15b7b38cd617cbaf2b9da9ad2f4e419765538f130770fd49bc31b26052fe78e5

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_6b52cf2f9180f420b31488e600df80cd_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Size 2.5MB
Sample260706-megalshx7j
SHA256 15b7b38cd617cbaf2b9da9ad2f4e419765538f130770fd49bc31b26052fe78e5
MD5 6b52cf2f9180f420b31488e600df80cd
SHA1 412ba57dbdca1efc2bfee8cb3fe405beb489fe31
SHA512 8689e381277a2884d5d524f3cca6b50e06bc83a012e668bbe655bb12cfa92a29dd07b1502e088dc981c2a37c75cd99a877e976e0697596c035ca5b227f20e97e
SSDEEP 24576:u99zm+OBbV5Z56jMK9jf5UNXFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+Rfj:wcZEUNXJkGYYpT0+TFiH7efP7wz
TLSH
T1F1C5BE01F3D695B6C4AF0578D47A921A6770BC040366CBFB67C4A9B62D33BC09E357A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
3	5688	dfsvc.exe
3	5688	dfsvc.exe
3	5688	dfsvc.exe
3	5688	dfsvc.exe
3	5688	dfsvc.exe
3	5688	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
4516	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\KP1NGPCG.G3A\8JXNVQ3Q.TNH\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_6b52cf2f9180f420b31488e600df80cd_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4\implication!scre..tion_0000000000000000_001a.0003_419 = 687474703a2f2f737570706f72742e6b6f72756375746563682e636f6d3a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4\Files\ScreenConnect.WindowsBackstageShell.exe_89 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_181d2ab1d766351c\scre..ient_420d02d3849b7992_001a.0003_none_ce1c35e41b = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_none_0b1fdd4ed2a7cba1\SizeOfStronglyNamedComponent = 2293010000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0003_none_3c7eaff348bbb2bf\SizeOfStronglyNamedComponent = 82ea1a0000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0003_none_e95a705aa22d02fa\lock!0a000000ed0b590ea4110000f00c00000000000000000000 = 30303030313161342c30316464306433313661363664633931	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_fe7035678b91951d\LastRunVersion = 687474703a2f2f737570706f72742e6b6f72756375746563682e636f6d3a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0003_181d2ab1d766351c\implication!scre..tion_0000000000000000_001a.0003_4191611d = 687474703a2f2f737570706f72742e6b6f72756375746563682e636f6d3a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0003_4191611db4b6c63e\appid = 687474703a2f2f737570706f72742e6b6f72756375746563682e636f6d3a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0003_none_3c7eaff348bbb2bf	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0003_none_e95a705aa22d02fa	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0003_none_3c7eaff348bbb2bf	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_00000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 0000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0003_none_3806d8120c6d9f8f\implication!scre..tion_0000000000000000_001a.0003_419 = 687474703a2f2f737570706f72742e6b6f72756375746563682e636f6d3a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0003_none_e95a705aa22d02fa\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_fe7035678b91951d	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_0000000000000000_57051d5779c6eb7e	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 68007400740070003a002f002f0073007500700070006f00720074002e006b006f00720075006300750074006500630068002e0063006f006d003a0038003000340030002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006d0061006e00690066006500730074000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0003_4191611db4b6c63e\pin!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0003_none_994db135f551829c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0003_none_ce1c35e41bbcf593\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0003_none_3c7eaff348bbb2bf\Files\ScreenConnect.Windows.dll_fc0d83aff7df0b5b = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_fe7035678b91951d	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4\SizeOfStronglyNamedComponent = ff5c040000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0003_none_ce1c35e41bbcf593\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0003_none_0b1fdd4ed2a7cba1\lock!04000000760a590e38160000bc0a00000000000000000000 = 30303030313633382c30316464306433313632363738386561	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0003_none_994db135f551829c\lock!14000000fc0b590ea4110000f00c00000000000000000000 = 30303030313161342c30316464306433313661363664633931	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 54007200750065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0003_181d2ab1d766351c\appid = 687474703a2f2f737570706f72742e6b6f72756375746563682e636f6d3a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0003_none_3806d8120c6d9f8f	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0003_none_0b1fdd4ed2a7cba1	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_181d2ab1d766351c\scre..core_420d02d3849b7992_001a.0003_none_3806d8120c = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0003_none_3806d8120c6d9f8f\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0003_none_e95a705aa22d02fa\lock!18000000fc0b590ea4110000f00c00000000000000000000 = 30303030313161342c30316464306433313661363664633931	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "QJMOJH5AKYBGQY3Q7JPH2P43"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 30000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_none_0b1fdd4ed2a7cba1\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0003_none_3806d8120c6d9f8f\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_181d2ab1d766351c\scre..ient_420d02d3849b7992_001a.0003_none_994db135f5 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4\lock!06000000760a590e38160000bc0a00000000000000000000 = 30303030313633382c30316464306433313632363738386561	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0003_none_3c7eaff348bbb2bf\lock!0e000000ed0b590ea4110000f00c00000000000000000000 = 30303030313161342c30316464306433313661363664633931	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0003_none_0b1fdd4ed2a7cba1\implication!scre..tion_0000000000000000_001a.0003_419 = 687474703a2f2f737570706f72742e6b6f72756375746563682e636f6d3a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0003_none_3c7eaff348bbb2bf\lock!1c000000fc0b590ea4110000f00c00000000000000000000 = 30303030313161342c30316464306433313661363664633931	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0003_none_3c7eaff348bbb2bf\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0003_none_3c7eaff348bbb2bf\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0003_none_3c7eaff348bbb2bf\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 68007400740070003a002f002f0073007500700070006f00720074002e006b006f00720075006300750074006500630068002e0063006f006d003a0038003000340030002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e003f0065003d0053007500700070006f0072007400260079003d0047007500650073007400260068003d0073007500700070006f00720074002e006b006f00720075006300750074006500630068002e0063006f006d00260070003d003800300034003100260073003d00310039003700360065006300370066002d0034006200350063002d0034003700610063002d0039006300610061002d0038006300340036003500300032003600630034003400620026006b003d0042006700490041004100410043006b0041004100420053005500300045007800410041006700410041004100450041004100510043006800330071006c00530050006600580067006800450056006e005a0043005400410051004800250032006200440059005300360036004600570045004d00320025003200660079007700450039004500640059005400650064002500320062003100360072004f0063007000650064004d006400650077006f0049006e006f0070002500320062004d0053003300520047006c0066007200550065004700470047006e007900310069006b0045004e003300420077007400470048006f00650061004e0066004a00590061004500670074005800710030005a004c0069004a00450035007800330057004100520068007a00340079006e007700380053004b0049004a0032006800700032007a006a006d0065006d006e0046006a0025003200620053006b00560079006c007a004700690031004100690074004700390054004b00760078004800380064003300510033003500390076007200480050004a004a006c006900300070006500610059003800750057004f0038003400780047004a00750036003300590037006a0075004b007800360057007a00690066004a005000310030005a0065004100680068004800710074002500320062004d00390050006500390050006f006b0025003200660079007a005200420059006c00460044004d0036005700300069004e00500053007500740035007a0065004600430056007a0065005900330045006c00550053004e004f005900320049006400350033006a007200710049004500760069006100320063004d0055004f006e0041003100250032006600560025003200660054006d0034006700670039004d0066007800730074002500320062006b004b003400250032006600580059004d00440033006c002500320062006e006d006200670059006f0052005000250032006200380036004600520066006900750067005000700047005a006d0076007000590044006e0050004f0046006c0044004d00410056004e00300031006e004e00260072003d00260069003d0055006e007400690074006c0065006400250032003000530065007300730069006f006e000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0003_none_ce1c35e41bbcf593\DigestValue = adbabe9dc84f77d386f83bda92e0f2087a3453bc	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	ScreenConnect.WindowsClient.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\KP1NGPCG.G3A\8JXNVQ3Q.TNH\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\1WM8Q0EH.300\H92A6BYK.P6H\scre..ient_420d02d3849b7992_001a.0003_none_994db135f551829c\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3984	2026-07-06_6b52cf2f9180f420b31488e600df80cd_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Token: SeDebugPrivilege	5688	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 5688	3984	2026-07-06_6b52cf2f9180f420b31488e600df80cd_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe	88
PID 5688 wrote to memory of 4516	5688	dfsvc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-06_6b52cf2f9180f420b31488e600df80cd_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_6b52cf2f9180f420b31488e600df80cd_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5688
- - C:\Users\Admin\AppData\Local\Apps\2.0\1WM8Q0EH.300\H92A6BYK.P6H\scre..tion_0000000000000000_001a.0003_181d2ab1d766351c\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\1WM8Q0EH.300\H92A6BYK.P6H\scre..tion_0000000000000000_001a.0003_181d2ab1d766351c\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1WM8Q0EH.300\H92A6BYK.P6H\manifests\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4.cdf-ms
Size 14KB
SHA256 bd26f86ce9aeae611127fc4821ffac18e2e1517eff12b8c10e3a2e7ecafe4b0d
MD5 e5e09ae220d37e5b67d6303656b8b31c
SHA1 6440e349b347de40b8b396782dde97e55fc256c4
SHA512 432f64f822d6fda626f72259f845d6fb0d58687eef73949a78dfc074dda339d878ea46c7884ef6d6a14d5f8b4253f0cc9ed94230f306215ac0599920efbbe7dd
SSDEEP 192:0wswHnAtYJGMUiTVuJrhrTrnr8b4IMGce7g4R4:0CgtYcMUmV+R/rUJ4
TLSH
T10D629411B7D6E933E2502773DC9AD3D47232BCE55F96135B30843B2EAD702CA4A23696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0003_none_3806d8120c6d9f8f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1WM8Q0EH.300\H92A6BYK.P6H\manifests\scre..core_420d02d3849b7992_001a.0003_none_3806d8120c6d9f8f.cdf-ms
Size 3KB
SHA256 587c8bb650dda83f958fdc2095639918d8299981fdbf298fd0ab2ebd0bf6f390
MD5 bfd33ce318cfc50eb762628db7ba3269
SHA1 a77b83b5492b6045e6942ad60fdc44334f190c96
SHA512 46dee499583e4e5d833ca52483d28865b9625551ee24e1f47194d3a77e5179d85b1c241ecd54a4ab1ad7e4683b163eac2a2ca007ca01ba245821e5977b7f72cd
TLSH
T169619702B244DE17E9690233ACD5D2ED37743E83DF82521F74C0BBAF3A326E65212295
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0003_none_3c7eaff348bbb2bf.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1WM8Q0EH.300\H92A6BYK.P6H\manifests\scre..dows_420d02d3849b7992_001a.0003_none_3c7eaff348bbb2bf.cdf-ms
Size 5KB
SHA256 5c7930b70c4b212a0ec4d12f1d78c8731ff1ab135367baee01de8d05007289cd
MD5 443a06cf63dd3ca44e49501001326d8c
SHA1 d05c91355c7e0d59d7e47f8f950200f0047e48fd
SHA512 3bfe048d4074aa375d244d21a1dc6da26ed711986f8006d9786fb39d63f4cf617b9e428ccf0494752092a9d2f69ad0e374dc863c0df70961c073171d99537d0d
SSDEEP 96:NfI3iW+RzfaL0eV+Ww7dIgOrLWLXpzoZovlzwnr+8F:rRzo7JngEqlg7F
TLSH
T153B122117290DD17D5B90633AC9AD2ED3A767E82DE03030B70D8FB1FBA326E65222095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0003_none_994db135f551829c.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1WM8Q0EH.300\H92A6BYK.P6H\manifests\scre..ient_420d02d3849b7992_001a.0003_none_994db135f551829c.cdf-ms
Size 7KB
SHA256 773014ccfc5de54b19b1c612380c39d82ed3336d2291cd568decad316a6b397e
MD5 2a4369a2af076ad02d80dad19ddcc271
SHA1 d5d42c8f410566e2e58ea800d0d97f77524d4698
SHA512 8087d2d4e84566a981f31d185fc4d111f10ec77c122130206a915a9ccd0000870a221c13ddab7eda8633ac2325547f3d0c7d0e0966e3d32ecf9d8708cda0070b
SSDEEP 96:rOO/ln4ka+eV+WwwB86W+3zksBZqHegRgAJv/I6qcplqfTbN6:6On4XJVWA+eGJHFxe6
TLSH
T11FF165027290DD1BD1A826339C97D6EC3A36BD9ADE43034B71D0FB2F7A323D61622095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0003_none_ce1c35e41bbcf593.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1WM8Q0EH.300\H92A6BYK.P6H\manifests\scre..ient_420d02d3849b7992_001a.0003_none_ce1c35e41bbcf593.cdf-ms
Size 2KB
SHA256 27367302d5c465d0c91ec1a38c85039657192834a10a72895ea7758a5ad0f96e
MD5 7c7de16f1b5b4b526b2cf10b1c5939b2
SHA1 0f0c20b1643b6db206ae6a23ace5284e4a0dfa3e
SHA512 38f5c0360b2b2a41dbcf4e8b2edb8a097c1b34cd2eaf9746c4eea7a4356378172c4625a5004d513d8b4d022c3fdad92035852491ff3c18e29d53aceb59e3554e
TLSH
T1EF5166057684EA67D66A0233EC96D2E932357E83EF47031BB190BB7F3A716C55612092
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0003_none_0b1fdd4ed2a7cba1.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1WM8Q0EH.300\H92A6BYK.P6H\manifests\scre..tion_0000000000000000_001a.0003_none_0b1fdd4ed2a7cba1.cdf-ms
Size 4KB
SHA256 a5f7099551f3e5cbe21c929e5056ea1acc3e57ec9a5d35c8ea6e53e918ebc480
MD5 23511aa524bd0a521a1440afd448f726
SHA1 f008f24ed76156034248801465fe4064de79e203
SHA512 e79df91f730d103f5f275032c5b295271727ccd8259a56d2705d0da309f02f29c7aed0987d7d36510cabb5023f131b5ae913daebd7bb6c00d3595fbc593cd935
SSDEEP 48:AP/mrIRAjIvDPnJgBRu9o0m5RD7xU7gFUTUEVkMXt4sQgbmZFms4Ch+UQRc3:SOU0GLwEW0m5R/xUm2kuQPfmvVUQRq
TLSH
T156913180B740E833D61457329CE3D2D033357DA60FD6975B70987B2FAD367C69622266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0003_none_e95a705aa22d02fa.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1WM8Q0EH.300\H92A6BYK.P6H\manifests\scre..vice_420d02d3849b7992_001a.0003_none_e95a705aa22d02fa.cdf-ms
Size 4KB
SHA256 8785223b04a22789085ab3986be657b99bd08b3baed3676bde60ba352e4c2fbd
MD5 11f06e9b2e903bbe1305567ffd935965
SHA1 81ddbc5d024cec4de380dda3023a5f7911791fbf
SHA512 1b5d5263213eec9b41dc2868a4e74cf12a64878a557e9b8108f0d7a18744c7ae4bf3f57b881b3d5138f9a12786b5ce6461b07e857ee71df893dd89614b537e34
SSDEEP 96:FzQHZO+eV+Ww8B4w9OI+TurfyDEa1/ICYxQV:vJD9+Lb5lV
TLSH
T1C3A168027290DD67E5A90633DC96C2ED36767D82DE43430B71C4BF2F7A726D64326096
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\1WM8Q0EH.300\H92A6BYK.P6H\scre..tion_0000000000000000_001a.0003_181d2ab1d766351c\user.config
Size 520B
SHA256 4e2247bd91428df1e05321b6431883b12131415950d69049cab4cff4dce95045
MD5 1b9f5cbd588c9d9d41a15b4f5976050a
SHA1 40836d486ba9444fc2450c820ffa0d40067bcba4
SHA512 f31f0794cad270412be366d55969a54d84d1820e2f836da2c7546817ab2aadb1759bab9096b013208112be06a059a945fbc91f2b04de06f0dc160e676f31303d
TLSH
T185F0E2A131806E4B03A36E23C5128745EE726B9B1561249874AF627A9F315CE07A32DE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\1WM8Q0EH.300\H92A6BYK.P6H\scre..tion_0000000000000000_001a.0003_181d2ab1d766351c\user.config
Size 667B
SHA256 a6c4f2dba26484c1e4d3f4627a903294f2fd3376b860d0a275e3e9c5fb550f41
MD5 9fc23dae2b195a4007cf07421e325682
SHA1 d2cac6e8866b65667b9c5b4229ccb419d0f46af3
SHA512 22ed8c17db1b17fa1ed9417894a5b6cfa2c4911a92619eb941026c7bb466f70fd39fb23e9b6193f6e2fcd8e6327eb12d8cc2764ebaf4f3234f47259e4227e767
TLSH
T17F017D6570C06D4B03B36E32C5214345EE31669B056560D874AE62375F708CA07A32DA
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KP1NGPCG.G3A\8JXNVQ3Q.TNH\ScreenConnect.Client.dll
Size 412KB
SHA256 dd73e93a5cb9af55ba0161d7166f277885d5ab64aafd1c99b406589448d7cbbf
MD5 6b58e99ddcaab8eddfdb1fe140329d9e
SHA1 adbabe9dc84f77d386f83bda92e0f2087a3453bc
SHA512 46a37b16f8b0e231900a111c4b40c377c0265cacbf7600e1e96e5ce873733f92a333e26a422a2ef659f2b8b45a98ce26b18194255d9abfc5384d0192e367da49
SSDEEP 6144:WS59LDc+cH1vpy2Y5sD8ETEavHy+vd7JPYIYyqQni65/PTL:tpc22xDHTEavSW7OQniOL
TLSH
T1B394CF8163E85D6EE9AF1F73F0A1A1344E72BC056182F2EE0D0475F51A7B7828B546E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KP1NGPCG.G3A\8JXNVQ3Q.TNH\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 9756b394e791c8c4adc81f0145065067bc4b359a44cb65a878fc518107d5e313
MD5 aa30c5cea510f2e7e4a93b7ad43244d9
SHA1 913e99dbd5dffa92714639a960da85fb174335ec
SHA512 ab0b99071073359d161cc535b5a89e4597e5af203f8666ec93862d96868f2d594b253b4a9af2d2b99a0274305aec3d853955813a8461b32e748a31b401dca501
TLSH
T1E7117B0191C4FE361F7341D1BEE7E420676D5B37048E194BB0A9A89F8B29AD743470B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KP1NGPCG.G3A\8JXNVQ3Q.TNH\ScreenConnect.ClientService.dll
Size 91KB
SHA256 da7e34b666c7f314507747d198fbe350dffbaa1cdd0f12b77f6b6cf4a0752a70
MD5 b74b170e0fc61885868f3ea11e0e71cd
SHA1 5e318a1a25a1f24a0dcc114239c3ec9efb081fbb
SHA512 3db2e999470629a40f0202d318222c8ce76864b2ddd411c35dfb5b527f1c3f4183c610e2ea320030790d72f3233a0ed4823780f3d85f7344b61d3923ab720c2b
SSDEEP 1536:dz0NAdGN6i9C4+Cm49qAqGWZa+QOV+eLD0GUazxDa91g0fI7v:dz2pz9Eyt0QOVFDtUazxDa91gyIr
TLSH
T1C1936E0293BC993AC9EF1E34B461F1A106B1B913D4E6EBD8AD9820DA2E553C11F543DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KP1NGPCG.G3A\8JXNVQ3Q.TNH\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 3c1bbc973bf04d381254de977c233d0bf684c626cdf5ae6331011b5ef1d4f916
MD5 00fcab2ac7a8cff5547ab96c1b1c1ceb
SHA1 91fec1fcd9cdbffd461b6a2e6d72951d119379fe
SHA512 17bf9f8a81cd230c113ce8988c281a607413c795677b418de76376dc737faf7b243c9d9ee0718676929150d5062e0ac821d4551335e11443b00657703150b605
TLSH
T12831161191C4FA351F7302C1BEE7E0609BAD5732148E194BB099A99FCF29AD7434B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KP1NGPCG.G3A\8JXNVQ3Q.TNH\ScreenConnect.ClientService.exe
Size 93KB
SHA256 0f07715d8f303e3986005939334adf6868a9d6a2e4043f75c672e4997fffcf16
MD5 78eead5b916f78738a8684a97ac4410e
SHA1 040d62cd0802927eb6ba358c92042b130bdd2ffb
SHA512 6c3f8943f2996c92363cc4795c1ebfebfdcfd7b2c3dece7aad7e57cea06552357741e30f34cc4d2b2f022893fafaa49453605e24fd200854d86e3e01c29bcac9
SSDEEP 1536:ug1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgkT0HM979ja:/hbNDxZGXfdHrX7rAc6myJkgkT0HwRa
TLSH
T1F9935B13B5C28871D573093158E0DAB09A3FF9615E61DEAB3788022E4F742C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KP1NGPCG.G3A\8JXNVQ3Q.TNH\ScreenConnect.Core.dll
Size 577KB
SHA256 17e195a714e72ee8652dc30bd22c0a25daa912d2bd105ba16dfd4411d2910118
MD5 4503f6c7cd6d3674b8ed6863737e4193
SHA1 8d0c7997341a323e8a227a569613433cfa4fb7b2
SHA512 dae4d0a0eefdcd0df4f2067a301a5563717b22a0ad9492faaf78390469d4456c076319f575cd53e749443870424979c4f10e67d641853a5e687660994f289bde
SSDEEP 6144:6Jv2GNGf5J8vWxUpiWKHSznYN/sbj+ymBbVEBKOS0om8lrArArb2iS/ChwDTax4L:+2Qq/G4PSzm++ymBbV50QlrFrb2iEMm
TLSH
T1BAC46C597394C677C9DF177DE03091560670E80464ABE3BB3AD4E9EA2C63F8C9E442A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KP1NGPCG.G3A\8JXNVQ3Q.TNH\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 84195d6f58f5aa7a6dd8fbbb1460de14902cd509abfc6922608b510f0c3be314
MD5 696316a43e1105564ef59bc40f07f627
SHA1 92cdf78155c1925c9d58578f69e83ead98e8b270
SHA512 dd4ee326ef2dc2bce69fd2768104194998bad9ee440b018f4bd36413996cd272effcd47e0416d35a98576a508183befc2d92d08e350be7a1e96db5e1cf650fb0
TLSH
T18B217C0181C8FA261F3302D2BEE7E42197AE5733148D194B70A9AC9FCB1DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KP1NGPCG.G3A\8JXNVQ3Q.TNH\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 ae0c7c3521b905606367a8e8cb7f105b2eacb84ae86db4a5766b9b97caa4c196
MD5 ecdcf1ab52f84e0e15ab3c7347c61718
SHA1 6e19865b53edefa758ed8947b8b97d9cc82349f9
SHA512 d3dd7d4f08ea85836fc0971b619cb4eee33e9fa2e6a30fc72a8db410b378cb280d32a59bf0f0af158eeecb9d688dfd1fbf4fdbb4279bbf49c8418ee14fb32c04
SSDEEP 24576:G9jf5UNXFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPy:mUNXJkGYYpT0+TFiH7efPL
TLSH
T1EB85BD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KP1NGPCG.G3A\8JXNVQ3Q.TNH\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 3e29cb9bb7b2ba80e5e1e2c2501defc32326e98eb0411917d19296e638cc2899
MD5 814208d979bf651c8d802ebbb9568604
SHA1 95e016f207de96c05fcc24e0b2a7ad57c3c85735
SHA512 12258dede4efb675f24004bae8ac4f0759d853db2ab144e6e5df02c6affcd9c08afc29193028e5528bf8bfb039725b324735e7b9b35344779e85114af5c838a7
TLSH
T15C41D01281C8FA250F3302C2BEEBE431979E5733158E194BB499A99BCF29AD74747077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KP1NGPCG.G3A\8JXNVQ3Q.TNH\ScreenConnect.WindowsBackstageShell.exe
Size 71KB
SHA256 3cbde2a13ea662f8f3c7a79ab01c47943b548491aac2a649c5f9337eb24bb9a1
MD5 a88164f766e7a3a5653dffa846db7855
SHA1 a6ea26a589ceec21626a237950bdd4201d15a804
SHA512 134f3750d6417e14c145e89b803a254960f4f8b767febe5779155977b81559ee1ab3816745c92964eb8bd54e3f6788e669f00105a6e594a33351d8dfb2fb3a8c
SSDEEP 768:yTzlYsf/wCdOBti13kDeuRsUQHjSz+dvmDSmBsuMQX5E+TCMXESsl3q7sBYiDLkM:qRYKtd739PD9dvmDqfQX5E+TC7BusB7p
TLSH
T1C5637D5023ECD525E9FE1E34B1E1F6200AB3BA63C8E1D7D92DA821DA5E137C14F64396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KP1NGPCG.G3A\8JXNVQ3Q.TNH\ScreenConnect.WindowsClient.exe
Size 675KB
SHA256 70e5d853c9f666153eaa43c15f2111b5dfdab48e4465a93ce948a913d7e2d564
MD5 c8f9f546232495591184e618a5b5a378
SHA1 0c6e965a101dfa8c974f1b77c88e63776607610e
SHA512 cefd6157539b433a5a05d2dc78320a78b418bdb94e030b8b13f34b8357e819c7823816659e741b326585a63718d508caa0d8447059831fefc42a44d54434081a
SSDEEP 12288:Z4RAIx8hUz6R9OtLlmXvKklQwshBLoEnXF:GNxlLupmh5HnXF
TLSH
T130E48D1133BC9BFBD4AF4B3AB067091457B4E8027185D78ED944A4EA1E827C49E463BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KP1NGPCG.G3A\8JXNVQ3Q.TNH\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 801cb4737f452dd96a317ab34a8895effb0b19d83643d95b5e2c41e2fb49f3f6
MD5 1803bd303ad8d22a1099fd52b581a45d
SHA1 def2ade59d114059fe8c66f3fc7237b195efb81f
SHA512 4dcdf9e52b89492b2fe8ddca66458a82d7cb75be8be688f957a67a0f79ed518884d776ba1a082ba2fc12e25fe6238935505441d20b09e230343d2bf81059cf8d
TLSH
T1F051C41251C4FA350F7302C1BEEBE4709B9E5732158E194BB099A98FCF28A97474B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KP1NGPCG.G3A\8JXNVQ3Q.TNH\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 7d55f486bb4f70873ae66500123b3f991128796d4df97f31ffebf22d5c52b98e
MD5 d5325009588decb43517df3e098d1f88
SHA1 43be9857a0755c248d0116ad30dae9c7c1065ae0
SHA512 74c44f48c198b639fead399dcf123ca70f6148c3d6ce8d5c590a67b9124602765e1636ca4802e0fe7cc31433ac3d5b4f1efa8553f23d0167477c7ad3b8f00ae0
SSDEEP 96:xWLwOhoyTuie2wvyJkqokSk3kekQqkXMykA4kOpQkOphykrAkOpD:oRRefqNbUfWXM7A9UFUh7rVUD
TLSH
T145F1CB9688C07C21573281C0FEE3D924BD157F33026E148EBD8D59AF9F625899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KP1NGPCG.G3A\8JXNVQ3Q.TNH\ScreenConnect.WindowsFileManager.exe
Size 91KB
SHA256 97decee82b05c7dc063731e99b8a98e72850260db636f36c9b2b893bce30b3f7
MD5 f8f5e67bcb066267ea83e530e54ac958
SHA1 cb002b475554e961aa74f21e6ea70fe39f3065d8
SHA512 c8d4926e438c1df83515dfc5d4560e6d5f7c73d101176d2cc0b081f54111ca576f13cdf320168717076d97ddec3504a9d1e618a6b840614caf0c32e7431c88ce
SSDEEP 1536:2UMOI1lP4oypI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVdiXj7HB4:1IHuukLC8jjB4
TLSH
T1D493E55235266231DEC6C033A492E9B19C337F6207FDC5BD28A1BA3639E03943E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KP1NGPCG.G3A\8JXNVQ3Q.TNH\ScreenConnect.WindowsFileManager.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

7VMDZTAB.MTP.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VM2OYE7V.654\7VMDZTAB.MTP.application
Size 96KB
SHA256 daa61662f9d0b46552278f3f7930d5304a38346979584e4bac1061e451f4e239
MD5 f37e9b8ee38a5f6809d34bf9bc925785
SHA1 2c88ae2d57c955fea6dc4e38d74ec1d80da9a551
SHA512 dd6e1de8deb86959204cc5019b9849475993b7c2b2cdfa0dbbc5f263940f3796320682e0d2c44d09333a593e0ff13c0d2fe7c86484d4febf101aa21211bcbcad
SSDEEP 1536:hK+zuLD4UABnjRnfduUW5Ab4KpSE5GP/uLTvooycupKQ/IuKE:luuBn1nfdvg2XOcupX1
TLSH
T142A3503ACE30F4C0477DB021D1A52D6B3D811B93DB731BACD90A186B0E69796EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3984-21-0x00000000750C0000-0x000000007587C000-memory.dmp

Download

memory/3984-13-0x00000000750C0000-0x000000007587C000-memory.dmp

Download

memory/3984-8-0x00000000750C0000-0x000000007587C000-memory.dmp

Download

memory/3984-7-0x0000000005A10000-0x0000000005AA2000-memory.dmp

Download

memory/3984-10-0x0000000005BA0000-0x0000000005D50000-memory.dmp

Download

memory/3984-11-0x00000000750D2000-0x00000000750D3000-memory.dmp

Download

memory/3984-0-0x00000000750D2000-0x00000000750D3000-memory.dmp

Download

memory/3984-6-0x0000000005F30000-0x00000000064EA000-memory.dmp

Download

memory/3984-12-0x00000000750C0000-0x000000007587C000-memory.dmp

Download

memory/3984-9-0x00000000750C0000-0x000000007587C000-memory.dmp

Download

memory/3984-5-0x00000000750C0000-0x000000007587C000-memory.dmp

Download

memory/3984-4-0x0000000003260000-0x0000000003288000-memory.dmp

Download

memory/3984-3-0x00000000058E0000-0x0000000005974000-memory.dmp

Download

memory/3984-2-0x0000000003130000-0x000000000313C000-memory.dmp

Download

memory/3984-1-0x0000000003110000-0x0000000003118000-memory.dmp

Download

memory/3984-17-0x00000000750C0000-0x000000007587C000-memory.dmp

Download

memory/3984-14-0x00000000750C0000-0x000000007587C000-memory.dmp

Download

memory/4516-292-0x0000000000420000-0x00000000004CC000-memory.dmp

Download

memory/5688-15-0x000002389A8F0000-0x000002389A8F8000-memory.dmp

Download

memory/5688-72-0x00000238B9860000-0x00000238B990C000-memory.dmp

Download

memory/5688-66-0x00000238B9700000-0x00000238B976C000-memory.dmp

Download

memory/5688-60-0x00000238B52F0000-0x00000238B530A000-memory.dmp

Download

memory/5688-54-0x00000238B9A60000-0x00000238B9C10000-memory.dmp

Download

memory/5688-48-0x00000238B97A0000-0x00000238B9834000-memory.dmp

Download

memory/5688-38-0x00007FFF8A550000-0x00007FFF8AEF4000-memory.dmp

Download

memory/5688-37-0x00007FFF8A550000-0x00007FFF8AEF4000-memory.dmp

Download

memory/5688-36-0x00007FFF8A550000-0x00007FFF8AEF4000-memory.dmp

Download

memory/5688-34-0x00007FFF8A550000-0x00007FFF8AEF4000-memory.dmp

Download

memory/5688-35-0x00000238B9470000-0x00000238B94C0000-memory.dmp

Download

memory/5688-25-0x00007FFF8A550000-0x00007FFF8AEF4000-memory.dmp

Download

memory/5688-24-0x00007FFF8A550000-0x00007FFF8AEF4000-memory.dmp

Download

memory/5688-23-0x00007FFF8A550000-0x00007FFF8AEF4000-memory.dmp

Download

memory/5688-22-0x00007FFF8A550000-0x00007FFF8AEF4000-memory.dmp

Download

memory/5688-20-0x00007FFF8A550000-0x00007FFF8AEF4000-memory.dmp

Download

memory/5688-19-0x00007FFF8A550000-0x00007FFF8AEF4000-memory.dmp

Download

memory/5688-18-0x00007FFF8A6DF000-0x00007FFF8A6E0000-memory.dmp

Download

memory/5688-16-0x00000238B5080000-0x00000238B5208000-memory.dmp

Download

memory/5688-311-0x00007FFF8A550000-0x00007FFF8AEF4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads