451e20bb50314ad1bcc191200a6a12c0d4bbede39e5b0bc97e5547012582c63b

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 09:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_63508f920944e02f70b8fc86466a6e7e_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Size 2.5MB
Sample260712-lcfevshv6w
SHA256 451e20bb50314ad1bcc191200a6a12c0d4bbede39e5b0bc97e5547012582c63b
MD5 63508f920944e02f70b8fc86466a6e7e
SHA1 88a0451e5986ee17c76e24f2a32972e8aa9a3555
SHA512 9174f176c24aaae435e27a3cfbf2d6b1ba5c7bc25126061cdb4a361ed19afcc257411144d2bb5e456f15206910482293208f95d99c74fdea9d6fb26e0fa25264
SSDEEP 24576:+lqSd0YA6egadV0MKCsgGFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT0x:Cj/usgGJkGYYpT0+TFiH7efPH9U
TLSH
T18FC5BE01F3D666B6C47F0578847A96166775BC0503A6DBFB93D0A9BA2C333C04E327A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
3	420	dfsvc.exe
3	420	dfsvc.exe
3	420	dfsvc.exe
3	420	dfsvc.exe
3	420	dfsvc.exe
3	420	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
4596	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\29P7ELGZ.QWV\KD187HE2.EJ3\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_63508f920944e02f70b8fc86466a6e7e_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0002_dd68d033d61bb8f3\lock!1d00000013c9590ef41100004012000000000000000000006cfd = 30303030313166342c30316464313165303162313564356538	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0002_none_e8e84ef38a223717\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32362e322e342e393632332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0002_none_3c0c8e8c30b0e6dc\SizeOfStronglyNamedComponent = 7ce41a0000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0002_none_3794b6aaf462d3ac\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0002_dd68d033d61bb8f3\scre...exe_0000000000000000_001a.0002_none_5d280ddfb	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0002_none_3794b6aaf462d3ac\lock!0e000000f3c8590ef411000040120000000000000000000 = 30303030313166342c30316464313165303162313564356538	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0002_none_5d280ddfbae1dcc1	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0002_none_0aadbbe7ba9cffbe\implication!scre..tion_0000000000000000_001a.0002_79 = 687474703a2f2f32342e3232362e3135302e34383a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e322e342e393632332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0002_none_5d280ddfbae1dcc1\Files\ScreenConnect.WindowsFileManager.exe_0e21 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0002_dd68d033d61bb8f3\scre..ient_420d02d3849b7992_001a.0002_none_cdaa147d0 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0002_none_5d280ddfbae1dcc1\lock!1200000003c9590ef411000040120000000000000000000 = 30303030313166342c30316464313165303162313564356538	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0002_none_3794b6aaf462d3ac\implication!scre..tion_0000000000000000_001a.0002_79 = 687474703a2f2f32342e3232362e3135302e34383a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e322e342e393632332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0002_none_3794b6aaf462d3ac\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32362e322e342e393632332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0002_none_3c0c8e8c30b0e6dc\DigestValue = be51ffd29ba6888edd0144aa85a4f7687b246441	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0002_none_cdaa147d03b229b0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0002_none_98db8fcedd46b6b9\lock!0e0000008cc7590ea4010000a80a0000000000000000000 = 30303030303161342c30316464313165303131633233306435	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0002_none_5d280ddfbae1dcc1\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e322e342e393632332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0002_791d872ecc895478	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0002_none_5d280ddfbae1dcc1\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0002_none_e8e84ef38a223717\Files\ScreenConnect.ClientService.dll_e781b1c63 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0002_none_98db8fcedd46b6b9\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32362e322e342e393632332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0002_none_3794b6aaf462d3ac\SizeOfStronglyNamedComponent = 730e090000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 68007400740070003a002f002f00320034002e003200320036002e003100350030002e00340038003a0038003000340030002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e003f0065003d0053007500700070006f0072007400260079003d0047007500650073007400260068003d00320034002e003200320036002e003100350030002e0034003800260070003d003800300034003100260073003d00360062006400390034006400340062002d0063003100610031002d0034003100360036002d0061006200630037002d0061003100370037006200350065003200630033006300380026006b003d0042006700490041004100410043006b0041004100420053005500300045007800410041006700410041004100450041004100510041003100650059004100540066004d004f00500043003000780033007700520030007a006b0075004300310054004a007a0025003200620068006d0047006900740051005a004300250032006600730035005a003200700065007a0076004500360030003500340038003600300069007000750056006300510073007000680055003100630043006a006f00760071006b004800340069006100530053004c003800750065004200700045005600690042006a004800750025003200660059004d004e00340074006b006b0025003200660076006e00420031003400460052006e005500310031006600500059005700340047004c0037002500320066006b00470041003700490047006f0031006e00490048003000320037007900650045007900520075004c0043004b0064006a00590035004300510058006200790064003900320035004100480031003300780055004b003400750075006d0056004c0063006e0063006f00720025003200620039006a0052006300780061003900510061004d004c005900610033006b00470036006e0069006e00760038004f0030006700730047005400590061004700680037007a0070007a004c005a0035003900430079004a00610049006f0066006f00480075005300690030006900580058006e00310076006b0036004a0041004a00390068005800730025003200620034005a00360076006e004f0038004a0068005400560032006c0062006c004400380039007700680068006a005600300059006a0062004e0049003300560072004d006c00430070007200560063004c007300690070006c005800780078007400540032006e0062005300760070004f007400680079007900370069002500320062007400550075007200640073006200480046005600480066007500790025003200620062004300780067003600730062004f006300570071002500320062004c0068004400540051005a004d004b0059007a006100260072003d00260069003d002e004c007500630034000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0002_none_5d280ddfbae1dcc1\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0002_none_5d280ddfbae1dcc1\Files\ScreenConnect.WindowsBackstageShell.exe_8 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0002_none_e8e84ef38a223717\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0002_none_cdaa147d03b229b0\lock!0a0000008cc7590ea4010000a80a0000000000000000000 = 30303030303161342c30316464313165303131633233306435	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0002_dd68d033d61bb8f3\lock!110000009cc7590ea4010000a80a00000000000000000000d949 = 30303030303161342c30316464313165303131633233306435	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 68007400740070003a002f002f00320034002e003200320036002e003100350030002e00340038003a0038003000340030002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006d0061006e00690066006500730074000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 68007400740070003a002f002f00320034002e003200320036002e003100350030002e00340038003a0038003000340030002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320036002e0032002e0034002e0039003600320033002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320036002e0032002e0034002e0039003600320033002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e00330032000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0002_none_5d280ddfbae1dcc1\Files\ScreenConnect.ClientService.exe_e781b1ee3 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0002_dd68d033d61bb8f3	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0002_dd68d033d61bb8f3\scre..dows_420d02d3849b7992_001a.0002_none_3c0c8e8c3	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0002_none_e8e84ef38a223717	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 30000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0002_dd68d033d61bb8f3	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0002_none_3c0c8e8c30b0e6dc	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0002_dd68d033d61bb8f3\scre..vice_420d02d3849b7992_001a.0002_none_e8e84ef38 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0002_none_98db8fcedd46b6b9	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0002_dd68d033d61bb8f3\scre..core_420d02d3849b7992_001a.0002_none_3794b6aaf = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0002_none_cdaa147d03b229b0\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0002_none_0aadbbe7ba9cffbe	ScreenConnect.WindowsClient.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0002_none_98db8fcedd46b6b9	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0002_none_3c0c8e8c30b0e6dc\Files\ScreenConnect.Windows.dll_fc0d83aff7df0b5 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0002_dd68d033d61bb8f3\PreparedForExecution = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0002_none_cdaa147d03b229b0	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0002_none_3c0c8e8c30b0e6dc\lock!1800000003c9590ef411000040120000000000000000000 = 30303030313166342c30316464313165303162313564356538	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_7379abe259ef5034	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 687474703a2f2f32342e3232362e3135302e34383a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e322e342e393632332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e322e342e393632332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0002_dd68d033d61bb8f3\scre..dows_420d02d3849b7992_001a.0002_none_3c0c8e8c3 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0002_none_0aadbbe7ba9cffbe\lock!1000000003c9590ef411000040120000000000000000000 = 30303030313166342c30316464313165303162313564356538	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0002_dd68d033d61bb8f3	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0002_dd68d033d61bb8f3\HasRunBefore = 01	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\29P7ELGZ.QWV\KD187HE2.EJ3\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\1K301QCE.ERV\RZAQ4DT6.911\scre..ient_420d02d3849b7992_001a.0002_none_98db8fcedd46b6b9\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5032	2026-07-12_63508f920944e02f70b8fc86466a6e7e_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Token: SeDebugPrivilege	420	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 420	5032	2026-07-12_63508f920944e02f70b8fc86466a6e7e_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe	88
PID 420 wrote to memory of 4596	420	dfsvc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-12_63508f920944e02f70b8fc86466a6e7e_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_63508f920944e02f70b8fc86466a6e7e_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:420
- - C:\Users\Admin\AppData\Local\Apps\2.0\1K301QCE.ERV\RZAQ4DT6.911\scre..tion_0000000000000000_001a.0002_dd68d033d61bb8f3\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\1K301QCE.ERV\RZAQ4DT6.911\scre..tion_0000000000000000_001a.0002_dd68d033d61bb8f3\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:4596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0002_none_5d280ddfbae1dcc1.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1K301QCE.ERV\RZAQ4DT6.911\manifests\scre...exe_0000000000000000_001a.0002_none_5d280ddfbae1dcc1.cdf-ms
Size 14KB
SHA256 9622bf04ef31802e86fbb5b54896daea02e5429155e19cd54a300635fe8a123a
MD5 791fc4d5ae66c639f307771e4410539b
SHA1 3c42419bc46800942a24b0703fe9e4a40aec75c5
SHA512 feb3b5e43ecc47d73b9371d90aca2bceb9af790cc45627b2e014805ea1c61f2dcee451bb51d501e69cf59809107eb328411a894fca5d93fc9c0ceeaae5dee1a1
SSDEEP 192:83EwHH/qfWRSHvVZQY0cwSQQ6gJX4dBvvJFEu7RGr2mQj1Dn4:8jnSfWsVTK2UL4
TLSH
T15D6253E3B692E33AE2A36732FD75D2E472517C681D6520AB3042372C043AD956F36E71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0002_none_3794b6aaf462d3ac.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1K301QCE.ERV\RZAQ4DT6.911\manifests\scre..core_420d02d3849b7992_001a.0002_none_3794b6aaf462d3ac.cdf-ms
Size 3KB
SHA256 ac55d9c4894250f9c8eb26e26339c8452c28a919a44d0b72d6e5e2616d7acc18
MD5 d1e57d87d7b0e0661c8ae294ab9a15de
SHA1 f6cfcaab03feecf0f9568d95553704b2b885ceaa
SHA512 7ca7590a869e1418d3870a420ab3f2db5e6731a07d8b4ea11e67fa54069e8c15b1f528a0c0fcde1e4e8e7a8cce87f02220dcd520e4451cf67b766578c8c4eb88
TLSH
T16061B901B280DE17D9690233ACD6D2EE37757E83DF42520B74C47F2F7A325E55622292
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0002_none_3c0c8e8c30b0e6dc.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1K301QCE.ERV\RZAQ4DT6.911\manifests\scre..dows_420d02d3849b7992_001a.0002_none_3c0c8e8c30b0e6dc.cdf-ms
Size 5KB
SHA256 8614520df2bd3304512dd67a114891a773e228b163c5c7e5131801d01e5f1162
MD5 9431959e3f13c648b61fea87a48a4524
SHA1 ef0a9c46f97d77573f1bf04c910c5114979fe930
SHA512 68dc5145bf27c680214614ca42ed3a3ec99a99d73c01126d006481918f8e797330fbd479798e604c37f4626b76e122acebbf79080c328eff4550bd30672845bf
SSDEEP 96:EFqSl4oheV+Ww7OqIKt49mPXqsl5tD8fyBwnv+U:Ql4JJbKMQXe7P
TLSH
T1BCB19411B294D917D5B90633ACA6D3EC2B25BE93DE03130B70D4BB2F7A326D65212196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0002_none_98db8fcedd46b6b9.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1K301QCE.ERV\RZAQ4DT6.911\manifests\scre..ient_420d02d3849b7992_001a.0002_none_98db8fcedd46b6b9.cdf-ms
Size 6KB
SHA256 fb7a658bcce9f981fa58725c793c978dec13dbb975cd78ca2f838c6ac3ee8076
MD5 71f538bc0ab2d6262b8876da4c4cc01a
SHA1 60e5dc90557a4282a47768b6ac434ea579d20ddf
SHA512 6698f0cf46af5e3a6175f4901562199d0f1f331d70290bed24f835f0885215223c0ad5344130baca5e01f5254915814af6dc8fc85c02a718230b79ea277c31b9
SSDEEP 96:ahrs4launpreV+WwwOQ86KOA6XCgdrQjIdLpvRzV0fBiWwBpqlTPz:I4qaunuJTKMhSwbIui
TLSH
T1EAE13391B358DD13D86C0A73DCA6C3DC3A257D8AEE02470BB0C4BB2F7A726D61292095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0002_none_cdaa147d03b229b0.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1K301QCE.ERV\RZAQ4DT6.911\manifests\scre..ient_420d02d3849b7992_001a.0002_none_cdaa147d03b229b0.cdf-ms
Size 2KB
SHA256 d5f05fa21805454cce0eeef51d9f8bf57ee02ef63ce56f01f1b2e8007bf7b63e
MD5 f396c9c684b8885083af744d0eaf4916
SHA1 9379f4dc7a7b740af066f8e00ee0626a28ef69e5
SHA512 f08aed0d3015d16d88424d740ecbf98a85cbf15150a40c415688444d918f10ce66c6ce242346740df199135cf5cd5a3d0f2195d02c67af8411aafb672fd39bcc
TLSH
T1AE5175057788EE67DA6A0273AD92D2D932757E83EF431307B1C0BB7F6A317D15622092
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0002_none_0aadbbe7ba9cffbe.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1K301QCE.ERV\RZAQ4DT6.911\manifests\scre..tion_0000000000000000_001a.0002_none_0aadbbe7ba9cffbe.cdf-ms
Size 4KB
SHA256 be31e568d5e95dbdb1559f6e1499eeb3fbe3ec96c00469b3e8d6c8cfb712c1ce
MD5 ca7549f38900889b18e287a880eafc9a
SHA1 ab174080a70a390be982faa171cd50dd9048acce
SHA512 b4468f4d0d8a5e10c9888c030e47bc03609468ce0c447dc91d5d4a101200b9bc77f459c8625795c78fa7859c29818e4f381f74acf7a282b3892cfb20d028ad83
SSDEEP 48:9P/mrIQAqzIvJ5kgtRu9o0m5RD7NU7gFUTUEekTf4sQgbmZFms4Ch+UQRc1:BOUeGtEW0m5R/NUm9kvQPfmvVUQR0
TLSH
T17A912C80B740F823D61457329CE2D2D032367DA64FD6971730987B2FAD367C596222A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0002_none_e8e84ef38a223717.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1K301QCE.ERV\RZAQ4DT6.911\manifests\scre..vice_420d02d3849b7992_001a.0002_none_e8e84ef38a223717.cdf-ms
Size 4KB
SHA256 204834b92975dd9ad401ff4862444e70aeb8fec38123544d2b92dcd669e5c9c2
MD5 b365425d56a7ddf4aba04f5b476e8bdc
SHA1 6295d1389281aeda7685b0ff10169080da4a984f
SHA512 096a138c6f68694a69e64f1ef827f79e7fe178b39046e313155b2a43af7123f667b1de69dddc3c9e044bcfb56c3701646469d11c9771bd0470760ed294832037
SSDEEP 96:LQEDBUQeV+Ww8OQ4wu4YtRIoJ+Ca97ZE+:1BMJFuFfF+tt
TLSH
T130A194017380ED27DAA90673AD96C2ED3A657E82DE42120BB1C47F2F76327D61336196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\29P7ELGZ.QWV\KD187HE2.EJ3\ScreenConnect.Client.dll
Size 412KB
SHA256 9ca0dd6d983eaa03fd43befb83fc297fa6a0f5ae46e6acfad422fdf7784cf575
MD5 6b59d8931510ba312fa6262708121f88
SHA1 31a315f72d5bf498841cecde4f820ff0c88f605f
SHA512 7b269932ae6e717fd260c6fdfede247e19440cef9803c7b3d8c762c7f95902c76ca09bd3afa4ba2433df12ffe41f5b8c61446c662b8e82a32cd3230c978383f4
SSDEEP 6144:JVTLfK1H+Zfog91vHtFsRJD8ETEavHy+vd7JPYIYyqQni65/PTO:3jpZfog5F4DHTEavSW7OQniOO
TLSH
T1C794DF8163E8993EEAAF0A73F09161344E76BC05A543F7AE0D1435F41A7B7838764AD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\29P7ELGZ.QWV\KD187HE2.EJ3\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 7fdfc06a2b2bbd5964934b184da06c1af56dcf76940e97263e85e3917983fc24
MD5 432337a461a0bb59f749d44abd55b24f
SHA1 4520cddfe07e1da3d14243fcc3d2daf4599d29ba
SHA512 fba7641413b839cc0fe355e3039f05e38745e50f4d52771c909d4d11abf2bc69db7ffccdb66229433dceade79a11484dec1b3f2cedab442aa034bec6d47dc99a
TLSH
T11611590191C4FA361F3342D1BEE7E420A76D6B27158E194BB0696C9FCB29AD643471B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\29P7ELGZ.QWV\KD187HE2.EJ3\ScreenConnect.ClientService.dll
Size 89KB
SHA256 36e211d86dd6883bd49e5554ea47f0ff4e0422e64d50d9acfead2ef3ea43ef3f
MD5 b4aad345f4dc216bb22939ddabed4816
SHA1 727e70038cec4d2ea2a2058266b727222d37c9d8
SHA512 d457b5dbfb50706d68993fe5958c0e13bb527aaf1fd8c362150566b2e82c25f9dba95c37fac61972d37f6f93193e1498b4aa42cf0a805b5072f485484966a549
SSDEEP 1536:jLO2ARdYMOby1g8VAfSOGI9ATpQbV3lHv0l/yT7L:jLKYpbVfbna9QbVBv2qT/
TLSH
T17A935B4293AC9926C9DF1E34B461F1610AB1BA13D8E6EBD4AC8C60EA1F523C15F543DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\29P7ELGZ.QWV\KD187HE2.EJ3\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 8bd45c4e681529c90907b4bfeb76065ef8eb724efba4fe6ba8d2ee740861fd28
MD5 54fb4f849943e88fdc158a18e1d9e7e2
SHA1 3a5dfb30bc9d9cd90dc8f67c0e4b65bbddacad64
SHA512 b5859e9033eb3b9e5ebc77732352648417974fcabb36e516a44a77b32becd6b9a0d828af46f5f6473cc9a0fdb6959a31dcb968effcc2b22303c3eaf630669a32
TLSH
T18231F61191C4FA351F3302C1BEE7E4609BAD5723158E290BB059699FCF29A97434B073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\29P7ELGZ.QWV\KD187HE2.EJ3\ScreenConnect.ClientService.exe
Size 93KB
SHA256 16d5596c5d53497ea722ae9713984de93478b53fdc8b34587b12656414967849
MD5 e80520bb4a0447cf61dbfe9d21e342d9
SHA1 f47f6fc913c34f353e82d0d7eb9e7e34314421e9
SHA512 6189d9b47b0ff6f26dc763b5252ec7df9a6e43fe492b6be1ab2651ef7d6abad5866315866e516cf41f73928edda35df3457846022911b1138bd3057120598bb9
SSDEEP 1536:xg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgMU0HMb7t:ChbNDxZGXfdHrX7rAc6myJkgMU0HqR
TLSH
T1B9935B13B5C28872D473093158E0DAB09A7FF9615E61DEAB3788022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\29P7ELGZ.QWV\KD187HE2.EJ3\ScreenConnect.Core.dll
Size 575KB
SHA256 4d16bdfd1b74808161f59a15f70746f8279208899644b0662bebe320dc8fbaaf
MD5 a2214d8d885dd1586f7d4ec634ad5e73
SHA1 f4a88604467db313d975fa1430445e22dbb88ec0
SHA512 f75c372a4b7ef282a6c10da5f9c4281073d571ba4c1e73ae62795c91a658f767830aa137b305e79735327863d5316827a7d94ad9572587f0527153e241e6da50
SSDEEP 6144:LqF259uAINF9SAV60SnNZp0ArA6BWiAetP5ggjq/bZTS/+hjTax4kxdhnSewrj0D:Y2nZIjSd0Qx04A6gKBggO/bZT50M+
TLSH
T1EDC47D117398B777C97E06B9E07099150379E82672BBF7C7A6A4E4FA2C833844D412B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\29P7ELGZ.QWV\KD187HE2.EJ3\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 0f83bbabc956b819bc3aa4649f91f6d4f085fc5d1b4d89eb178c95428fea625f
MD5 5b8eafaf5759cdc49f3f04d23c54d4b3
SHA1 d0120dc8c30ba09c1883632eac36fed46e1690f1
SHA512 ab5d7529771f9f9985beefd5aeeabc39103fca29fd5a074b2695c2f34fb6684e459fc31855bb27d1acdf306366d40d4c55a636342131c0e8ab5c8d657190cc62
TLSH
T1C521790181C8FA261F3302D2BEE7E42197AE5B33188D194B70A96C9FCB2DAD24747173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\29P7ELGZ.QWV\KD187HE2.EJ3\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 a0702217c7542d53a938003b89ade00e324814104c1a8fdf4f09338c5b624505
MD5 d5c52d3473ee10ffa3b0ceab80d5b651
SHA1 be51ffd29ba6888edd0144aa85a4f7687b246441
SHA512 770bf19dc679dc84641abf563b2909a797b72fca38a2dfdbbd15cc561e6ea4a913c3229be34508312b42b4ff1d91d0ce57ceb3172482cb0a43c409c92ff45f4c
SSDEEP 24576:9CsgGFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUw:gsgGJkGYYpT0+TFiH7efPh
TLSH
T1E485BE41E2C365F5D46B047888BF572AB6743C080365CAFB93D4AE366D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\29P7ELGZ.QWV\KD187HE2.EJ3\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 f542400bf3815f405643e11131a9a9d04ccabc5cdd1a93b76aa6f2cbcdbfce43
MD5 2b32cec5d15501411c62d448637c8c95
SHA1 03e78c80e557d5dd4f3a93ec556d5017afee0d21
SHA512 a9eb8ebd805960ce515084a553d1224cc6d0707fd9e2962d9843696f10f8d5ba3125286b301c7887f8d3c0735e8bac14181c9883f4fc6d7a16f64c4c1392eafb
TLSH
T13341D11181C8FA250F3302C2BEEBE431979E5723158E194B7499AD9BCF29AD74747077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\29P7ELGZ.QWV\KD187HE2.EJ3\ScreenConnect.WindowsBackstageShell.exe
Size 71KB
SHA256 4aea3c1985c64acd63203bbbcc82df991e87e2f3fd9bfb27d66a8e1b1f4bb103
MD5 c2569c8c736a8451942fbc89fa63f94b
SHA1 ad73e13e40f19289538702b551501edbfe6e0866
SHA512 c2b95489f436333c4debb3501bedfbc7de29eb02ec23f7d745b025b89dd2be599e539cad46ce1f520cf4af0f9c613a08d8e45b4163d9e2e9f6c2f4d777d93f37
SSDEEP 768:dzlYsf/wCdOBti13kDeuRsUQHjSz2dvmDSmBsuMQX5E+TCMXESslxq7wCYiDLk5J:dRYKtd739PD1dvmDqfQX5E+TC7buwC7a
TLSH
T17B637D5063ECD535E9FE2E34B0E1F6200AB3B963C8E1D7D52DA821DA2E127C15F64396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\29P7ELGZ.QWV\KD187HE2.EJ3\ScreenConnect.WindowsClient.exe
Size 668KB
SHA256 9d0c96d6a286c64a97c60e83a85f6140db26a995d8a2fcd81d56c030bcf855ba
MD5 6ef28260eda97de6c44463100cb728c1
SHA1 8fb193ce4601ba427731c3390e1a3bd650330b09
SHA512 fbb227085b1f6b7f5305cc5d38a0337bc75d19afec186cb50b36c16f4f959c3703b2d82ebd2fea6e82f9955adb7b02d529929937cc151da4ccdbf7dbe042fea4
SSDEEP 12288:dQGxjhXiSOV/HRD/fiIDXWTOtBM4HhPee1KXWz/HgGBZ0TgB:dqJbiIDSpaeiZT0TgB
TLSH
T10EE47D2177BC9A7BC9AF0B3A7073195417B8E5117185EB4FF650A6EA0EC27808E053DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\29P7ELGZ.QWV\KD187HE2.EJ3\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\29P7ELGZ.QWV\KD187HE2.EJ3\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 d41ecc668fe228c67a42cfdcbf336d6fdb53cd6a1f6103c56ed11cd1b263784a
MD5 28dee0039f7c1211bc2e8350daf014f5
SHA1 3b920a2e6c539dc0af27ffb1bf7c2f6fb17904ca
SHA512 61a2fef48a17f5ce6060b204b61a63fbfeb9677d57093077557bd9052d221e3bc00087cd1a6533c0c898927d4eb047f6366c63a90fc15f9b0d69f72f880f0a1b
TLSH
T16651C21181C4FA250F3302C2BEEBE4719B9E5B23158E194B7099A99FCF29A97474B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\29P7ELGZ.QWV\KD187HE2.EJ3\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 422e3eab7aeffb1ea3a5e6996df1d75d907100d128eb040b0c6b65b2d5d790f3
MD5 60f005d498bb56b914f3603c6e8012e1
SHA1 fee5d18d5343bcb447e324abd994311045699543
SHA512 bb6974890409a00b7faf2eb557c6161352d60cb60e09849e2402a2c3882d521450e4f443b1a00e0b0c5da3d1fe30a7ca38c483c27aba4458b4b5043d1266af2c
SSDEEP 96:xWLwOhoyTbHe2wvy2kLKkTkXMkJkGqkHMyk34kOpQkOphykbAkOpD:oRjeMv4XZiwHM739UFUh7bVUD
TLSH
T105F1AC9684C0BD21573281C0FEE3D914BD157F63026E148EBD8D19AF9FB25899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\29P7ELGZ.QWV\KD187HE2.EJ3\ScreenConnect.WindowsFileManager.exe
Size 91KB
SHA256 66617969158867a0c983e7573c943ea61d20387b79b81674202a6669a314995f
MD5 96e3ca0cfe5765555f909144f9c36060
SHA1 5b68f21953a49a01459ae935f9e881763a37dc5f
SHA512 8094836cc7bcf5914ba399be92f59a3d503869338436522aaa9f938a5cd9764bfc6915d3ed5e49251d1a1485d20932233798ad8f39ab6768a28c32a1f4d6d0cf
SSDEEP 1536:EUMOISlP4GyjI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVdiRA7bu:XIsaukLC2A/u
TLSH
T14993E552356A6235DEC5C133A492E9B19C337F6207FDC5BD28A1BA3639E03903E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9PONG46M.4QW.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZCKZ7NV0.W2P\9PONG46M.4QW.application
Size 162KB
SHA256 ab326b91def4669053615ed00d84b50928277069e02de0b8bc489ce58be5d5fc
MD5 bf7a919e772e77f5f165c8b7ace9a574
SHA1 6839ffbf5019646f8de49b9d949f78225f128f0d
SHA512 20221f26d2e3dcd332d372de233358bca8975dfaafad42512c0c433d16a5f2a38a3bec943eada6a642b2e1de5bc5e93aa527129890fcc000ee854f79df08c04c
SSDEEP 1536:5Ycj21eUZZJXvIMxVNrVh57J29ym3KQ/IuK2OR3zGIzLG3eC5iF:5uVNX5M9ym3XjyzTHGub
TLSH
T146F3523A8E30F5C0877DB021D1642D6B3DC11B97DB730FACDA06186A0E69796EF1A65C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/420-50-0x0000025CDD540000-0x0000025CDD55A000-memory.dmp

Download

memory/420-21-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/420-33-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/420-34-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/420-44-0x0000025CE1D20000-0x0000025CE1ED0000-memory.dmp

Download

memory/420-25-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/420-301-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/420-22-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/420-56-0x0000025CE1B20000-0x0000025CE1BCA000-memory.dmp

Download

memory/420-277-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/420-62-0x0000025CE1A60000-0x0000025CE1AF4000-memory.dmp

Download

memory/420-20-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/420-68-0x0000025CE19C0000-0x0000025CE1A2C000-memory.dmp

Download

memory/420-32-0x0000025CDD6D0000-0x0000025CDD720000-memory.dmp

Download

memory/420-18-0x00007FFFAD5DF000-0x00007FFFAD5E0000-memory.dmp

Download

memory/420-16-0x0000025CDD250000-0x0000025CDD3D8000-memory.dmp

Download

memory/420-278-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/420-15-0x0000025CC2C10000-0x0000025CC2C18000-memory.dmp

Download

memory/4596-288-0x0000000000890000-0x000000000093A000-memory.dmp

Download

memory/4596-300-0x0000000002AE0000-0x0000000002AFA000-memory.dmp

Download

memory/5032-13-0x0000000074AF0000-0x00000000752AC000-memory.dmp

Download

memory/5032-11-0x0000000074B02000-0x0000000074B03000-memory.dmp

Download

memory/5032-10-0x00000000054F0000-0x00000000056A0000-memory.dmp

Download

memory/5032-9-0x0000000074AF0000-0x00000000752AC000-memory.dmp

Download

memory/5032-8-0x0000000074AF0000-0x00000000752AC000-memory.dmp

Download

memory/5032-7-0x00000000051F0000-0x0000000005282000-memory.dmp

Download

memory/5032-6-0x0000000005700000-0x0000000005CBA000-memory.dmp

Download

memory/5032-4-0x0000000005030000-0x0000000005058000-memory.dmp

Download

memory/5032-5-0x0000000074AF0000-0x00000000752AC000-memory.dmp

Download

memory/5032-3-0x00000000050B0000-0x0000000005144000-memory.dmp

Download

memory/5032-2-0x0000000002A20000-0x0000000002A2C000-memory.dmp

Download

memory/5032-1-0x00000000011B0000-0x00000000011B8000-memory.dmp

Download

memory/5032-12-0x0000000074AF0000-0x00000000752AC000-memory.dmp

Download

memory/5032-14-0x0000000074AF0000-0x00000000752AC000-memory.dmp

Download

memory/5032-17-0x0000000074AF0000-0x00000000752AC000-memory.dmp

Download

memory/5032-19-0x0000000074AF0000-0x00000000752AC000-memory.dmp

Download

memory/5032-0-0x0000000074B02000-0x0000000074B03000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads