bf06b81895225367ff2e839f1109
MD5 f5896a5eea0fabc146ab39b5a49821b0
SHA1 c76d5447ab32e5c022feb41de62b87a90692fcc9
SHA512 63539c0eeafa8cdf35e836a468578497e5abfa41c251dd9d00d6f2db72556ea0bbfc40a2570d915c14d71165e03bb016d96ba8615f9f1573ce7261fd02d4eafa
TLSH
T17D21370181C8FB261F3302D2BEE7E4219B9E5B33188D194B74A9699FCB2DAD64747173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZHP4HDRG.W3W\AGAQYP4V.9HW\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 d4fba5ffd6bb627827a922573cdaadc0e85d653d6844c3e4255860cbb7c7531a
MD5 a0828b7fda085a5b2e8d322afb56316a
SHA1 c0f5e641a5745bd7248cc50ab161e88e5f61b8d6
SHA512 53114f19f56360ee36e5e9a7398b0d9683e4a9191db4d2ce1af67ca07201ef4e8b3541ff2d43abb091eff8718dada1ef8338eb95ee36b25c3b3fc57b4dac0c02
SSDEEP 24576:LRp7Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTc:lp7JkGYYpT0+TFiH7efPd
TLSH
T1C685AD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE356D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZHP4HDRG.W3W\AGAQYP4V.9HW\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 a81540a6837503404dda20ab0e4e387aaf29028295e1a1480b3496cb94dd50c7
MD5 1410ce8d5b39e1bfccba162b4875c7b4
SHA1 05b51f3be312b8dd71f3a9d56df3ad69b1327061
SHA512 fe74673496c913e0af7ea44dcf3e12c0eda87396b0f42e2b20737d145ef95ddea3b800227035eb774f22253a02ee6435a985710b358f0dd64776bad6d25f8ce3
TLSH
T12D41D31281C8FA250F3301C2BEEBE431979E5733198E194B7499A99BCF29AD74747037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZHP4HDRG.W3W\AGAQYP4V.9HW\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 c459b5a1e6d13093f0c0ed218c4d9af9b74f6d83975c8fae52ca1f24cda36d98
MD5 5c5ee3a75764870d8ade5c3eff1aa5aa
SHA1 146a7392d86e32e2a95fd8d829c7e9c0596fd5bb
SHA512 fe1ed99e729585298d318f259d8d7397fa97c4ac08be2507c2c6a1064f159ac0dd7cb614a2d6b7463358045354cee4a2c44ecd00c8600e134c75dcf6c86ad40d
SSDEEP 1536:roSOs/MRZFe9aQ3DvmDTyQX5E+TC7xh2syGbjSj7J:roTsCZFe9dmyQOJ3Sjd
TLSH
T1DE538E4153E84615C9FF2E7CB8F2A1141EB1AA439441EBAE0DCD65EB1E537815F203E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZHP4HDRG.W3W\AGAQYP4V.9HW\ScreenConnect.WindowsClient.exe
Size 604KB
SHA256 82477cdde7d90092fd2fe8b331d41851a2fa42f79e64721307b59e02c789a887
MD5 d4b14aef70f13fa88c21885749053e89
SHA1 e178ae799b442971e4fcbe261591b8195f2e7b06
SHA512 2fc2314bd002481977998ae6fd444291dc6de98d2bbd80794dc1e07b29918dceb555ff55ff470a49b0d8c000615120c2fc98036b3a92bee38b30b7011e31e238
SSDEEP 6144:FaEAH0RclKUyYHwjSPIDQj391lMKgrurWAcC1CCzP+pE6nUcoI2/Z4Is4zu2wAsE:FacSlKUy8wjSPIDQVrW/C1SE6+zJkYhr
TLSH
T10DD46C2173BC8A3BC4BF077BA0A11E6857B0FC0291C5D79E5924A8E94EE73D649443E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZHP4HDRG.W3W\AGAQYP4V.9HW\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZHP4HDRG.W3W\AGAQYP4V.9HW\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 95dc27a4addbfcbf999321f3e522d138701d40cea52435c760c4f9b48545517b
MD5 aa564ca0718210c76373562df208c4fc
SHA1 1ece2ce6dd6448c57cfac6ab6d6340badcf3c2ee
SHA512 8adca2c88b5506e3d90381235dff75868581a921d802e69e25ff97f29e117d8513415f0dca2ead9ddda34062d086c6ada28116bff1d185e875a508ef248da600
TLSH
T17E51B30641C8FB210F3301C1BEEBE471979E5B32158E19477099999BCF29AA7474B137
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZHP4HDRG.W3W\AGAQYP4V.9HW\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 da9096dc05bfe7d043f7e59831ff81fc8d268e12fc885258c47c28437a2dd403
MD5 c94a103898df8c59121e7089980cf077
SHA1 4e216aff99265bab6c4a075c360928083003e46f
SHA512 73f514f333df71f60ba06217c6568aa80f6371693a87326a7aa331a556350c6ef1da626b2965d40f166ba7cf5a5c1c6bc620f2226224905b8ce0778c909ddac4
SSDEEP 96:xWLwOhoyTEOe2wvypLk7kmktfkAk2qk19kx4kOpQkOprkL2AkOpD:oRteggw3tsVg1ex9UFUA6VUD
TLSH
T1C1F1CD9684C07D21573391C4FEE39914BE057F2302BE148ABC8D19AF9F765899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZHP4HDRG.W3W\AGAQYP4V.9HW\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 d5465efd50c55dd1d4537b2813181b6a69a0536aed1da314d40c2c102ce63972
MD5 d0d7a3194eec44545acef770c8441960
SHA1 4d6c15e9f840af15462ce64d6e2a942943c7c721
SHA512 034323fa683973a423a2cc6179ad1a2635cd9df7406bbc90e02aecf9e7bf313e1837c59468ae6451fc0c59b5ca028139fb86e9d435b6179da0e36f47f5afb859
SSDEEP 1536:Qtyol44+zbsI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Aj07C:7mbukLd8j02
TLSH
T1A683E78235762231DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03443A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4460-301-0x0000000002E90000-0x0000000002EA8000-memory.dmp

Download

memory/4460-291-0x0000000000C40000-0x0000000000CDC000-memory.dmp

Download

memory/5532-16-0x00007FFFE9350000-0x00007FFFE9CF4000-memory.dmp

Download

memory/5532-18-0x00007FFFE9350000-0x00007FFFE9CF4000-memory.dmp

Download

memory/5532-35-0x000001726FA00000-0x000001726FA50000-memory.dmp

Download

memory/5532-36-0x00007FFFE9350000-0x00007FFFE9CF4000-memory.dmp

Download

memory/5532-37-0x00007FFFE9350000-0x00007FFFE9CF4000-memory.dmp

Download

memory/5532-38-0x00007FFFE9350000-0x00007FFFE9CF4000-memory.dmp

Download

memory/5532-39-0x00007FFFE9350000-0x00007FFFE9CF4000-memory.dmp

Download

memory/5532-49-0x000001726F9D0000-0x000001726F9E8000-memory.dmp

Download

memory/5532-25-0x00007FFFE9350000-0x00007FFFE9CF4000-memory.dmp

Download

memory/5532-55-0x000001726FFF0000-0x000001727019E000-memory.dmp

Download

memory/5532-24-0x00007FFFE9350000-0x00007FFFE9CF4000-memory.dmp

Download

memory/5532-61-0x000001726FD20000-0x000001726FDAE000-memory.dmp

Download

memory/5532-23-0x00007FFFE9350000-0x00007FFFE9CF4000-memory.dmp

Download

memory/5532-67-0x000001726FD30000-0x000001726FDCC000-memory.dmp

Download

memory/5532-22-0x00007FFFE9350000-0x00007FFFE9CF4000-memory.dmp

Download

memory/5532-73-0x000001726FD00000-0x000001726FD68000-memory.dmp

Download

memory/5532-21-0x00007FFFE9350000-0x00007FFFE9CF4000-memory.dmp

Download

memory/5532-20-0x00007FFFE9350000-0x00007FFFE9CF4000-memory.dmp

Download

memory/5532-304-0x00007FFFE9350000-0x00007FFFE9CF4000-memory.dmp

Download

memory/5532-26-0x00007FFFE9350000-0x00007FFFE9CF4000-memory.dmp

Download

memory/5532-17-0x00007FFFE9350000-0x00007FFFE9CF4000-memory.dmp

Download

memory/5532-303-0x00007FFFE9350000-0x00007FFFE9CF4000-memory.dmp

Download

memory/5532-13-0x000001726B660000-0x000001726B7E8000-memory.dmp

Download

memory/5532-302-0x00007FFFE9350000-0x00007FFFE9CF4000-memory.dmp

Download

memory/5532-15-0x00007FFFE94DF000-0x00007FFFE94E0000-memory.dmp

Download

memory/5532-11-0x0000017268EE0000-0x0000017268EE8000-memory.dmp

Download

memory/6628-5-0x0000000074840000-0x0000000074FFC000-memory.dmp

Download

memory/6628-0-0x0000000074852000-0x0000000074853000-memory.dmp

Download

memory/6628-9-0x0000000074840000-0x0000000074FFC000-memory.dmp

Download

memory/6628-7-0x0000000005BA0000-0x0000000005C32000-memory.dmp

Download

memory/6628-8-0x0000000074840000-0x0000000074FFC000-memory.dmp

Download

memory/6628-6-0x00000000060B0000-0x000000000666A000-memory.dmp

Download

memory/6628-3-0x0000000005A60000-0x0000000005AEE000-memory.dmp

Download

memory/6628-12-0x0000000074852000-0x0000000074853000-memory.dmp

Download

memory/6628-10-0x0000000005D40000-0x0000000005EEE000-memory.dmp

Download

memory/6628-2-0x0000000003400000-0x0000000003408000-memory.dmp

Download

memory/6628-1-0x0000000001B40000-0x0000000001B48000-memory.dmp

Download

memory/6628-14-0x0000000074840000-0x0000000074FFC000-memory.dmp

Download

memory/6628-4-0x0000000003430000-0x0000000003454000-memory.dmp

Download

memory/6628-19-0x0000000074840000-0x0000000074FFC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads