41fa2a08f83979d63579dbca49905b28074a01ca053da3d29a418e646cb9d97e

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_8d07ee28539d09fa840e90d244924158_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Size 2.4MB
Sample260709-pt4essav7q
SHA256 41fa2a08f83979d63579dbca49905b28074a01ca053da3d29a418e646cb9d97e
MD5 8d07ee28539d09fa840e90d244924158
SHA1 105556c220a2378df3502c1ef26ba21fbfb06a68
SHA512 cbf7032877fd18939bfd16e197eb8995da5eb1ab25c8a72d8ff698b85187285ff78f2e9d3be1e21ad0293233230ca4acc8b6fe040f01dbfe48b742c72e56a9fc
SSDEEP 24576:jIubA9DS2XINpgFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH8:sDupgJkGYYpT0+TFiH7efP0Q97om
TLSH
T1F5C5AD01F3D265F5C46F0A3884BA421AA774BC081315DBFB56D4A9A93E337C05E36BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4292	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\MW3H9XAO.ZDY\PH0KWO3L.7PM\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_8d07ee28539d09fa840e90d244924158_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 68747470733a2f2f626b6d772e68656c702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a843f70	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_9a594a8020495bb2\scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0004_9a594a8020495bb2\lock!11000000e3a1590ee4120000dc09000000000000000000000a39 = 30303030313265342c30316464306639666434663062643963	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244\lock!060000000ca3590ec410000024140000000000000000000 = 30303030313063342c30316464306639666464356134326366	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_aa602f57b9d8c973\LastRunVersion = 68747470733a2f2f626b6d772e68656c702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0004_6ac0e1786e39465d	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_aa602f57b9d8c973	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_0000000000000 = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d002200680074007400700073003a002f002f0062006b006d0077002e00680065006c0070002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320035002e0034002e00320035002e0039003300310033002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320035002e0034002e00320035002e0039003300310033002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e00530065007400200063006c006100730073003d002200530079007300740065006d002e00530065006300750072006900740079002e005000650072006d0069007300730069006f006e0053006500740022000d000a00760065007200730069006f006e003d002200310022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d00220028006800740074007000730029003a002f002f0062006b006d0077005c002e00680065006c0070002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300030003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "1Y32WWBGE57LGQE7YCYECXAM"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 680074007400700073003a002f002f0062006b006d0077002e00680065006c0070002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e003f0065003d0053007500700070006f0072007400260079003d0047007500650073007400260068003d0062006b006d0077002e00680065006c007000260070003d003800300034003100260073003d00620031003600620062003000330034002d0034006300350066002d0034006500300038002d0062006500310034002d0034006300330038003900630033006400630065006600650026006b003d0042006700490041004100410043006b00410041004200530055003000450078004100410067004100410041004500410041005100420064004c004c00420055004b0068004b004b004e006a0070004e004b0073004e00750047006a007400390041005200520044004b00480071005200460078004d006b00340068006d006b0068003900540058004a0068004b0059004100620070004d006f006d005a0052004400670044002500320062006e00680063007400420067004900660057004200470058005700380041005a007a004e003900580074004a007000390079002500320062004c004d005900630065005900770052005800520076003800380025003200620044007a00370078004a00710033004500510072005500250032006200700047006c00500033005700370059007a0043007800520030005900320044006600590056003100430025003200660074005a00300059006d007200710048007a0053004500430039004a0042007400430054007100450059007100360033004b00620059005100740061004800690039004700590055006600510079002500320062004c0053004c00590071006f004300500057006700250032006600720068005600590056003000500035006c007200730030006900420078004300710030006e006d00510042004b00660053003700250032006200450070003600460037006100700069004c005500250032006200250032006600490030006500510056006e007700510071004e006b00560025003200620062004c004200350076006d00560061006f0035006300750055004e00780048004700510034002500320066003800340025003200620030006b0025003200660031004a0025003200620046004500530069007a0069006f006d004500450042006700710035003300740045004d00300064007800670045005900450057007000500042005a006500540038007a0070004b00450063006900580058005a006e005a0067004c00470036003200410051004f007a0061007800760048004c0058004900500025003200620058005a006500760063004300620061004200640056006300460076004f003100260072003d00260069003d0055006e007400690074006c0065006400250032003000530065007300730069006f006e000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab\implication!scre..tion_0000000000000000_0019.0004_6a = 68747470733a2f2f626b6d772e68656c702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0004_none_1cbe04a2ab6ffd98	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0004_none_1cbe04a2ab6ffd98\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\SizeOfStronglyNamedComponent = a7fc030000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40\Files\ScreenConnect.Core.dll_b96889d378047e27 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_0019.0004_9a594a8020495bb2\identity = 68747470733a2f2f626b6d772e68656c702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_0019.0004_9a594a8020495bb2	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_aa602f57b9d8c973	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0004_9a594a8020495bb2\appid = 68747470733a2f2f626b6d772e68656c702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_none_1cbe04a2ab6ffd98\SizeOfStronglyNamedComponent = 9c84010000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\Files\ScreenConnect.WindowsBackstageShell.exe.c = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\lock!06000000d4a1590ee4120000dc090000000000000000000 = 30303030313265342c30316464306639666434663062643963	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d\implication!scre..tion_0000000000000000_0019.0004_6a = 68747470733a2f2f626b6d772e68656c702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e342e32352e393331332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\Files\ScreenConnect.WindowsFileManager.exe_0e21 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244\lock!08000000d4a1590ee4120000dc090000000000000000000 = 30303030313265342c30316464306639666434663062643963	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab\lock!1c0000000ca3590ec410000024140000000000000000000 = 30303030313063342c30316464306639666464356134326366	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\Files\ScreenConnect.WindowsBackstageShell.exe_8 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_9a594a8020495bb2\scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727 = 01	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "W7HL4R6OQAYVJ2DX1QOBT72N"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244\lock!140000000ca3590ec410000024140000000000000000000 = 30303030313063342c30316464306639666464356134326366	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_aa602f57b9d8c973	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 54007200750065000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b\DigestValue = 8aaf1107de02e0190a4ea0dd4e4ed05808e3df85	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab\SizeOfStronglyNamedComponent = c84f010000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0004_9a594a8020495bb2\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a843f70\lock!080000000ca3590ec410000024140000000000000000000 = 30303030313063342c30316464306639666464356134326366	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\MW3H9XAO.ZDY\PH0KWO3L.7PM\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\1Y32WWBG.E57\LGQE7YCY.ECX\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5584	2026-07-09_8d07ee28539d09fa840e90d244924158_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Token: SeDebugPrivilege	4836	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5584 wrote to memory of 4836	5584	2026-07-09_8d07ee28539d09fa840e90d244924158_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe	88
PID 4836 wrote to memory of 4292	4836	dfsvc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-09_8d07ee28539d09fa840e90d244924158_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_8d07ee28539d09fa840e90d244924158_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5584
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Users\Admin\AppData\Local\Apps\2.0\1Y32WWBG.E57\LGQE7YCY.ECX\scre..tion_0000000000000000_0019.0004_9a594a8020495bb2\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\1Y32WWBG.E57\LGQE7YCY.ECX\scre..tion_0000000000000000_0019.0004_9a594a8020495bb2\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1Y32WWBG.E57\LGQE7YCY.ECX\manifests\scre...exe_0000000000000000_0019.0004_none_6f38569aabb4da9b.cdf-ms
Size 14KB
SHA256 61bc237e21d71fb0c436332c6067d6680ce4c147b768e98a3c528d912ebb7ae9
MD5 f1db6b870935740ef1ac685697692656
SHA1 289d0c7274296bce2132dd1683100cbbcd03c6ce
SHA512 4b51b0c38f1ee36298cc173478b5f2ae092dbed0be360b4826925e7c509294a6d71706b1f86eb5d34911b124effac3d96feb1ea86e3dcd2abc9073b5387a6412
SSDEEP 192:kvgwHXpAkluTJGZD4XjrerererSrZIQGV67gqk/iG4:kHCkluTsZE+++ay/F4
TLSH
T1A7629711B7E6E932E2552773DCDAC3D47232BCE51F96135B70443B2EAE702C98A23685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1Y32WWBG.E57\LGQE7YCY.ECX\manifests\scre..core_4b14c015c87c1ad8_0019.0004_none_423d05913e362c40.cdf-ms
Size 3KB
SHA256 0029391e13e677b658bf6263386a3a07e6daeb85729c12ce857e184c7f2ca472
MD5 5a7272d3ccc18d0d15069ea68e6bb48f
SHA1 a54b49d3280e67ae6990cc4883d3a4774b7deec2
SHA512 ee8c010438c2e7217c3db9a9ec97f5af11f0c5a4bba00bc31b11819814c10e4611ff22ac35a0261b0309a74b85ead4472957da8379e8e39586a015ecb9fd78d8
TLSH
T19161C9027704DA17D9A90633ACE6D2EE3B743E83CF81860F74C47F2F76322A652112A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a843f70.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1Y32WWBG.E57\LGQE7YCY.ECX\manifests\scre..dows_4b14c015c87c1ad8_0019.0004_none_46b4dd727a843f70.cdf-ms
Size 5KB
SHA256 82c22e41ba11f415854a746bd2b36eb238a0da0a0fd8d5e2fe214788ba8c92ca
MD5 3f67b45e00b8f38d99b00726d4e4b11a
SHA1 d886f50650ef8478d5474eedfb5a132bbda0a0ae
SHA512 e9ab084699c50878b74c103b5e8c12fe80013d68810c64898b231394ccb9889d0a060877c2cc95c5f42ba78ed046120d721298dba5148e239f6d6ee7948c9a29
SSDEEP 96:k6fP+RxU9LTeV+Ww7mkzuZa6sthY9wcngnsRgu:+RxUNUJi6Za60zEQdu
TLSH
T14FB13F11B304D553E4B946339CA6D3ED2B787E53CE82120B70D87F6F76322A687252A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1Y32WWBG.E57\LGQE7YCY.ECX\manifests\scre..ient_4b14c015c87c1ad8_0019.0004_none_a383deb5271a0f4d.cdf-ms
Size 6KB
SHA256 5306c5ced7464f404e00fbd6e86858c176a6d69258c652cfaeb23ab000246de6
MD5 455f8b73e078f10d6ef71d55bae86ecf
SHA1 f20a1b285cff67d8a4ff30ab6703d8022c88d357
SHA512 08f4bb8898cd603d35709452f810b249dad3bba64b4a50633c11fa52b590668bd176b1e42b4f44eea68eecf798f0ebd124a4a0973e4182bf87df7cfd4155398f
SSDEEP 96:i7jkhWhDM5leV+WwwU8WbzW2FAvgP6v+W+xoz9pnsVoeiw:FAZMMJwbXp/apVs6w
TLSH
T18FD123127290EE16D1A90633AC9AD2DD32767E96DE43430B70C4BB2F7B322E60722095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1Y32WWBG.E57\LGQE7YCY.ECX\manifests\scre..ient_4b14c015c87c1ad8_0019.0004_none_d85263634d858244.cdf-ms
Size 2KB
SHA256 b1b380f2fc9a3fc7a29228437768f92d465045ee0114bffa0497c1f30c18a02a
MD5 813270f3d528a76a3e21a83ab42e8072
SHA1 cb67893a527fc296c10c5638e7b22a4e9e266452
SHA512 8ea0d0b73f131d5f4c9da6a43f62c542a17613021b15e87b8268983b2e37b4d7f942501859febf717067d538eb9a450a1226f116f1ff169c425221a754387604
TLSH
T11C51BD043784EA67D66A0233ACA1C2DD36757E82DF46031BB0D07F7F3A316E54A221A2
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_0019.0004_none_1cbe04a2ab6ffd98.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1Y32WWBG.E57\LGQE7YCY.ECX\manifests\scre..tion_0000000000000000_0019.0004_none_1cbe04a2ab6ffd98.cdf-ms
Size 4KB
SHA256 90a289805775fb615bdf30f739282adeff2cf61aca6094dc3f6ad0f3335efae1
MD5 189be5a7c040bfacf48cb5534688e8f8
SHA1 f8d2733254e3b0896f327832860ddb381f777bbc
SHA512 5c786220ac2074ce3f882adff29f2a4bf632a9d06ac83354886e17ecc176396949612ebc872b1c3acd09a6dc1e0387bcba2f09f93541d073f99e693805109a01
SSDEEP 96:n+a+pAtEW0m5R/8UmPkEQK1m9mL+dxH/s:+IVA98aEuC0
TLSH
T17A811140B780E823D61457339CE2D2C073357DA64FEB574B30987B2EAD367C69722265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1Y32WWBG.E57\LGQE7YCY.ECX\manifests\scre..vice_4b14c015c87c1ad8_0019.0004_none_f3909dd9d3f58fab.cdf-ms
Size 4KB
SHA256 f4a5864a0e67b56bf72b756d9e6b46b58ceebf48886ba5b89f722a7ccf8f6f4a
MD5 7d0dd8c4ca4bd0dd0c637b3288e00839
SHA1 4a576a6d648827627368b2396c07ff5b787fd975
SHA512 494c2e78a99c038d2e47d0d54c8fa767fad7983bc9e3e21c8ce548bb1c87cb79fabfd6737f5213ee4b9a2bc8a561b748b3960e077cde8d2a0bf5eb4f775e3da7
SSDEEP 96:GGLteV+Ww8U45uEC0W6Np+ZsEwuZNfpcnDvUf:QJjuEQ6p9uZFpEDM
TLSH
T1B9910D11B740E967E5A506339CA6C2CE3B357E83DE82560BB0C47F3F76316E61B211A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DVO979KD.41L.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\95NM1VGH.AEM\DVO979KD.41L.application
Size 93KB
SHA256 6ea3e7e4148fc6b4fcc59ce9abed72247b822a6ffebba6383d623729d45c0267
MD5 1fced0998dbf1f609eaaea7526202b56
SHA1 5624b63fed9cdfa3e8936058449c557d03802b36
SHA512 b2745812745c6f36e54e8da8baf280d4859d705682a65349e21cafd665e0e6af3958af0700ec9510cc1e1d75f727b6bafd0ff207cfc6b0b23cfde1de5a1122f4
SSDEEP 1536:pkp63XmAmki10M5n76+8rJsZckAGSZNVNzWJJ29ymy:pr32AiqM5n76+syMVN6K9ymy
TLSH
T13093413A8E30F4C0477DB021D1A52D673D812B93DB730BACD90A186B0E69796EF5E65C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MW3H9XAO.ZDY\PH0KWO3L.7PM\ScreenConnect.Client.dll
Size 228KB
SHA256 9507c29ca92f850426ba5a05647214f3f6e408853a2baef97892db5f7e974a55
MD5 db64c607261db6c29852fbb235df5d44
SHA1 ef1aa54cd6a09f178eb0fe006908099bde860f86
SHA512 6710ab02207e5abc9f6f9a343894dfe654fa00aedf879759997528582011bfe7c1135896fd4f86584063913e33704c54d020b451b08616bbbb56112919fb7ac5
SSDEEP 3072:xNYrrhDXQePbEIG2hsNVFJRCcyzv5qnn44O9BexzNzn42zDvJXYd/HT:wrtD1bsI4Jjeqnng+Zz42GZ
TLSH
T1C8347F4633A64C65FBEF0AFBB49091248A72ED056153E76E8D0479FA1DB378283507E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MW3H9XAO.ZDY\PH0KWO3L.7PM\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 abedad01322bc77aaecf0e58331298f62daff9937666265931efc7995e7aa890
MD5 cb59fbfe2c4b0db2feab82b39bb41d4e
SHA1 4144d072fbd1495b70d2412d6cee9c7010bfcefd
SHA512 f1775552d4b3eb070d226db4b7e6ca17def881bc5b78dd44817426454156ad874d4efafa3cb39e9b81353efe87942c0d41b00980e33fecc80cb993ecb2acf9ae
TLSH
T108117B0181C8FA261F3341D1BEE7E021976D5B33048D194BB06968AF8F3DAE683471B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MW3H9XAO.ZDY\PH0KWO3L.7PM\ScreenConnect.ClientService.dll
Size 78KB
SHA256 81d06d6f5c4dcca630d5001425566ab976e222082612f96dfc99078f585139ed
MD5 4aaa3056c5af955a0a8c233869d7291f
SHA1 b373544d77580000e73dd09c7ef3c53a65d747de
SHA512 f0ae365f3ee4cae565dfbbbbdbe66631c12a1e381ef642bf29420366e58f7819cafc3c580a4dd7bb2e465fad7234c715927cee621cf88bcafcbb57145a770e2f
SSDEEP 1536:sOZLd94e+JBm+Xfi/N7t2DEPVQXV3lk9OIb5M7rbm:sEgtxPantQXV2hMHi
TLSH
T18E736D12A3BC8A26CDDF4E7874A1B0450F719A41D4A6FBD89DC9A4EE5F523C13A043DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MW3H9XAO.ZDY\PH0KWO3L.7PM\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 97a3af25bfd040d4b7c09d39137024e3054db3e3ffc6d70c48c8e037bc7d28de
MD5 adc9c617ac3026a6947fdf12027f9144
SHA1 6c4c468e7457e446cb9ede02348342d07df41eb8
SHA512 809c19fb85b74764cd0e6d50e6ee5620e170e24b3340c30c463dd81ae2ab69a4e85949dcd5ccdcb845112359ee9efe53a049aa62f78c95bd8148cd1e2809e106
TLSH
T15A31E90641C4FA251F3301C1BEE7E061975D5B33158E194B706959AB8F3DAA6434B173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MW3H9XAO.ZDY\PH0KWO3L.7PM\ScreenConnect.ClientService.exe
Size 93KB
SHA256 bc0b03a340d46c23a4a2f91ebd7ed4d0fcf92fc7c4323f522c86369ad483f68a
MD5 01670513447f464926e6d2c74f529162
SHA1 22627141ffec9b9317b49ca95ac9b27aa5b79ee2
SHA512 e6747fb124f5e8e3361d723cce10a1626572682b19d713278e6081611e2f55c4ee5a0680cf96cd4cfd31759fef676c242bc133677222ccd682c6d04085291388
SSDEEP 1536:jg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg0T0HMa7r/Q:MhbNDxZGXfdHrX7rAc6myJkg0T0HhHo
TLSH
T1C1935A13B5C28872D473093158E0DAB49A3FF9615E21DEAB3798022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MW3H9XAO.ZDY\PH0KWO3L.7PM\ScreenConnect.Core.dll
Size 552KB
SHA256 dc3168bfff8b8bffb36f4374da4dfce8a96786a632eb6bdb666099fc0cf16a54
MD5 d7c08ace02be7766ca7c7cd2db3f092c
SHA1 c458f768008fcf3cea1f683665a14f049aaf0da1
SHA512 e7370785050c9cb4772fd0e15f9af11b00b90b812226689603c2f44f93af220bd9a638e440935e284739220e1232993de07f264d5b2505bce8b35345168fca1b
SSDEEP 6144:ZTc03YqaaDUy3dX19jcjxrvm7zh7LZP8UllEDOb6E9GI7Ar1nb2q/QSeDTax4k4J:ZTeqafoFYkPJuolEDOuE9GWKb2IiXh/
TLSH
T164C48F11B394B66AC6BF0B37E0A084151730ED08710AE76759A4D4E83F6278F6E49EF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MW3H9XAO.ZDY\PH0KWO3L.7PM\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 701043b60905f164f8c7eacbe72a8738948409475263bc331711895950a4edc0
MD5 dfc5114133b3b1356aed7daeb3386c6a
SHA1 ac875bebb46228d56ca4f48e64a165229e0d8aea
SHA512 6d76465e8a60678f5e4cdfc7141aa00a46f63b1384aa447d6b0350c3632f920c6b70966da3d02dcf5a073893a1edf876e1d7aec550d11bd5782f6d3d90561f03
TLSH
T10121670181C8FA261F3302D2BEE7E421979E5B33188D194B7469689FCB2DAD64747173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MW3H9XAO.ZDY\PH0KWO3L.7PM\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 ff82ff2c60cebea3eb57b9d50e5ac1653009ff781d288f4b4b0c3578b2aefd30
MD5 70c1afe03b8e1787c55301c4e40a4524
SHA1 6d4f89426b36cba739ac87a116308a133ab4343f
SHA512 71f50772c6ef48fa01bbdb1c6272ab087664f77c1ae2805c30c55a9100c9de09c4b6ac00fd77bacb14b8ef3f48dc8a5d959ce3537de488e60afa99cba3fedc78
SSDEEP 24576:B5phFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTE:nphJkGYYpT0+TFiH7efPJ
TLSH
T11D85AD41E2C369F5D46B047888BF572AAA747C080324CAFB97D4BE356D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MW3H9XAO.ZDY\PH0KWO3L.7PM\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 22a7184049b2294a26e2ae97f1e52a45dae7e375bd40bcef82d28afb76628549
MD5 e7e3aeee640f9090fbf05eddbd147a95
SHA1 4ee7cb637008e348d72f8adc46a86893eb715b2e
SHA512 3f911ff1fab3935405ded38be4b7570e7e495f7595b2196013df2957a42f57065606fe74bde96256cdd3fa32f1a074c701fd044568de2ad33415402d2328b1e9
TLSH
T18F41F31281C8FA250F3301C27EEBE431879E5733158E190B74A9A99BCF29AD74747177
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MW3H9XAO.ZDY\PH0KWO3L.7PM\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 6cb34f11581e157628118bf39adc1effdc92ef81043632ad9f6b7952b85fb1eb
MD5 5291b601616078582e4448dd8f0dd03d
SHA1 734146fafa922d6fdf9adebe76b05d8747c71784
SHA512 b663aa83b020ecf0990dc2e6c28bdde5ae88f0e7fba93bbbb87420ce8add29ebb8e4845ae2bb9d5b4009edbc7de97bd4c71cdd9495a585e1496548a6a20836aa
SSDEEP 1536:hoSOs/MRZFe9aGhDvmDTyQX5E+TC7tih2syGbXe7rN:hoTsCZFe99myQOKDeH
TLSH
T1EC537D4163E84619C9FF2E7DB9F2A1141EB0AA438441DBAE0DCD65EA1E537816F203F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MW3H9XAO.ZDY\PH0KWO3L.7PM\ScreenConnect.WindowsClient.exe
Size 599KB
SHA256 0fcf040e7c627085146cbe9ca77bc61d2dec0eacc500651fd2b02f76387a0c2e
MD5 b35a60a49d6b334ab27104e72d011661
SHA1 4b7f3832da8745d35314d29405637e0eefb88994
SHA512 f4512a1e06bed58f324640d160940118df72be916e7deae095084122d2f374126dcda438e6078aafab8347df4dca6d21dd88a6c50ae862fbed57fdb08171f297
SSDEEP 12288:tdqgkJ1ws1YGO711SxLBr+b/SCNv9h+si:61Yd1ExLQb/NtSsi
TLSH
T12BD45C22737CDE7BC8AF0779A0B118245FB0F819A285E35E4954A5E90F8738A5E443F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MW3H9XAO.ZDY\PH0KWO3L.7PM\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MW3H9XAO.ZDY\PH0KWO3L.7PM\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 aface8e8210443e62021751699279663bed2007af7a86d905f2ec7ba5dfc6ffe
MD5 54e4e4a218ca37ef40fe7a66eff9169c
SHA1 6356b3e9a4b105b93fdb0f26ca6992149ceeba1d
SHA512 9060ed3ed281f8eb08efdf7fbceebf6b5e6b03c3328c8336b67185a6dece723eefba3f969341be014682fb728aabc2e7199d9cc8259c0bebef6a7be71fda6cfa
TLSH
T1CD51D41641C8FA210F3301C1BEEBE471979E5B32158E190B7099999FCF2DAA7474B177
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MW3H9XAO.ZDY\PH0KWO3L.7PM\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 360f2c32f1675fd92ea4895693de10e849cf36b21f7c9952d6af4e7090cd8421
MD5 283b73cc24c8b64544a19a0212f12f0c
SHA1 8aaf1107de02e0190a4ea0dd4e4ed05808e3df85
SHA512 54fda7d41a7ce92ee47d12ba99e6a1f43e27b6165105cf77e9d31743cc0a2f708f3d474fd13d1f42167353c4c5a7a2ebe9325f1e172f9a0f1a67df8a2ce4f370
SSDEEP 96:xWLwOhoyTvJe2wvyAkodkYkFk8kwvkpdykG4kOpQkOpXyk2AkOpD:oRReYo+d2pbpd7G9UFUX72VUD
TLSH
T192F1BC9684C0BD21573291C0FEE39924BD057F2302BE148ABC4D19BF9F765899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MW3H9XAO.ZDY\PH0KWO3L.7PM\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 14525dd6476e98c5746aefc3386768c2320d3ed802e638ad1ff49dabb983229b
MD5 fef4bfd6bdb04cbe2e2a860be8485a90
SHA1 0bbed282196b5d8dd22e327ee1c4c593b3d9f064
SHA512 f38e6cdadca4b57584c450d4662489a5fa4fbd9b612e2305c19cc7a9f3c5b9228a6b50340a03fcc6ca7f35daf61e478c2daca4032cfa40990d332c99429e9553
SSDEEP 1536:Ntyil44BzbRCI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC70t7re:OcSukLdwtH
TLSH
T17483F68235762631DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4292-288-0x0000000000830000-0x00000000008CA000-memory.dmp

Download

memory/4292-302-0x0000000002AB0000-0x0000000002AC8000-memory.dmp

Download

memory/4836-18-0x00007FFED6290000-0x00007FFED6C34000-memory.dmp

Download

memory/4836-303-0x00007FFED6290000-0x00007FFED6C34000-memory.dmp

Download

memory/4836-35-0x00007FFED6290000-0x00007FFED6C34000-memory.dmp

Download

memory/4836-36-0x00007FFED6290000-0x00007FFED6C34000-memory.dmp

Download

memory/4836-46-0x000001AEC1C10000-0x000001AEC1DBE000-memory.dmp

Download

memory/4836-20-0x00007FFED6290000-0x00007FFED6C34000-memory.dmp

Download

memory/4836-19-0x00007FFED6290000-0x00007FFED6C34000-memory.dmp

Download

memory/4836-52-0x000001AEC17B0000-0x000001AEC17EE000-memory.dmp

Download

memory/4836-34-0x000001AEC1620000-0x000001AEC1670000-memory.dmp

Download

memory/4836-58-0x000001AEC1D50000-0x000001AEC1DEA000-memory.dmp

Download

memory/4836-64-0x000001AEC1D40000-0x000001AEC1DCE000-memory.dmp

Download

memory/4836-33-0x00007FFED6290000-0x00007FFED6C34000-memory.dmp

Download

memory/4836-70-0x000001AEC1770000-0x000001AEC1788000-memory.dmp

Download

memory/4836-16-0x00007FFED6290000-0x00007FFED6C34000-memory.dmp

Download

memory/4836-21-0x00007FFED6290000-0x00007FFED6C34000-memory.dmp

Download

memory/4836-15-0x00007FFED641F000-0x00007FFED6420000-memory.dmp

Download

memory/4836-26-0x00007FFED6290000-0x00007FFED6C34000-memory.dmp

Download

memory/4836-13-0x000001AEBD230000-0x000001AEBD3B8000-memory.dmp

Download

memory/4836-11-0x000001AEA2B10000-0x000001AEA2B18000-memory.dmp

Download

memory/4836-23-0x00007FFED6290000-0x00007FFED6C34000-memory.dmp

Download

memory/4836-22-0x00007FFED6290000-0x00007FFED6C34000-memory.dmp

Download

memory/5584-14-0x00000000747E0000-0x0000000074F9C000-memory.dmp

Download

memory/5584-10-0x00000000054B0000-0x000000000565E000-memory.dmp

Download

memory/5584-9-0x00000000747E0000-0x0000000074F9C000-memory.dmp

Download

memory/5584-8-0x00000000747E0000-0x0000000074F9C000-memory.dmp

Download

memory/5584-7-0x0000000005270000-0x0000000005302000-memory.dmp

Download

memory/5584-6-0x0000000005790000-0x0000000005D4A000-memory.dmp

Download

memory/5584-5-0x00000000747E0000-0x0000000074F9C000-memory.dmp

Download

memory/5584-4-0x0000000002A40000-0x0000000002A64000-memory.dmp

Download

memory/5584-3-0x0000000005080000-0x000000000510E000-memory.dmp

Download

memory/5584-2-0x00000000029A0000-0x00000000029A8000-memory.dmp

Download

memory/5584-1-0x0000000002980000-0x0000000002988000-memory.dmp

Download

memory/5584-0-0x00000000747F2000-0x00000000747F3000-memory.dmp

Download

memory/5584-12-0x00000000747F2000-0x00000000747F3000-memory.dmp

Download

memory/5584-17-0x00000000747E0000-0x0000000074F9C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads