3d8d2bba43d1bf17542f31503f891c2cbe6fe269d5d3ffab41e08f4b3cb86cc5

Analysis

max time kernel
149s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 10:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_b971f0d2dce14516664bf15ce0ba1562_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Size 2.4MB
Sample260710-l735eaas7y
SHA256 3d8d2bba43d1bf17542f31503f891c2cbe6fe269d5d3ffab41e08f4b3cb86cc5
MD5 b971f0d2dce14516664bf15ce0ba1562
SHA1 177a8c6aee40906f60cb1174302be9bb50e61730
SHA512 67db3f061a009a6d0915926eaf2dc33ebd6e6737a6a0c04480bbfe7d7fdb9db15a6f0bb97f9750b9fe8a5dc1425d2f569e605535e08a906499d0457027454fcb
SSDEEP 24576:zShXBJF/sEEznSRpiFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTq:mhRDO4piJkGYYpT0+TFiH7efP1Q9Ozu
TLSH
T1C9C5BD02B3D656B5C47F0678987A961AAB70BC040316CBFB57D4AAB92D337C04E357A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1432	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\97TZ704Y.JCT\X0VE2XAY.579\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_b971f0d2dce14516664bf15ce0ba1562_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_4be256b049d4ca11	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d1339154c6\implication!scre..tion_0000000000000000_0019.0008_84a = 68747470733a2f2f636f6e74726f6c2e617574683337372e72752f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_4be256b049d4ca11\scre..dows_4b14c015c87c1ad8_0019.0008_none_46eee1e060	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf\DigestValue = 5ba95918731df980a71a036b1d5a38a60291070f	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_0019.0008_4be256b049d4ca11\PreparedForExecution = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf\lock!0a000000b5a1590e98050000f40700000000000000000000 = 30303030303539382c30316464313035343838363366316562	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0008_none_46eee1e0609011f2	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0008_none_f3caa247ba01622d\Files\ScreenConnect.ClientService.dll_e781b1c636 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0008_none_427709ff2441fec2\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_b19286413ab2b852\LastRunVersion = 68747470733a2f2f636f6e74726f6c2e617574683337372e72752f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf\implication!scre..tion_0000000000000000_0019.0008_84a = 68747470733a2f2f636f6e74726f6c2e617574683337372e72752f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d\Files\ScreenConnect.WindowsClient.exe.config_f7f = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d\lock!12000000c4a1590e98050000f40700000000000000000000 = 30303030303539382c30316464313035343838363366316562	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d\DigestValue = e9d36ea53aa9fae3b88de24694b04bc0516b94e5	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_4be256b049d4ca11\scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d133 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_0019.0008_4be256b049d4ca11	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_0000000000000000_57051d5779c6eb7e\LastRunVersion = 68747470733a2f2f636f6e74726f6c2e617574683337372e72752f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_4be256b049d4ca11\SubstructureCreated = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_00000000000000 = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d002200680074007400700073003a002f002f0063006f006e00740072006f006c002e0061007500740068003300370037002e00720075002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320035002e0038002e0030002e0039003400340030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320035002e0038002e0030002e0039003400340030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e00530065007400200063006c006100730073003d002200530079007300740065006d002e00530065006300750072006900740079002e005000650072006d0069007300730069006f006e0053006500740022000d000a00760065007200730069006f006e003d002200310022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d00220028006800740074007000730029003a002f002f0063006f006e00740072006f006c005c002e0061007500740068003300370037005c002e00720075002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300030003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0008_none_f3caa247ba01622d\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0008_none_427709ff2441fec2\SizeOfStronglyNamedComponent = 73b8080000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_4be256b049d4ca11\appid = 68747470733a2f2f636f6e74726f6c2e617574683337372e72752f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_none_1cf80910917bd01a\SizeOfStronglyNamedComponent = 7c9e010000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d\Files\ScreenConnect.WindowsBackstageShell.exe.co = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0008_none_46eee1e0609011f2\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0008_none_427709ff2441fec2\DigestValue = de7b86e45f09d1d5ae0d55e3cc6dcc07ad09d8a6	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d1339154c6\lock!14000000c4a1590e98050000f40700000000000000000000 = 30303030303539382c30316464313035343838363366316562	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 680074007400700073003a002f002f0063006f006e00740072006f006c002e0061007500740068003300370037002e00720075002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320035002e0038002e0030002e0039003400340030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320035002e0038002e0030002e0039003400340030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e00330032000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0008_none_427709ff2441fec2\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_4be256b049d4ca11\lock!1d000000c4a1590e98050000f40700000000000000000000d91c7 = 30303030303539382c30316464313035343838363366316562	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0008_none_46eee1e0609011f2\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d\Files\ScreenConnect.WindowsFileManager.exe_0e21f = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_4be256b049d4ca11	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_none_1cf80910917bd01a\lock!02000000b5a1590e98050000f40700000000000000000000 = 30303030303539382c30316464313035343838363366316562	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "RTW44T6NTRQEM57MRO6R3NT4"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32352e382e302e393434302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_none_1cf80910917bd01a	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_4be256b049d4ca11\scre..core_4b14c015c87c1ad8_0019.0008_none_427709ff24 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_b19286413ab2b852	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_4be256b049d4ca11\scre...exe_0000000000000000_0019.0008_none_6f725b0891 = 01	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "HRJ25P9WJC88ABTQQXD4ZCQB"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 680074007400700073003a002f002f0063006f006e00740072006f006c002e0061007500740068003300370037002e00720075002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006d0061006e00690066006500730074000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0008_none_f3caa247ba01622d\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_4be256b049d4ca11\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d1339154c6\DigestValue = 3eae8d3f27f5f2f5fab3d015b8ed6d3a45b9fd6e	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d1339154c6\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_84a835795e7e033a	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0008_none_46eee1e0609011f2	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0008_none_46eee1e0609011f2\SizeOfStronglyNamedComponent = 7cb21a0000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf\DigestMethod = 01	dfsvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\OnlineAppQuotaUsageEstimate = "3815523"	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\97TZ704Y.JCT\X0VE2XAY.579\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\RTW44T6N.TRQ\EM57MRO6.R3N\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3472	2026-07-10_b971f0d2dce14516664bf15ce0ba1562_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Token: SeDebugPrivilege	5616	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 5616	3472	2026-07-10_b971f0d2dce14516664bf15ce0ba1562_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe	87
PID 5616 wrote to memory of 1432	5616	dfsvc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-10_b971f0d2dce14516664bf15ce0ba1562_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_b971f0d2dce14516664bf15ce0ba1562_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Users\Admin\AppData\Local\Apps\2.0\RTW44T6N.TRQ\EM57MRO6.R3N\scre..tion_0000000000000000_0019.0008_4be256b049d4ca11\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\RTW44T6N.TRQ\EM57MRO6.R3N\scre..tion_0000000000000000_0019.0008_4be256b049d4ca11\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:1432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\RTW44T6N.TRQ\EM57MRO6.R3N\manifests\scre...exe_0000000000000000_0019.0008_none_6f725b0891c0ad1d.cdf-ms
Size 14KB
SHA256 211120277014c51de10e56ac078cf9e5190b03c55c23d2dcabb8fa52d2b51f4c
MD5 7835250481824127ca278391189c14d4
SHA1 8d6d7e4c5d236428ec3ba71b458c87b9c5c9de73
SHA512 d90197531b87edf2e703b350aff441de60c9adad6c060f7764af6483953c03d5243553fedfab2543767deaa763dd3ff7a15bb2e89fc827a488b7c959578cc834
SSDEEP 192:OdzwHH/JWD7l9eTV9XUrerneEEGXNXVp15AcJztVhg4PEH4:OinhWDh9eg+nRHXZ7EH4
TLSH
T13862C901B792EABAE3501773DCDAC2E47232FEE51F56135730443B2E9E302C98A23691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0008_none_427709ff2441fec2.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\RTW44T6N.TRQ\EM57MRO6.R3N\manifests\scre..core_4b14c015c87c1ad8_0019.0008_none_427709ff2441fec2.cdf-ms
Size 3KB
SHA256 305b1dfcccdac2f1d4bf77d7179af79785e0033ac99351a4ce76803c706d962b
MD5 6a1923121949d1aad568b8d63b91bed3
SHA1 4502024bc0373923c0dc2c614ccaf78e5493f40d
SHA512 22d001d8940d93be4203998b403f3d1e21a5823e4961e46807866af622572b32b2dd456c600b02117b6d17318d2aa97c982bac613ab56c4c392d931a84b25f38
TLSH
T1266154017244DE17D96A0633ACD6D2EE37757E83DF82420B75C07B6F7A322E646121A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0008_none_46eee1e0609011f2.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\RTW44T6N.TRQ\EM57MRO6.R3N\manifests\scre..dows_4b14c015c87c1ad8_0019.0008_none_46eee1e0609011f2.cdf-ms
Size 5KB
SHA256 f42f56fd0192eb8dec02ac57e5f5e5b6423ed5a9d4bc66357089a041483b6bb6
MD5 c50a3d55db6c97894c9fe76571e18f10
SHA1 f982dfd5798b04a37d0fd06d7a7ae9da7457f994
SHA512 81e8e36db00c49f83cf0fbad2148624732a15199855250bf1085da1c8b8f78d0cf06c1b1fb4d47ffa8564a07476002ece30ed0d1c17475220ca52fc1dee1e0ac
SSDEEP 96:4qP+RxlQheV+Ww7SWk/WGgyHmzSNp9QHAzwVfZ41dngnsR6O:kRxlxJDvOMrvOA+QQzO
TLSH
T1A4B11D117304D953D5B806335CAAC3EE2B787C53CE82460B70D4BF5F75326EA47212A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\RTW44T6N.TRQ\EM57MRO6.R3N\manifests\scre..ient_4b14c015c87c1ad8_0019.0008_none_a3bde3230d25e1cf.cdf-ms
Size 6KB
SHA256 134d94befc144a1c398387c02e304dec43ca7479c1a2f3efde318f6d066e1f8e
MD5 164d78f08a7105923f76081a61e83ac5
SHA1 ef85a2eac72c48c93d6f1a22fc1c9ef7dab1430e
SHA512 efb85082052ac97ef65a4b8d0aec8013e613390ee7566bcd6c65d51dbb0fd345f7026bbf9d4c8f09e0db3f49f3fee74c28a482c94ec8125f7dcf4b34fce550b2
SSDEEP 96:6MWhDMPP/p/eV+WwwSE8Wm2TOt0O6gG56OL6rsrHFrlzinsVoeb:cZMPP/+JK4mZ0QG56OOMFhSsT
TLSH
T1F0D1EF227304EE17D5B90A33AC9AD3DD37683D96DE42470B70C4BF2F76322A61726191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d1339154c6.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\RTW44T6N.TRQ\EM57MRO6.R3N\manifests\scre..ient_4b14c015c87c1ad8_0019.0008_none_d88c67d1339154c6.cdf-ms
Size 2KB
SHA256 2f4d8dc25e9b8ff4000710bb74373b0dcd1ecebd535d9e106370997533bbdb1c
MD5 0f4b0cfc672967c996129ae2276bf6b9
SHA1 04db9199b9c639354903451ee0d975c6147c5f4b
SHA512 5aa3d5740e90c8bb1fdb14e4c1ba72bce0ff33a830604254e8cba8430ff1ebf5a9d22f1e44ed70c2c7876ad32328f5f8a47a1939f5c489ec45e8f216b7426729
TLSH
T16351DD057A88EA67DA6A0233EC85D6D932757E82DF460717B1C07F7F3A312E54B120A2
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_0019.0008_none_1cf80910917bd01a.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\RTW44T6N.TRQ\EM57MRO6.R3N\manifests\scre..tion_0000000000000000_0019.0008_none_1cf80910917bd01a.cdf-ms
Size 4KB
SHA256 73131481c83bdc4a78598b4f3343fd73603a76d2f045ddf64675b1ad76baff8a
MD5 0d0552590ef25d3c02935ffa75b23ac0
SHA1 16014a9bb04c55c77029504f23e04e3f12baba47
SHA512 575c1436ad1bc5e4e7a6fcd36b87bb28ec8fe533b6c4352c0cb4eef8d087a6f35ea4a960bc78d61555e8854b8c0ecbdbe2405326f42a0ec8ab3cea215fc349cc
SSDEEP 48:13P/mrIgAqzIv22gRRu9o0m5RD7L9U7gFUTUEekKf4sQgbmZFms4Ch+UQRcchd:FOUOGUEW0m5R/L9Um9ksQPfmvVUQRtL
TLSH
T116913E80B780F823E6144732ACD3D2D032357DE64FD6871770887B2FAE363C29622266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0008_none_f3caa247ba01622d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\RTW44T6N.TRQ\EM57MRO6.R3N\manifests\scre..vice_4b14c015c87c1ad8_0019.0008_none_f3caa247ba01622d.cdf-ms
Size 4KB
SHA256 4a8cea5efa473d3467fc5f43ba922c819c883e13c0d2410ce09d54cb7ca017ce
MD5 0a4be7f4fa3bba5bb1b96802b0f66167
SHA1 0b38f5c02045a72571c0925f94867dd663aa1b30
SHA512 395e805c506acb69db7d9b0b6c11f7d43c5612a18f16aab78a7a39e34aef95ae7d829d9127e4e4247cfb5edfa365b71152a596d9fe1616fd9951ffb632735e21
SSDEEP 48:EjxCDVxldg2e6S+9ow87g/EW75uvnlF1+ILTsV/MZr70seBlxAJhNWe1vvunwAvO:EdQeV+Ww8SE45utF1bse7zfse1unDvuf
TLSH
T1FB9142027300E463EAA60772ACA6D2CE7F797C92DE85060FB4C43B7FB6316965B11295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\97TZ704Y.JCT\X0VE2XAY.579\ScreenConnect.Client.dll
Size 400KB
SHA256 c8901f627cb7a5502d6726792c56aff9a94d2c2be0411ac53c8a5b75cbe37dcc
MD5 a3c43d75e1b611e607ebe91fbe5cd7ed
SHA1 3eae8d3f27f5f2f5fab3d015b8ed6d3a45b9fd6e
SHA512 087ada3a0207ce88757d35a3ab563a26d42cedba021be44c7d550266039e2be33d7f8c296958f610acea6b77c51c55ea9b188e2c97fbb5576d216904d982f43f
SSDEEP 6144:7MSiC+YXJN9ZvH8ETEavHy+vd7JPYIYyqQni65/PG+:gSF+45HHTEavSW7OQni3+
TLSH
T1F594CF85B3B44D2DFEAF0A37F46081258E739C456552F66D0E44B9F80AB37A28644FE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\97TZ704Y.JCT\X0VE2XAY.579\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 88fd90d366adc732fb776a8840ef28bacdf70724c9513ff21605c6c0c7509e6f
MD5 2059b0cb6c221a1a6ea9341b27af954f
SHA1 699865a6e5a53e3622f8beed2bc1d06f829176ef
SHA512 6414c1c24db740c7db12ab0b1914992d4b28d11aec640a2393cf16d7b165d243db33c2d05c0957b5c38487ca2648a12e6a537671bf59b77aab29921318b6fd12
TLSH
T1A0115C0181C8F9261F3301D1BEE7E021A76D1B33048D1547B069686F8B29AD74347173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\97TZ704Y.JCT\X0VE2XAY.579\ScreenConnect.ClientService.dll
Size 78KB
SHA256 badd627ff97136084e9c811a5400d32e9584eaebc9209a65333aea7f5153d480
MD5 3aded48ac715aee952d445a81b051843
SHA1 1485daaae9b3ec2dc1e03c1229cd156b70b34ccd
SHA512 0528999dbca8e1636f384d8eaa015ba1b1a3b0e9e3e46008f5d754d607eb166748583e00385ede1b2dd99513da228529cbb126265fd1bd922137c37818de414b
SSDEEP 1536:r7nnFxZ5/ZSXj+LFOPB8PrHwEkRQXV3lTH2obPFw7NI:r7nZ5/ZSXjgFqKPrL+QXVFHFwu
TLSH
T128734C42E3BC4E26C9DF4F38B465B0450FB09A0294A2F7E99DCDA4F61B467C12A143DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\97TZ704Y.JCT\X0VE2XAY.579\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 8147e5d137a6684ff7114ce382eb5fa23125882b04ea497d2e9f3192b688571c
MD5 2859234383f70894445dd360faa6b3cd
SHA1 523af10a8e3f1841bf91d5b1ce3f08ee8298c6f4
SHA512 2ed4f41ace3bf12d5dbe2aa068f855bc30d7dd1ba4b6120d31cd9e072ef66d362ab92e8d4aabb1d13b6440d5fc9c57b776d413a644151469663b9ed148c9d09c
TLSH
T10931E90641C4FA251F3301C1BEE7E061976D1B33158E19477059599B8F2DAA7438B177
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\97TZ704Y.JCT\X0VE2XAY.579\ScreenConnect.ClientService.exe
Size 93KB
SHA256 63ae8c708ab99e4795298c68e3fc57a414f929f5914abd8c57232ca37f8c88e6
MD5 9f78d93eceb6287ec6556a55cb7637d1
SHA1 543f355e12862711931184e1c77a47883e40be39
SHA512 a0da5bf1014ec9fc03af6d19e5e9d850740bad03858bb30cb6673b97e8f5c9891e4debef1acc10fe1cd5e264b40cb1597afff17924461390546f5a6dc4a7993b
SSDEEP 1536:bg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg8U0HMG7Xxd:UhbNDxZGXfdHrX7rAc6myJkg8U0HHVd
TLSH
T163935B13B5C28872D573093158E0DAB09A3FF9215E61DEAB3788022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\97TZ704Y.JCT\X0VE2XAY.579\ScreenConnect.Core.dll
Size 553KB
SHA256 4dc65c2ec967f80c61d98fe5734869c6e9debaa99c063cf56086740aa4a072c9
MD5 be19cbe04549a8cf605a5aa37dd3b2da
SHA1 de7b86e45f09d1d5ae0d55e3cc6dcc07ad09d8a6
SHA512 8ae256df5b4878ae0bf76ea29119cdcc3e9a1b84ba3b3386f75b0810f7b16bb1ae9c102f20bb5076e2c6b5ab996307e737f472c17eec605d0a11ad5059e8316e
SSDEEP 12288:tx6Uvha0XYZB2N/R6qIs22VF/sbbGHEznIX:FhXBJF/sEEznk
TLSH
T12FC46C1333E8873AC67F0BBAF120D9154A71E911B30AE75B1A99F4E52D823894D4C7E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\97TZ704Y.JCT\X0VE2XAY.579\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 d25ba6b9e5247ed772b247f70c1df44070d7de2a2d81d495c590fd9fbd8d6f4c
MD5 0141148aba6e1e515e2e898902a87535
SHA1 3577b62bb9439b6a7931c15fae11e05b42aac677
SHA512 3d22666adfe978f9d0a94b7912a6dd5acbe811e6b953d229f9a0a1a5e81c27a590e4a4206571a91c5dc5625beb53e4826819856c75d84ac224713b8eb601a4f4
TLSH
T11721670181C8FA261F3302D2BEE7E42197AE5B33188D194B7469689FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\97TZ704Y.JCT\X0VE2XAY.579\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 4913381885979aed0233ac2a3401eb597b8c0ef37ac3f96b497901f95f251d26
MD5 9a3d026f2549ad04bb14102ccc94d633
SHA1 38c137f1584e4797e39a85439f3ece01a192bd39
SHA512 3cf1c7b5b095473ded49edf4aa646a17f06fee480fcd1a3c2334cf5d98925f4c79e61193466434a33585b57121066853d3a1c319265995a98904bef86859f734
SSDEEP 24576:9RpiFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUT8:DpiJkGYYpT0+TFiH7efPt
TLSH
T17185AD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE356D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\97TZ704Y.JCT\X0VE2XAY.579\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 de921e4e98c8fc3d976a482dbcf0f2a3df270b27cb4942026958c453d88de1e9
MD5 a0dda458757bc089901f40b07b1c6549
SHA1 f6f97d3c71df1873fa06b066628c422cff1d14af
SHA512 fb24e22c6e0d1020a5871d76e570fbd459cb3c4872f41c5cb095c21fa1a331ee47d9508fe0c9606ad38ba686e1a503b5f3d71d9bc6e3a560962b3ea8bb4d2595
TLSH
T19B41D31281C8FA250F3301C27EEBE431979E5733158E194B7499A99BCF29AD74787037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\97TZ704Y.JCT\X0VE2XAY.579\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 0dd3250f1e179a89ce0b8ed3eac64c7513ac5cfbba2f6d43fb9aa98887086f3d
MD5 664718a968e0f697cdfeb600baecd10f
SHA1 aa7f417852ee1471a4e751046face0d4571c808f
SHA512 c94016d328584a82f137b2693cf55955ab14c7650da0b43a2e88a132a89e0df86788f8025aac078c1259344f95a3c18ed118bb76282732e85ed1a351c304ce83
SSDEEP 1536:6oSOs/MRZFe9aSNDvmDTyQX5E+TC7Eh2syGbYK7wC:6oTsCZFe9NmyQOOcK7
TLSH
T10C538E4163E84615C9FF2E7CB8F2A1141EB1AA439441EBAE0DCD65EA1E537816F203F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\97TZ704Y.JCT\X0VE2XAY.579\ScreenConnect.WindowsClient.exe
Size 603KB
SHA256 57dfe3b0a64a84102d4113d3b21fa49d961d55cdaba5be263dcd850f6c31fa47
MD5 906624dc96dd029a7d16fddc0cb7f56d
SHA1 5ba95918731df980a71a036b1d5a38a60291070f
SHA512 ae24c5b1770c891db3057c9389446bee8856712577beea2c9b4d342681bb286ff151bb6138c07f2f7c0c4518ee31ef640f26d2ccb713b32cb7fe21d6853910c7
SSDEEP 12288:UmREZ5mKf2cQF7t590iglIUGrpDk+n0zT5gSTX:imKfo2StDj03iSTX
TLSH
T157D46C22737CDA3BC8BF07B8B0F3182457B4EC056685E79E4940A5EA0DD73899A543E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\97TZ704Y.JCT\X0VE2XAY.579\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\97TZ704Y.JCT\X0VE2XAY.579\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 259d2e52d727b7154b29f598e6437b9e51fe47fffd92de3af22bc497e7244339
MD5 caa9ac16ace0682a0c702aa321c25ee9
SHA1 1063153e85f2c5da89d10a2f4efba9a2db2dd5c7
SHA512 1cea0465e44442e9be9ebb3ebb498352908816b646b449a1817a75eb59ce51430928115b909f488c36c84d262e6f7698634fad9d457bef327f9cf281843ee8fa
TLSH
T19251B40641C8FA210F3301C1BEEBE471979E5B32158E19477099999FCF2DAA7478B137
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\97TZ704Y.JCT\X0VE2XAY.579\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 646c8a503886dec81c74db3c0365aa116a8548ad38564d4063ae037b9d3dcc9b
MD5 532579d5fbed70f6a29447ba291ae8cb
SHA1 e9d36ea53aa9fae3b88de24694b04bc0516b94e5
SHA512 d81165d53a41095836ec8364b2acf87fc3d327e961dc2c3d0223589cf452a6cdc313704d58eba1fb2421810d5cc2a098f6ef0da631dfe9b9288299f85888d654
SSDEEP 96:xWLwOhoyTjHe2wvyDk/rkvkK8k4kaqkh9kW4kOpQkOprkOAkOpD:oRreP/AcKp9cheW9UFUAOVUD
TLSH
T1D4F19B9684C0BD21573291C0FEE3D924BE157F3302AE148ABC4D19AF9F765499B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\97TZ704Y.JCT\X0VE2XAY.579\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 794fe19e18b99187b3a6c69f5c11e6f977304363f07028d4a498f647ddc7c497
MD5 b73f9c75e19ef9778eac3235b35299a9
SHA1 737e5a024bc4ece16c96518b037c88aa0538be81
SHA512 5bd6165ef6ca6b5ddbc8aa0492adbcf768d62aee7a0631ec70b30c0e9a45c037bb757569d027b0538e002b628c2d1b47a73f4c8ab04ad41c3310293d3c366bef
SSDEEP 1536:HtyGl44DzbmI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7bZ72:EA2ukLdnZa
TLSH
T10583E58235762231DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03443A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOZVA91W.7TB.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NZ9QQMMB.BGH\LOZVA91W.7TB.application
Size 99KB
SHA256 e0f9f259bc4c87536387843bb5b626781e0cb8aacacda1a017349e8a3e01d7cd
MD5 dde0fb76c074a4d1c1420d0cb8337baa
SHA1 15646327c97bd5f73030b8a7124e7d4e873c901f
SHA512 e76acb3dd7373beadf5eb140a01e54340fa861de372fb3ab9d22437ca85faaffc6a6abe528b430ad6960678cab9bd6f65ee9c6480a318a9982632219967c632e
SSDEEP 1536:I4Bp875Amki10M5n76+8rJsZckAGSZNVNzWJJ29ymgoUbyV:I975AiqM5n76+syMVN6K9ymD
TLSH
T186A3423A8F30F5C0477DB021D1A52D673D811B93DB730BACDA0A186A0E69796EF5E64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1432-291-0x0000000000680000-0x000000000071A000-memory.dmp

Download

memory/1432-305-0x0000000002A80000-0x0000000002A98000-memory.dmp

Download

memory/3472-8-0x0000000005170000-0x0000000005202000-memory.dmp

Download

memory/3472-4-0x0000000005040000-0x0000000005064000-memory.dmp

Download

memory/3472-9-0x0000000074D40000-0x00000000754FC000-memory.dmp

Download

memory/3472-11-0x0000000074D52000-0x0000000074D53000-memory.dmp

Download

memory/3472-7-0x0000000074D40000-0x00000000754FC000-memory.dmp

Download

memory/3472-6-0x0000000005650000-0x0000000005C0A000-memory.dmp

Download

memory/3472-5-0x0000000074D40000-0x00000000754FC000-memory.dmp

Download

memory/3472-10-0x0000000005330000-0x00000000054DE000-memory.dmp

Download

memory/3472-3-0x0000000004FB0000-0x000000000503E000-memory.dmp

Download

memory/3472-2-0x00000000029C0000-0x00000000029C8000-memory.dmp

Download

memory/3472-12-0x0000000074D40000-0x00000000754FC000-memory.dmp

Download

memory/3472-0-0x0000000074D52000-0x0000000074D53000-memory.dmp

Download

memory/3472-15-0x0000000074D40000-0x00000000754FC000-memory.dmp

Download

memory/3472-17-0x0000000074D40000-0x00000000754FC000-memory.dmp

Download

memory/3472-1-0x00000000010F0000-0x00000000010F8000-memory.dmp

Download

memory/5616-14-0x0000014679A60000-0x0000014679BE8000-memory.dmp

Download

memory/5616-73-0x000001467E0E0000-0x000001467E148000-memory.dmp

Download

memory/5616-67-0x000001467E0E0000-0x000001467E16E000-memory.dmp

Download

memory/5616-63-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/5616-60-0x000001467E180000-0x000001467E21A000-memory.dmp

Download

memory/5616-54-0x000001467E440000-0x000001467E5EE000-memory.dmp

Download

memory/5616-50-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/5616-47-0x0000014679C60000-0x0000014679C78000-memory.dmp

Download

memory/5616-37-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/5616-36-0x000001467DE50000-0x000001467DEA0000-memory.dmp

Download

memory/5616-27-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/5616-26-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/5616-25-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/5616-24-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/5616-23-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/5616-22-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/5616-21-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/5616-20-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/5616-19-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/5616-18-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/5616-16-0x00007FF8CFE3F000-0x00007FF8CFE40000-memory.dmp

Download

memory/5616-300-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/5616-13-0x000001465F310000-0x000001465F318000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads