37517577f90e89f1c1124328a907ad0c4e4813ceecb030ae5642719d7da64229

Analysis

max time kernel
149s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_467cf4255fe2f4cd9874e8d01b3682ef_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Size 2.5MB
Sample260718-em671afy2k
SHA256 37517577f90e89f1c1124328a907ad0c4e4813ceecb030ae5642719d7da64229
MD5 467cf4255fe2f4cd9874e8d01b3682ef
SHA1 51d87e72273c1ebdd6dccf049ea77d73e419912a
SHA512 48cc6e1ab53b7eddaea64aa9796deed49399e517e917f61e12636c7deb6b9809531897c8c2e48cb55ccb16725b813bcb24e0bf88061964100e3ec281e09d0f60
SSDEEP 24576:2YId9BbVER68MYBjf5QN9Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT0f:QC3QN9JkGYYpT0+TFiH7efP8Zl
TLSH
T16FC5BD01F3D695B6C4AF0538D47A925A6A70BC0403A6CBFB67C4B9762D337C08E357A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1968	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\NJ4YL04L.AL7\MGMWMDHL.JZ2\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_467cf4255fe2f4cd9874e8d01b3682ef_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 460061006c00730065000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_61fa8f5132ba7575	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d8 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\lock!06000000cc8a5a0eb0070000b00d0000000000000000000 = 30303030303762302c30316464313636616265373138346332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\implication!scre..tion_0000000000000000_001a.0004_61 = 68747470733a2f2f73686172652e7265647361696c746563686e6f6c6f676965732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\SizeOfStronglyNamedComponent = 1f82060000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_61fa8f5132ba7575\pin!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8\lock!16000000dc8a5a0eb0070000b00d0000000000000000000 = 30303030303762302c30316464313636616265373138346332	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a\SizeOfStronglyNamedComponent = 7427020000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3\SizeOfStronglyNamedComponent = 4b88010000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8\SizeOfStronglyNamedComponent = 7cea1a0000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\DigestValue = 76194a0a5bca0f6c369ba0007f5dcfbf44b2c261	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3\lock!0e000000cc8a5a0eb0070000b00d0000000000000000000 = 30303030303762302c30316464313636616265373138346332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_4b2eaa1de5b9e80d\LastRunVersion = 68747470733a2f2f73686172652e7265647361696c746563686e6f6c6f676965732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\implication!scre..tion_0000000000000000_001a.0004_61fa8f5 = 68747470733a2f2f73686172652e7265647361696c746563686e6f6c6f676965732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\lock!14000000dc8a5a0eb0070000b00d0000000000000000000 = 30303030303762302c30316464313636616265373138346332	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "K03DL870GA7XKNTJC314RTYT"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\lock!010000001d885a0e900600006c150000000000000000000 = 30303030303639302c30316464313636616237303836306638	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a\implication!scre..tion_0000000000000000_001a.0004_61 = 68747470733a2f2f73686172652e7265647361696c746563686e6f6c6f676965732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\SizeOfStronglyNamedComponent = f3ba0a0000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "E524AMTD3W41V628OACJMKP3"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 680074007400700073003a002f002f00730068006100720065002e007200650064007300610069006c0074006500630068006e006f006c006f0067006900650073002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006d0061006e00690066006500730074000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 54007200750065000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8\DigestValue = c4310e45e724f2c863de5156fcc78fad6768d6bc	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3\Files\ScreenConnect.ClientService.dll_e781b1c63 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188\lock!0e00000036895a0e900600006c150000000000000000000 = 30303030303639302c30316464313636616237303836306638	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a\lock!02000000cc8a5a0eb0070000b00d0000000000000000000 = 30303030303762302c30316464313636616265373138346332	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_0000000000000 = 68747470733a2f2f73686172652e7265647361696c746563686e6f6c6f676965732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\Files\ScreenConnect.WindowsFileManager.exe.conf = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\lock!04000000cc8a5a0eb0070000b00d0000000000000000000 = 30303030303762302c30316464313636616265373138346332	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\lock!1100000046895a0e900600006c1500000000000000000000786e = 30303030303639302c30316464313636616237303836306638	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 68747470733a2f2f73686172652e7265647361696c746563686e6f6c6f676965732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3\implication!scre..tion_0000000000000000_001a.0004_61 = 68747470733a2f2f73686172652e7265647361696c746563686e6f6c6f676965732e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\NJ4YL04L.AL7\MGMWMDHL.JZ2\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\T1DZ4M8R.AMY\3H8XTLXQ.Q7E\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3376	2026-07-17_467cf4255fe2f4cd9874e8d01b3682ef_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Token: SeDebugPrivilege	1680	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 1680	3376	2026-07-17_467cf4255fe2f4cd9874e8d01b3682ef_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe	90
PID 1680 wrote to memory of 1968	1680	dfsvc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-17_467cf4255fe2f4cd9874e8d01b3682ef_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_467cf4255fe2f4cd9874e8d01b3682ef_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Users\Admin\AppData\Local\Apps\2.0\T1DZ4M8R.AMY\3H8XTLXQ.Q7E\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\T1DZ4M8R.AMY\3H8XTLXQ.Q7E\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:1968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\T1DZ4M8R.AMY\3H8XTLXQ.Q7E\manifests\scre...exe_0000000000000000_001a.0004_none_5d4c1629ba92ca9d.cdf-ms
Size 14KB
SHA256 150c532406e8db7af0b55a91c5b7333a29a0d5eb7b3f95cf08bd77e3ba6acc72
MD5 d0baf321df7e01d06045c24af61dec1a
SHA1 756a90d4a5902b55babd1207f1ebbe9d9cbe7b29
SHA512 52a7c20db0afec03c4466a32e42586cde47f50c17632ef85978c15073d7b4698c663e38994cc01dd9b4673344aaf2c333c8bf3a5ff544df3120137ef8c3f28a4
SSDEEP 192:0WEwHnwCoZjxV2SCOYivNtTYG79tZRRXptEVq/of4LVLu8kaWZFD3prtH7uEexd8:0cQCoZNVvCO5XrK18qnH7uEex94
TLSH
T1EB629121FB49F033E5612E369CB7D6C86B6ABD6A2DA1204B7581337E4C7118ACF35385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\T1DZ4M8R.AMY\3H8XTLXQ.Q7E\manifests\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188.cdf-ms
Size 3KB
SHA256 fc9dca9b90cd177fb3d781e78cac4dc9266138b7e297524596054a052a36aa4a
MD5 3170db7bb307747f5922657ad45550dc
SHA1 8690b871144720ddd735498250007435bcea3d09
SHA512 be0eb576318d8eb9235aca740920e6c1b62e77207fc81392af591d4d9b28cf0c6d82a8953cd22477d20eb9c2916be1b641c38534386791432ebaf39682e9fdad
TLSH
T16C610D01B344DE17D96A0633ACE6D6EE27747E83DE41820B74C47F2F79361F62212295
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\T1DZ4M8R.AMY\3H8XTLXQ.Q7E\manifests\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8.cdf-ms
Size 5KB
SHA256 87e08de812d42a61839af9a95920e17c55dda30edc67cafbf6fbcd1273665d15
MD5 a93869f7060bec127b7f37f37538cf71
SHA1 780a5a9559eba605218697717db5b6f76980b26b
SHA512 1a86a4ea2ad469999ba9af303c5fb54de137f3b53f0f1a3435eb29c364237c0db7c66c417182b730ed7ea7b7a2866940e0deffb037f3c7e64518e98e934a04f6
SSDEEP 96:24qSl4+heV+Ww7O0IKOQlVXXezoZpviNwnv+s:nl4nJBKNB6w/
TLSH
T17EB15411B290DD1BD5B90633ACA6D3ED2B367E82DE43030B70C8BF1F7A326D65222195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\T1DZ4M8R.AMY\3H8XTLXQ.Q7E\manifests\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495.cdf-ms
Size 7KB
SHA256 df9c83ca5153a7578f8fadc66a36ba2ffbe5f9b70d77f62dfd76b8ea1adb9f8d
MD5 caff35d4d249cc43e01da0cc3623bdf7
SHA1 7e1b3468aeff969626a0fb83978726d892e13b92
SHA512 f5ac7224dce4ff4245ebb59929b9ec86313c119e58a585249a4f6e3691db38b64504dd8008e74de483d8a2919850ee7348a40be2fa4ee2e6fac2111c14a0a797
SSDEEP 96:zgOOOXxnCTUL43FeV+WwwOO86D2/g92oUSxjDu/1n4FVxThLgTD:zx5xnAV3aJxDD2otxjcnS8D
TLSH
T13FF1CC02B350D917D5B90A33AC9AD3ED3B793D92DE82560B70C0BF2FB6725E61322095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\T1DZ4M8R.AMY\3H8XTLXQ.Q7E\manifests\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c.cdf-ms
Size 2KB
SHA256 e50a5f12cfdba6e37c16419f10d5c69d206057dc6642aa6eaf8dd4677607cc23
MD5 80b9f8ed0ec5ba033a60bb40933af13f
SHA1 ad27a7044e0a0473b7d69f502acb83a48558652e
SHA512 dc65cd993b5f8f138307c8470638d513be0d1e8430d9e7a56dbd12462a4f9a578fdfed5f2d62e3cd9a58e33666a0d68db3c3574c80dbc7b557818a1d3fdee006
TLSH
T1A651D0017648EA77D57A0232AC95D3DD3275BE87FF42070BB1C47B7F2A712C14A22495
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\T1DZ4M8R.AMY\3H8XTLXQ.Q7E\manifests\scre..tion_0000000000000000_001a.0004_none_0ad1c431ba4ded9a.cdf-ms
Size 4KB
SHA256 30665ba3ede70f7a96b96c55731df7d73483507546edd584667dad8e44a67f95
MD5 861a8ae1b1cf6c77ef6782842c6aefe0
SHA1 52b24201c2e349a22cb4a10c4727a7f2b021fbbf
SHA512 18fbf9dd4c6ba771549696c67ad56a8fbd45c2ee6c2691cf82de31c2edd2d4ac9cd4208cf7ed8ba66bf29aeb1e6e1179c45d0be94754cbc5aa617eb23dc4bb12
SSDEEP 48:pLP/mrIPAqzIvoPIgrRu9o0m5RD7EqU7gFUTUEekspf4sQgbmZFms4Ch+UQRcY:pDOUvG6EW0m5R/vUm9ks1QPfmvVUQRN
TLSH
T100913F41B780E823D61447329CE3D2D032367DE64FD7971770987B2FAD363C59622666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\T1DZ4M8R.AMY\3H8XTLXQ.Q7E\manifests\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3.cdf-ms
Size 4KB
SHA256 6f21369ef5ea310643324f5572d29b7af542c2c67d277e0d96139c68878cb04b
MD5 faf927e672e6015e0f4397b3c8fe08cf
SHA1 dc9670e8cf05ea68d09624e531739faef387b6e0
SHA512 a9c0fcf2b031199d52299937c35e97808264a0fa58e6de481cb3825fb0f0790c297b74eb009ba8bb5cf8662c96c6aa61b7a5bb3beb5e646d43178d1fad28501b
SSDEEP 96:1QxDBUqeV+Ww8OO4w1Du2PAEZZL1vV7ZEC:CB+JP1n/PJ
TLSH
T1D5A145027280ED67E6A90633ECD6C2DD3A767D82DE43430B71C4BF2F76726D64226096
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4kw3vjl5.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\T1DZ4M8R.AMY\3H8XTLXQ.Q7E\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\4kw3vjl5.newcfg
Size 657B
SHA256 8e053c139605bd7a05806ccb258d2c67f3a60d76ac6a310a3064632651b59679
MD5 30e7b5d4d92cc6eebf889d153c6aed29
SHA1 a44067736e6b925ef0d7e8cfe19994dad1b07564
SHA512 5eacf58e1f51eeca033c849bd479e20d216f0278d56665c72522f6caf66886382fccf4c385ce1fe7a79b9ebbee2bf33d673dfc96c103559d88bcb14ead204ffd
TLSH
T159014C6570C0AE9702732E33D5218741EE725A9B016120A874AF327B5F305CF07E32DE
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\T1DZ4M8R.AMY\3H8XTLXQ.Q7E\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\app.config
Size 800B
SHA256 9c0ba5ee193a7777c9a0edd6451a0d587728faea48cd5d0e2c05c320e7656626
MD5 a6cd769c3f542436f202576aff03a61a
SHA1 b31a87f77012c2c079a0931ad39a23e4564be036
SHA512 bac051034248f41ab69a7f114d69697b55ba5cce480e98813a83f8a88959afda1609568d19bd3c6efbfc445eae61c0c3202534c620b8a6af6de74973db6a3a7e
TLSH
T1D101D61870C4BE6A16A31E33E6234540ACB09DA30216A4AC34EE3137DB716D513F33D6
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\T1DZ4M8R.AMY\3H8XTLXQ.Q7E\scre..tion_0000000000000000_001a.0004_0907228c84ac99cc\user.config
Size 520B
SHA256 53420a21b9e026a9839e79dd3f012a68071aec1b9eb43fc27bf7eeed74b629ec
MD5 3483dcf494babc0b08cb328e5fa324a9
SHA1 07be0907d7ceaa153c38eec90d0a9410deed4ccf
SHA512 cf9f3d3d222f68d645658a156ef70e86b15b1b1ce28f4ced210fa24a3d4fec59d67a34b73554c7574491d7124bb4a43dec2fe8cc47a49df4dfdba25d08632edf
TLSH
T1BBF0E9A131C06D4703735E23C5114741EE725B9B0555249874AF227A9F315CE07A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

RE2C3QCH.D2H.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\47JWO94H.5VO\RE2C3QCH.D2H.application
Size 133KB
SHA256 e5de35169db22742e436e23be00f77789125c1e26144b4dd89ab0a49bf4a14d4
MD5 814ebde777161fbd38d556de9da12708
SHA1 d3617288823ebd901d0f90f09d2064871e685a4e
SHA512 bf1c420ddc36800616bc4fe03a4102e069824d724c237b191dfca77eeef0c8c2edbed82ffa19fc3657db7161fc085b2b1255d1a8939d7d69bc9b6e8227d78271
SSDEEP 3072:T/a9YuuBn1nfdvg2XOcuNKEBy25ZKEc2KEc4X1:ra9YuuBn1nRWUQG74
TLSH
T16FD3F73ACE30F5C4477DB021D0692D673DC11B939B730BACD90A196B0E69796EF1A68C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NJ4YL04L.AL7\MGMWMDHL.JZ2\ScreenConnect.Client.dll
Size 412KB
SHA256 54aa1a930ee8577cf39e697e4b9a2cfd0aafe3a0766ebc5f265d1d5a0b7b8c63
MD5 513c63de95f2c2eca72b3af1ed87ffb3
SHA1 5fd40fb2cb18d62abeac2db4effdccd69acb42ed
SHA512 1c84959d914e4039669cc0aef8fd5abf1df44d650a0ed3cb2734f00524d7836e04474187906f68d9f19c250a702f2caa17323f75542090112dc6d692772559e5
SSDEEP 6144:zS59LDc+c31vpY2Y5sD8ETEavHy+vd7JPYIYyqQni65/PTe:2pcs2xDHTEavSW7OQniOe
TLSH
T10094CF8163E85D6EE9AF1F73F0A1A1344E72BC056182F2EE0D0475F51A7B7828B546E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NJ4YL04L.AL7\MGMWMDHL.JZ2\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 6f4eae4b257cf30340c226bb3ee5d8656c6de79b820714e6727f62eee2044292
MD5 7400597be5c012b58f1c50ecdebf2a1a
SHA1 0c835ed0c70c99900fdabc79321e41c8694b4dca
SHA512 5a7aaf04ab807d602107c068bdc555d1ca0bd15d80ba96f2786cd8f960eb1f718cfcdb24fee1589e8072ab5b5378c28db90863d440d9330e98517d24d3a1acb3
TLSH
T18C11590191C4FA362F3341D1BEE7F46067AE5B23198E194BB0696C9F8B29AD643470B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NJ4YL04L.AL7\MGMWMDHL.JZ2\ScreenConnect.ClientService.dll
Size 91KB
SHA256 f5a82014a8a000ba58fd40ec2d60724e11713fe94dd779b018d9f8e533db0dbb
MD5 c499af696f598c4726ff498b446116b9
SHA1 ab019c65abacee29d2737c71d6b44278d88df875
SHA512 771fba09c8b4415bce305e261d06cf7d069caae803da6eefc71dd2125a2fb2036af7f2cab477d87d36ab301ff8d9dbbeaad8ba63ad08f355337a51dc3a380638
SSDEEP 1536:tz0NAdGN6i9C4+Cm49qAOGWZa+QOV+eLj0GUazxDa91g0O97r:tz2pz9EyJ0QOVFjtUazxDa91gr9H
TLSH
T11F935D0293BCA92AC9EF1E34B461F1A006B1B903D4E6EBD86D9820DA2E553D15F543DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NJ4YL04L.AL7\MGMWMDHL.JZ2\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 6f4e37343704120b5977eac90f904fa3aa74f111761aa604d5745beca115f727
MD5 57ae8924de501aea2d37892b8d4de231
SHA1 bd6957bbe37e112b9d18e63e6eb2224ca2aecbb8
SHA512 fdee6c86ad2f53b82c8de9e181193a14e6486682f5c055724a6cc31e7832280f9024ff7b95f1eb99aeef02932a6fe212104edda90fb0c36de88bc05bcf4dd8a4
TLSH
T1E431F61591C4FA351F3302C1BDE7E4605B9E5722158E190BB059699FCF29A97434B073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NJ4YL04L.AL7\MGMWMDHL.JZ2\ScreenConnect.ClientService.exe
Size 93KB
SHA256 bbbe7e148f6788a573d24503c237d6d558ba3a751089197b4fa8de20c0da9d51
MD5 08cd4d76263747ad29397e50dc19e271
SHA1 cf2951da09b83f98efa2317e7a1976bd6d903f7d
SHA512 a774bb57821c07c1e39ec46aa453e45a05aebdd7b6ca2bbe77acc280f2f90ca7a07d8fb32195105bac74d0bf28d874e7910cf2b3a3fab3cdc7f74bfce55ac9da
SSDEEP 1536:Ug1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgcU0HMW7i:thbNDxZGXfdHrX7rAc6myJkgcU0HnW
TLSH
T1EF935B13B5C28872D573093158E0DAB09A3FF9615E21DEAB3798022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NJ4YL04L.AL7\MGMWMDHL.JZ2\ScreenConnect.Core.dll
Size 577KB
SHA256 34f71df56e930be845cfe724a7f93e74d771f6d1a34041a678a0c3d8d27c9e65
MD5 46d043b411b0aefc0c229eeea96e3579
SHA1 f9ba0527b7a78b04bc11cc48c58ae72dffcb0673
SHA512 6b4d9ee36ab4ee78a7554cd8a88084bc8f9fe8a698ffb481c91272004b5822338dc8de09e484ff6035e336a12c81bcbba7703b593fb48112749fed7e3f261004
SSDEEP 6144:jJv2rM+MrJSR1wrpiTw8iXlcY2BbVEBc8fXySJPluAPb2iS/ChwDTax4kxPhUTx8:J2QTWo4T3ccY2BbV8ZJPlpPb2iLMU
TLSH
T1C4C48D1A73A48377C9DF0B7AE07055660F71E80424FBD76B7698F4A62CA33848E446E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NJ4YL04L.AL7\MGMWMDHL.JZ2\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 655601939c46f0ec9cf99a4b37bd4622ac768a6eb4f0f558df4ecdec14ca0644
MD5 05ca8de63ce3a248e6cbfee8393ed0e1
SHA1 f789dac448e2e1cc4bda20bfffd99df6f0b4d045
SHA512 e8fe6d077535a5bda969f35bed7c1984e0f550eebf6ca5d9b01b8f0b0af09f14e32fa4e9977aee8d44c90dd0f175e5217f5721c2f57a7f85e7222d5326676f7f
TLSH
T15B21480181C8FA261F3302D2BDE7E42197AE5733188D194A7069689F8B19AD24747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NJ4YL04L.AL7\MGMWMDHL.JZ2\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 70ce0a15fc51546d251c31de1997eb8fba9f0fadc79c14ff746837cb5a2aedcb
MD5 f66a771f7a6b092d6dacc5c742533e0a
SHA1 c4310e45e724f2c863de5156fcc78fad6768d6bc
SHA512 7ff21c7994d99bce8f7062a5e6f489220c69ecb2af55707b74fea184332cc43bbef8158f89d7b8d1776d4b883d9d188c950cb31ae8dfc3cb9113447becbf2e46
SSDEEP 24576:LBjf5QN9Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPS:DQN9JkGYYpT0+TFiH7efPP
TLSH
T14B85BD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NJ4YL04L.AL7\MGMWMDHL.JZ2\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 6a0833e60c9e01dbe30a2036f7617953a2ed0f732f0ea0176c3f31463df6ab08
MD5 9e3b8f46a912c7d3efcea309dff71112
SHA1 ae0eb977f9bfbf00e5c46206c145fac1507200b8
SHA512 5898714462c0691bb41e17c165cc4f6e07d01e06cc63b82893490328bca7ec04ea7c6106b211db4bcd8076691365efaaffe020baf02f3f99bbeb5d00fd7b5376
TLSH
T10241F11281C8FA251F3302C2BEEBE431979E5723198E190B7099AD8BCF29AD74747037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NJ4YL04L.AL7\MGMWMDHL.JZ2\ScreenConnect.WindowsBackstageShell.exe
Size 71KB
SHA256 05b55a089251605867293f971f066e7424c618d104709b01d496bfcd784e3b05
MD5 1d683880e77b8d4ebf4b68d7a524f2da
SHA1 53bb6e056eb9a136871929182949b44acd9e2766
SHA512 3d2a5b3c73f83a38db51987a1a1ae805fc9bae24dc4eaf066d9ce8045da87399f0b989c977b4d62195cf34d39880a6e47565b95c67c4771a0b56fd0f21556568
SSDEEP 768:QzlYsf/wCdOBti13kDeuRsUQHjSzmdvmDSmBsuMQX5E+TCMXESslRq75KYiDLk5w:QRYKtd739PDldvmDqfQX5E+TC7bu5K7f
TLSH
T10F637D5023ECC525E9FF2E34B0E1F6600AB3B963C8E1D7D52DA821DA1E127D14F64396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NJ4YL04L.AL7\MGMWMDHL.JZ2\ScreenConnect.WindowsClient.exe
Size 676KB
SHA256 754e3bd3a763fd5d396a1f06149e6819aa7e3dd0d9a4f6dc2d7607fcfb0f258f
MD5 6b6846e44007df584c4fb773ba03f424
SHA1 76194a0a5bca0f6c369ba0007f5dcfbf44b2c261
SHA512 41677847adc26f0067d18a9e9f388bf8e5daa91ea175ff7de469463a0c135e3faf8b17e4aa5478ab58c427c2ae5e21fa054d87bb2e5ad5567f18a84e9855660a
SSDEEP 12288:bGafI0dcqD/bp96K0ZSDVkmwY7zvrPfaGOwg24oLJ:9g09eMRPvtChoLJ
TLSH
T14EE46D3137AC9A7BD5AF0B39F033391867B1E4057289E74FD948A4EA1D8B7848D0539B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NJ4YL04L.AL7\MGMWMDHL.JZ2\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NJ4YL04L.AL7\MGMWMDHL.JZ2\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 ef613a98b6ad15c74d85b533ea914337fb549c8f9b882c78f31616d27a664746
MD5 9ebf4d420218c403bd6eb773227b670a
SHA1 6e6b3f8dd8223cbbccb79b90a63649b06a378eb0
SHA512 dee07c4919b990b845b6ebd6cdb8f70363d0c733180ed53c954ca52b62518e0a43c938d5c4a20b05603f70224d48f964fbe1ea385f78b528be8909ddfa19ea1a
TLSH
T13751C61651C4FA351F3302C1BEEBE4709B9E5722158E190B7099A99FCF2DA97474B037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NJ4YL04L.AL7\MGMWMDHL.JZ2\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 951218d6ff46cd53e73e97e4a4801130a1a37c8b8d2efcd7d08892132f0c3d90
MD5 3ba1b81529915bb42df0c62331522a60
SHA1 a863ffd69c1ce79df47f4fad62cc9b111fd531e9
SHA512 3c0fd033cb367038285c4a90be9a30841d40df54cf0cad138af0601e1817d7f326489623b9cc59bd37c12eb725934b573d04dc54f8371023c31c21d3647f9610
SSDEEP 96:xWLwOhoyTpte2wvy8kO/kWkDkXn+Pk8qkQhMyk5w4kOpQkOphykYAkOpD:oR/eKOMHIX+86QhM75w9UFUh7YVUD
TLSH
T1DCF1BC9684C07D21573391C0FEE3D914BD157F6302AE148EBC8D19AF9FA25899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NJ4YL04L.AL7\MGMWMDHL.JZ2\ScreenConnect.WindowsFileManager.exe
Size 91KB
SHA256 9ea69d3699057fa5999eaedc7c9d4f9169be3481ba64c35afae6594a6fa7b960
MD5 a8e00048db6fcc17404a519c3ce77ea6
SHA1 c9850cc2944fc5f0343ba637ec875a4c65f5ae1e
SHA512 344f4363beacf7fed7f127b5c6b31ef884262eaec2eb5a7b727f6d8b4130815707f7f20d11521eb56913e5d5cd1f7e77fe27bd77efc85ccfb974a3f9dd5148d6
SSDEEP 1536:HUMOISlP4wyHI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVdi167M:8IsAukLCK6A
TLSH
T1AA93D652356A6231DEC5C033A492E9B19C337F6207FDC5BD28A1BA3639E03943E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1680-325-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1680-26-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1680-45-0x000001B530EA0000-0x000001B530F34000-memory.dmp

Download

memory/1680-324-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1680-51-0x000001B52CAA0000-0x000001B52CABA000-memory.dmp

Download

memory/1680-16-0x000001B512010000-0x000001B512018000-memory.dmp

Download

memory/1680-57-0x000001B530E70000-0x000001B530EDC000-memory.dmp

Download

memory/1680-18-0x000001B52C7A0000-0x000001B52C928000-memory.dmp

Download

memory/1680-63-0x000001B531160000-0x000001B531310000-memory.dmp

Download

memory/1680-35-0x000001B530C70000-0x000001B530CC0000-memory.dmp

Download

memory/1680-69-0x000001B530F60000-0x000001B53100E000-memory.dmp

Download

memory/1680-25-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1680-23-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1680-17-0x00007FFCD4EDF000-0x00007FFCD4EE0000-memory.dmp

Download

memory/1680-22-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1680-21-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1680-20-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1680-19-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1968-289-0x0000000000E40000-0x0000000000EEE000-memory.dmp

Download

memory/3376-14-0x00000000748B0000-0x000000007506C000-memory.dmp

Download

memory/3376-12-0x00000000748B0000-0x000000007506C000-memory.dmp

Download

memory/3376-11-0x00000000748C2000-0x00000000748C3000-memory.dmp

Download

memory/3376-10-0x0000000005840000-0x00000000059F0000-memory.dmp

Download

memory/3376-9-0x0000000005530000-0x00000000055C2000-memory.dmp

Download

memory/3376-8-0x0000000005C00000-0x00000000061BA000-memory.dmp

Download

memory/3376-6-0x00000000030C0000-0x00000000030E8000-memory.dmp

Download

memory/3376-7-0x00000000748B0000-0x000000007506C000-memory.dmp

Download

memory/3376-13-0x00000000748B0000-0x000000007506C000-memory.dmp

Download

memory/3376-5-0x00000000748B0000-0x000000007506C000-memory.dmp

Download

memory/3376-4-0x0000000003030000-0x00000000030C4000-memory.dmp

Download

memory/3376-15-0x00000000748B0000-0x000000007506C000-memory.dmp

Download

memory/3376-3-0x00000000748B0000-0x000000007506C000-memory.dmp

Download

memory/3376-2-0x0000000002E80000-0x0000000002E8C000-memory.dmp

Download

memory/3376-1-0x0000000002E60000-0x0000000002E68000-memory.dmp

Download

memory/3376-0-0x00000000748C2000-0x00000000748C3000-memory.dmp

Download

memory/3376-24-0x00000000748B0000-0x000000007506C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads