2e9e8b04cc40fee048c4c03d233d1b733644b5868d5c47fd8a1fa79dcb25e515

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_5df99046a1e633b6967747c412a2f5d4_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Size 3.7MB
Sample260717-xtrd8sfx6s
SHA256 2e9e8b04cc40fee048c4c03d233d1b733644b5868d5c47fd8a1fa79dcb25e515
MD5 5df99046a1e633b6967747c412a2f5d4
SHA1 b5dddd2b938d5d86be8b82eee977a4bdf4722718
SHA512 0f45ff8b32a69e67e4707ccc665f7ce133f18ed6b18c12d3d6c64c6d46a9426f0f4ef0972b9637015e1087e75ffafe00af9b42b42074ff4c68e88a1bb8d8d938
SSDEEP 49152:z2znMyu08YMih7EQtzO5kJkGYYZTk+T1iH7efPmZzk/ENw:ziu08YFZhUM6efPm+/J
TLSH
T19D06CF4AFBC6A677D47E067584652314B7B0F4854B22C7AB6AD0BB3D1C323D06E293C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
252	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\3WVOTA2O.QAV\0668Q96K.86V\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_5df99046a1e633b6967747c412a2f5d4_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9443\SizeOfStronglyNamedComponent = 10b3050000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_056f69108ca96257	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee99\DigestValue = 38455760b278e0e71c178f0baf8188ceaeaf4644	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0001_d91b6e911d0fdd54\identity = 68747470733a2f2f306670746563682e686f73746564726d6d2e636f6d3a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee99\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee99\Files\ScreenConnect.ClientService.dll_e781b1c636f = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_none_0b03d694d1d8b740	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0001_d91b6e911d0fdd54\PreparedForExecution = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3b\lock!0a00000049015a0efc000000ec00000000000000000000009 = 30303030303066632c30316464313631666363613932366338	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9443\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee99	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee99\implication!scre..tion_0000000000000000_001a.0001_056f = 68747470733a2f2f306670746563682e686f73746564726d6d2e636f6d3a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0001_none_37ead1580b9e8b2e\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3b\implication!scre..tion_0000000000000000_001a.0001_056f = 68747470733a2f2f306670746563682e686f73746564726d6d2e636f6d3a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "15DLTZ7OCM74R4938WGKK1TR"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9443\implication!scre..tion_0000000000000000_001a.0001_056f = 68747470733a2f2f306670746563682e686f73746564726d6d2e636f6d3a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9443\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_d91b6e911d0fdd54	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_d91b6e911d0fdd54\scre..core_420d02d3849b7992_001a.0001_none_37ead1580b9 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede132\DigestValue = 87faa7b88b6256a0ad055ad7cfa8b23b20236619	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede132\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee99\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_d91b6e911d0fdd54\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947ec9e5e	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_d91b6e911d0fdd54\scre..core_420d02d3849b7992_001a.0001_none_37ead1580b9	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947ec9e5e	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9443	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee99\lock!1c00000049015a0efc000000ec00000000000000000000008 = 30303030303066632c30316464313631666363613932366338	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0001_d91b6e911d0fdd54	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947ec9e5e\DigestValue = 29ecfef397b5f7be80680a7e0e1b8e3e30acdacb	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3b	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3b\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_none_0b03d694d1d8b740\SizeOfStronglyNamedComponent = 9a92010000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0001_none_37ead1580b9e8b2e	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947ec9e5e\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee99\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9443\Files\ScreenConnect.WindowsClient.exe.config_f7f1 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9443\Files\ScreenConnect.WindowsBackstageShell.exe.con = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9443\Files\ScreenConnect.WindowsFileManager.exe_0e21f8 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede132\Files\ScreenConnect.Client.dll_fc1d7bd48553fcab = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0001_d91b6e911d0fdd54\lock!1100000001005a0e48110000a8160000000000000000000047488e = 30303030313134382c30316464313631666334343362373466	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0001_none_0b03d694d1d8b740\lock!0200000049015a0efc000000ec00000000000000000000009 = 30303030303066632c30316464313631666363613932366338	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_cfede5efaadb3515	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9443\lock!010000008afe590e48110000a816000000000000000000006 = 30303030313134382c30316464313631666334343362373466	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0001_none_0b03d694d1d8b740\implication!scre..tion_0000000000000000_001a.0001_056f = 68747470733a2f2f306670746563682e686f73746564726d6d2e636f6d3a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9443\Files\ScreenConnect.WindowsFileManager.exe.config = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3b\Transform = 01	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\3WVOTA2O.QAV\0668Q96K.86V\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\8GGDDLTX.DR3\X3E960XA.DKX\scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3b\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3448	2026-07-17_5df99046a1e633b6967747c412a2f5d4_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Token: SeDebugPrivilege	4424	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 4424	3448	2026-07-17_5df99046a1e633b6967747c412a2f5d4_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe	88
PID 4424 wrote to memory of 252	4424	dfsvc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_5df99046a1e633b6967747c412a2f5d4_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_5df99046a1e633b6967747c412a2f5d4_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Users\Admin\AppData\Local\Apps\2.0\8GGDDLTX.DR3\X3E960XA.DKX\scre..tion_0000000000000000_001a.0001_d91b6e911d0fdd54\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\8GGDDLTX.DR3\X3E960XA.DKX\scre..tion_0000000000000000_001a.0001_d91b6e911d0fdd54\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9443.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\8GGDDLTX.DR3\X3E960XA.DKX\manifests\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9443.cdf-ms
Size 14KB
SHA256 437d718934de6bef48ac523374e02e1d4f5355c69969c890176df794724d8e81
MD5 46294b212b7ae3371417bc151538d664
SHA1 483a5cfc14e3e282943045c30ec60f39577ace0a
SHA512 5959f52fdd84507de9a65fb5b3744066d45278817e2bfd69fe4f94a32bf62d892b5de10b16ef2dcb571b03543fa598a94b28ff2e7f3dc47ad54e32c94669320f
SSDEEP 192:n3lfwHfS/uAKGivo1CTZkUDjWsMMH5CDsPo50i7nvCixpaqz4:neUuhGioIT9DMg55w6A4
TLSH
T178629251FB18F133E6950B73AC7AD6D533217EA92CA4128BB080373D997019A8F363D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0001_none_37ead1580b9e8b2e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\8GGDDLTX.DR3\X3E960XA.DKX\manifests\scre..core_420d02d3849b7992_001a.0001_none_37ead1580b9e8b2e.cdf-ms
Size 3KB
SHA256 bf01334b64bb72a861d947866c951e2169b6a769ed492f8036987638fc77e7d7
MD5 b76560c02978d820d2fc9c4c4fb9ce11
SHA1 0a6c97d812a7d26cd5960d759fd9c65568f81f8b
SHA512 764bf25642bedef37862993a443702804287dc0c0895f4d4725a5ff76aa2e2195a04528a4801bcdcc06212170c0a672d95e502aaea5b40c0a8a3c5b3a1bc23c1
TLSH
T1FB613E027341DA17DA7A0772ACF2C6EE6FA87D97CE81410FB0C03B6F39325E546122A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947ec9e5e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\8GGDDLTX.DR3\X3E960XA.DKX\manifests\scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947ec9e5e.cdf-ms
Size 5KB
SHA256 be4619bc5c187dbac585e6237495bce7ae9e7e0f89f358ba809f3dde4ae585d1
MD5 4eb6a90fbd568081807f00fdadcf0ac6
SHA1 843e606a8a154514dc6fede865cd759f6aabdf86
SHA512 66805dfdd522ffa7dad19c308c46f519c8fa47d4b4aed7f130de2169955ab362bc789260fe7a7d9fdc97cd1c2ef0528c42075a8744905aeb55fb1f0780549724
SSDEEP 96:VvA+RxU9LHeV+Ww7WIcOrL3AXpzguZovl2giqP9O:NRxUNgJ+cE0lgegO
TLSH
T177B14311B290DE57E5B90633AC96D3ED3A367E82DE43430B30D8BF1F7A326D64222195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3b.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\8GGDDLTX.DR3\X3E960XA.DKX\manifests\scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3b.cdf-ms
Size 6KB
SHA256 3995fa029b4ad5a1553fc815a20ff89f7300d1608fc45e9b82f9ad56caaf764e
MD5 7e72aebefedc71d81035d36d87909708
SHA1 9e865b13c683a09c537a3ba12a4fa66464172c9a
SHA512 d1e4c4a0342a826ff5afed0b27958f9cfb36fe148f7f48d6a01d075535bda0239f858180facb33a638c9c09039932ba1518042c0fe4641aad336df26c71a6c83
SSDEEP 96:Sd1NaunTu5VeV+WwwE86QueBe676O9LyVswfiDtyp6qSw4Fd:4LaunTusJwQf/dwdfbsV
TLSH
T1B6E1BB11B340DE53D57C1633ACAAC3ED37797E96CE42470B70C0BB2F7A725AA1622195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede132.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\8GGDDLTX.DR3\X3E960XA.DKX\manifests\scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede132.cdf-ms
Size 2KB
SHA256 a5eb9cdf785121c7128adaa6c087344b1bf01a6c79537e4eb112daf2ebf9b0a3
MD5 5360505a8de6d6779a9741112ca10624
SHA1 4c25fe2136705f8e7dec00e9b1669c5e7c062100
SHA512 59cc0033858425243abf981b8501dcf0c84a9c3742dbcfa501da19e37335856ab8ef5188a4a851e7743df18e39a9b5d882adb216f807e7fbe41ab599379ad753
TLSH
T1795199057684EA67E56A0233ECD2D2DD33757E82EF07130BB1D0BB6F2A726C14612092
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0001_none_0b03d694d1d8b740.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\8GGDDLTX.DR3\X3E960XA.DKX\manifests\scre..tion_0000000000000000_001a.0001_none_0b03d694d1d8b740.cdf-ms
Size 4KB
SHA256 9e5719c2b9c0a9bb4c0a287f240ce438e2700d0373e66c4bd0725e81ea03de5b
MD5 fdb551bba560af66bdcfd8a0836b2726
SHA1 8e47b17a1def453a08a35dde84f1d89dff5dd40c
SHA512 f899ce6b32df648f0ef4161f585d4a41d1d6c44260bfe005620680c579ac64876b4ca0e316959f8449860f215d4fd3062cf1eb10811aaa1056c5d3f026ac82b6
SSDEEP 48:yP/mrIEZAjIvMEXgyRu9o0m5RD7gU7gFUTUEjkKXt4sQgbmZFms4Ch+UQRcT:gOUrGMYEW0m5R/gUm4kAQPfmvVUQR2
TLSH
T1AB914280B780E923E6145732ACE3D2D432357DA64FDA571B30987B2FAD363C59622266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee99.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\8GGDDLTX.DR3\X3E960XA.DKX\manifests\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee99.cdf-ms
Size 4KB
SHA256 a574ec6cbc61166d85536d53c4e8871ba0097f4c8102f995acb16d8ee90824a6
MD5 95fc01c7c8d04a1e9e0d6779982798b4
SHA1 557673e5cedc2f728c400bc7950488872de3a8ae
SHA512 dea28bdaf0c336ac0857da1cf2eb43e0c004e00e7320b730dea3b82fc8597c60e0ba72576b7c929c0feaf7be4be434949bd3622dd784f36c49bffde41183d797
SSDEEP 96:3zQYSOleV+Ww8E4cMagq4r+86wEjQKbDKuQiV:3yJ2M9165dV
TLSH
T10BA1CF017380E967E5A90633AC96C3DD3A71BD82DE43130B71D4BF2F7A726C653250A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3WVOTA2O.QAV\0668Q96K.86V\ScreenConnect.Client.dll
Size 633KB
SHA256 1a484431de9b806dcbe40472affa54ca47588eab29a4ba997980b79eaccc0eed
MD5 40f8bba54fb085e25bb31cdac0ba2e26
SHA1 87faa7b88b6256a0ad055ad7cfa8b23b20236619
SHA512 3e231f55fa145a6000474f4036766ebd01336f55bdcd98cec93671c530643926424d5480ea21330427541c596a459fb66dc9ecfe5515397c53caed10b2a0839b
SSDEEP 12288:ye8IOB7VTzIn/nuxbc4zHTEavSW7OQnin1fJIE:ybjB7knuumzEn8qnFJIE
TLSH
T199D4CF4EAB28BA1ADD6E0B33E1D13224EAF06C9A9957D31F0D64B77C0D76380768D1C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3WVOTA2O.QAV\0668Q96K.86V\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 59a93b012d20a6cd44019a922f71a7dd8bc4b74e989d2d13cb27656201ea8bfb
MD5 c24784cf3a8454ffb9c6c002f6d47dd9
SHA1 2b8c9def3a1830717bc732898e9724cada606d1d
SHA512 b59493947d4a364b0f857eb11d6864d835146f0f5702c4d04d2851e47a33ccf869d8d85c0ba1f91fa7b6e8e1219afa6eb63b1d9bb67f1c8228250016afc476ad
TLSH
T1EA11290191C4FA362F3342D1BEE7E461A76E5B23148E194BB069685F8B29AD687470B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3WVOTA2O.QAV\0668Q96K.86V\ScreenConnect.ClientService.dll
Size 187KB
SHA256 015a7d385d2c684672db22163da6266da8ffbe67280b96c26354da07d90b2181
MD5 10ff5aea35cc0d7e8ae9abc3ac6e524c
SHA1 38455760b278e0e71c178f0baf8188ceaeaf4644
SHA512 c04a6c67d33d08150e013c412487fcddaa1b243958322562e373fe15d79daecca5620f3415897ae0b4206036f68bca94bab7bb1dfcd285a3fdcc20f1a6f6d453
SSDEEP 3072:fo5R8L2tipvOxzwD3VyEU/oucQFV2vUH2sC7:fv2tJdoBUHa
TLSH
T14014AF49F75D9926C59E0E36E451B31042F1B453C9EAD38BAC9C62EE1E467C02B983CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3WVOTA2O.QAV\0668Q96K.86V\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 47c0ba8139e9488d3b2252585b54c5cc627722e38d51718122135f54ffd77455
MD5 f99a2f49bdf125a4b68e105c2e0e8011
SHA1 f3dca3348faa711e3a7a1131bf7751a7a259f404
SHA512 747d23ff8930e823e0106521d71cb560b87201728f9a102c0015735659f7a06d64e4a0edba05eff86efe7c223b8306d5db4da077098d0220982f4fb73d46e07c
TLSH
T16C31F60191C4FB351F3302C1BDE7E4609B9E5722158E290BB059695FCF2DA97834B073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3WVOTA2O.QAV\0668Q96K.86V\ScreenConnect.ClientService.exe
Size 93KB
SHA256 552c661487939e89c8dd64a1744d7bc19629ed20a8439d66d416b31a3fc35bfb
MD5 53a1ecc118f3779ce87f45a35e645397
SHA1 8ddf93fdb37800f63cf28e269d9eaf6093bfb0ae
SHA512 9a3d4a1b4f46679c1761510e22a3f5bf4ce30783047a6200567facbb60df6bc66c3c97316a71aefff665561724c1be5cb2e667448d78948398252b294a4b1078
SSDEEP 1536:ug1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgkT0HM37T1j:/hbNDxZGXfdHrX7rAc6myJkgkT0H+l
TLSH
T133935B13B5C28872D473093158E1DAB09A3FF9615E61DEAB3788022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3WVOTA2O.QAV\0668Q96K.86V\ScreenConnect.Core.dll
Size 1.3MB
SHA256 06a4b390c7a452610ca49895a4fa8336ec6fd143d25b0d6274f732f53e80cf65
MD5 e3e39a4145d386ce89827b8227c2ed21
SHA1 1cfd27a493904264060590e77126092915d043f4
SHA512 0b9c25eab8ebc837b24638a2e554923e33a7b41c45ce4dbc26d86b36ab431181e4ec236327e69c47d7821ba929e69fd6b0c8a30a91c0956e47102f50292d79b6
SSDEEP 24576:k7aY+sosxyPm0eQzSYirquhr9+GALHzUpI9q07tCQHNzuVjN:k2znMyu08YMih7EQtza
TLSH
T1BC559E8E7FD5E727CAAD167694A02304A7B0D0D25F23E75B29A0A7BD4C453E87D881CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3WVOTA2O.QAV\0668Q96K.86V\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 9fbd22d5224ed19cae58b921bffd29b9ccc0d42e4f5cb49ebbc6d60964b53b9c
MD5 99d60c0933fbfc8bb21fa795389737f5
SHA1 31caa201e773de0b9aea48986de34cb0e50a6098
SHA512 175e16c1e8501d6dce4763cb797735a520e4cc25466e303281be684d989d5334a600705f5b39c5edf0a74c094d28cbff60cc16586b4158593ce3cbd4529c2859
TLSH
T16E216A0181C8FB261F3302D2BDE7E42197AE5733148D194B7069685FCB1DAD24747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3WVOTA2O.QAV\0668Q96K.86V\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 e7d2516b567af5d172749cb67ed06b65b0f6a1b4da9401bdf0230d92037582e6
MD5 40a9ff09a215ed5f77c695d239d2a811
SHA1 29ecfef397b5f7be80680a7e0e1b8e3e30acdacb
SHA512 4dfc872aaff7d6c6658a1d4bd34f2e2b481a4d285c8bfef532937024579777f1f03b18713093396030755e5b09cca203b34e878dbdc20483967cbee315d53d12
SSDEEP 24576:Zg1mSVTkFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKPL:W5kJkGYYZTk+T1iH7efPmZp
TLSH
T1A295AD41E6C364F6D47B057888BE632AA6743C040355CBFB97D0AE396D337C0AA3A795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3WVOTA2O.QAV\0668Q96K.86V\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 7fb442dc7f3a39a71789f8827a4a10f6879ddad2357901f1b3f04438921e0501
MD5 a220886e12fb68a252bd200d8a52df8e
SHA1 7a0f66e3fc693a98780c5dc575bfa0a3b6fb9098
SHA512 847cfa71c81caf69669f6bbf6525dcd11cadd3fd2a825c8473529966f654b98ec10a65a55e0555e85d3d2b725504ab5e6ca28e97e6e60deaa7fb7cb33716e32d
TLSH
T1CC41F11181C8FA251F3302C2BEEBE431979E5723158E190B70A9AD8BCF29AD78747027
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3WVOTA2O.QAV\0668Q96K.86V\ScreenConnect.WindowsBackstageShell.exe
Size 132KB
SHA256 0738fdec3949138061fb7d4f2afbd35d3eedbeb96803d2a4aea268471e0aa230
MD5 0001b08f86f30b6c73b600d8d2072318
SHA1 108c4932132ce74cc577866b57636afc02c45a4b
SHA512 c2a35c898dd4d299dda7fda93ab4c6041e59e750a67f61ab6c0e1595368f5c42003c0b32880cb3538a26ecd742760423a75aa85ebc719bf1f34abf86b37d14c7
SSDEEP 1536:Md8w1LPnv5EFbovhvskqcqC+GZos9pA+gZilTY3vxpDqfiKmM7H+TCWGc3EJfqMQ:Md8Qx+LkqcqCJZ/HTYGfiKgd3ey/R
TLSH
T1C0D39D817B99D522C5EE0E3BA4E2F21046F1F093CAD3C74B6C94127D7E18BD16E992C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3WVOTA2O.QAV\0668Q96K.86V\ScreenConnect.WindowsClient.exe
Size 1.5MB
SHA256 6bb41965e03a8f8c9d446f069545aa3d88b90c0082564611e5d476fc908dacd8
MD5 01d9500c6332b2abd0eb9f1f6e75ec18
SHA1 41efe92c4c5e7e4e6624a6d090a47564f8e1a662
SHA512 732f778e7b3b86cc0ed49377c22136c803c94e1d13b18e1c068e3895758b50490db500a918e9d21ce1c87eec28dd19c1624d604b1478640379c80721c24ae023
SSDEEP 24576:2e/vLaXyCPMtMft9Zs1LmOZRcUx89AYYvrqd7fFeW5zca:2e/vOXyCodZH8TQCDPX
TLSH
T13B75AD297E85EE3BC95F0B7790652204B3F094918B3BDB472854B7BE2D853C46D48ACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3WVOTA2O.QAV\0668Q96K.86V\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3WVOTA2O.QAV\0668Q96K.86V\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 433f3d4000a80cbf4c44622e741d4c605cb1507c02c16c42b917c711b6aecdaf
MD5 95a63a1a452e5471143d88336568f915
SHA1 84a5de8055620ecc17707c08566bfba42352ae2e
SHA512 0bd34bbf086e9b3e52fc953c5914acaf669246792cf9631bd5862bfbd3e3fc1b6a88e01bae594dbb1d219769b329a2ce28d6b98078f72245de4c9289991d9f76
TLSH
T12A51D21191C4FB251F3302C2BEEBE4709B9E5B23158E190B7099A98FCF2DA97474B027
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3WVOTA2O.QAV\0668Q96K.86V\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 65289faaae4c47f9544d0e0c49b40f5ae4058e206036f97e6bf4ffbfb8442ec5
MD5 acd868201fab5b41dbf8f1ddb622aa47
SHA1 327a28a2f95a33877d49d084d7d753bff2812833
SHA512 5acaa177dd91a1b440be2cc8995854ff9e9bdd6e1f372eac09267f3043c70efdf098d8279a51c9d1dac6cfdd3d4e100d3d100507c16da9eb481bd1eb80195a74
SSDEEP 96:xWLwOhoyTzde2wvyHkHqkyAkdkT6GZYkdqkTRkz4kOpQkOp0ykCAkOpD:oRpeZHjyV+TLZd1T6z9UFU07CVUD
TLSH
T1B9F1BE9688C07D21573381C0FEE39914FD15BF23026E148EBC5D19AF9FA25899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3WVOTA2O.QAV\0668Q96K.86V\ScreenConnect.WindowsFileManager.exe
Size 116KB
SHA256 20babd5227e07ba62518698c334a787ba5459554d56dc56acfd4d0c50b7f7f35
MD5 dba42593e7fac1d884868782584df6b9
SHA1 5234d700fdbe34e649daea3211500bc5fa9c3efc
SHA512 9ca3041a6db172bab1312e00428504db894f8ca11628f8fbd38173121708ae642096cc512caad765b050c8b2eb0e1b84541234c828a0b99a9ee298e674a45c81
SSDEEP 1536:3jDEyOsGO1QDHFHSolRU8WhUcXoO87jI5BLP+VVVVVVVVVVVVVVVVVVVVVVVVVS1:3jY0GO1Io0zcXyjuBLNLtf
TLSH
T1F8C3294135266231DE95C5339452EAB059337F6607FEC6BE3CA1BA3A29F03903E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADLNJY9G.7MJ.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\790AR9Z1.1P5\ADLNJY9G.7MJ.application
Size 96KB
SHA256 8a7a32dad28fb46ea529af535ddb1f3f666bb03eec24e82f20bd75778cf768d5
MD5 33225ca029d4cd739964d8eb59b78b73
SHA1 4f806dc82f4379c01562f42353b812a7aaa37e0b
SHA512 5c5cdc50160a4bcfe8d249de59a9ad8cfb3441e3ebb5320f0929fa98a7cf0bf34f4b8764fa4f6df0ddaddad856f94181643360a44f915d51c5afea3539f55709
SSDEEP 1536:w/iBHhe2WCRSmQfn4/5EHSZ5GE/uLTvooycu5KQ/IuKE:w/YHhlWCRbW22XOcu5X1
TLSH
T1C4A3523ACE30F4C0477DB021D1A52D673D811B93DB731BACE90A186B0E69796EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-289-0x0000000000480000-0x000000000060A000-memory.dmp

Download

memory/252-295-0x000000001B510000-0x000000001B542000-memory.dmp

Download

memory/3448-10-0x00000000058B0000-0x0000000005942000-memory.dmp

Download

memory/3448-19-0x0000000074580000-0x0000000074D3C000-memory.dmp

Download

memory/3448-0-0x0000000074592000-0x0000000074593000-memory.dmp

Download

memory/3448-12-0x0000000074592000-0x0000000074593000-memory.dmp

Download

memory/3448-13-0x0000000074580000-0x0000000074D3C000-memory.dmp

Download

memory/3448-11-0x0000000008F70000-0x0000000009154000-memory.dmp

Download

memory/3448-9-0x0000000005C50000-0x000000000620A000-memory.dmp

Download

memory/3448-8-0x0000000074580000-0x0000000074D3C000-memory.dmp

Download

memory/3448-6-0x0000000005390000-0x0000000005408000-memory.dmp

Download

memory/3448-7-0x0000000074580000-0x0000000074D3C000-memory.dmp

Download

memory/3448-4-0x0000000074580000-0x0000000074D3C000-memory.dmp

Download

memory/3448-5-0x0000000004FC0000-0x0000000005110000-memory.dmp

Download

memory/3448-3-0x0000000074580000-0x0000000074D3C000-memory.dmp

Download

memory/3448-2-0x0000000000FE0000-0x0000000000FF0000-memory.dmp

Download

memory/3448-1-0x0000000000FC0000-0x0000000000FC8000-memory.dmp

Download

memory/4424-14-0x000001D228F80000-0x000001D228F88000-memory.dmp

Download

memory/4424-71-0x000001D247F50000-0x000001D247F82000-memory.dmp

Download

memory/4424-65-0x000001D2485C0000-0x000001D2487A4000-memory.dmp

Download

memory/4424-59-0x000001D248290000-0x000001D248332000-memory.dmp

Download

memory/4424-53-0x000001D248480000-0x000001D2485D0000-memory.dmp

Download

memory/4424-47-0x000001D248500000-0x000001D24868A000-memory.dmp

Download

memory/4424-37-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp

Download

memory/4424-36-0x000001D243C60000-0x000001D243CB0000-memory.dmp

Download

memory/4424-33-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp

Download

memory/4424-26-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp

Download

memory/4424-25-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp

Download

memory/4424-24-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp

Download

memory/4424-23-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp

Download

memory/4424-22-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp

Download

memory/4424-21-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp

Download

memory/4424-20-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp

Download

memory/4424-18-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp

Download

memory/4424-17-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp

Download

memory/4424-16-0x000001D2436F0000-0x000001D243878000-memory.dmp

Download

memory/4424-15-0x00007FFF9ED3F000-0x00007FFF9ED40000-memory.dmp

Download

memory/4424-296-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp

Download

memory/4424-297-0x00007FFF9EBB0000-0x00007FFF9F554000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads