d56bbfe8131e156d530c382275937cc4af2b2b672fd8b3adf9860fd85f933ba7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 07:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_666755a842177cf0d7ebaba3aff0221c_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Size 2.5MB
Sample260718-jmcqlsf161
SHA256 d56bbfe8131e156d530c382275937cc4af2b2b672fd8b3adf9860fd85f933ba7
MD5 666755a842177cf0d7ebaba3aff0221c
SHA1 6a1c1cc962fbe5648888b864165af561e57996dd
SHA512 cfc336d85bee09e78ed18135b64d92038854537149f1b1573160d09de6d5ee148f3bdf9494d32095eab1a0e7236ea4325166eded687a45a41d3364a3e13d2f96
SSDEEP 24576:ux9zm+OBbV5Z56jMK9jf5UNXFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfT:McZEUNXJkGYYpT0+TFiH7efP7HS
TLSH
T19EC5BE01F3D695B6C4AF0578D47A921A6770BC040366CBFB67C4A9B62D33BC09E357A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 7 IoCs

flow	pid	Process
27	4824	dfsvc.exe
27	4824	dfsvc.exe
27	4824	dfsvc.exe
27	4824	dfsvc.exe
27	4824	dfsvc.exe
27	4824	dfsvc.exe
27	4824	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
2900	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\VE60D1NL.NH8\9G7COYWA.Q93\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_666755a842177cf0d7ebaba3aff0221c_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0004_160d1601be44e8d5\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\lock!18000000a9c3580e540b0000f00d0000000000000000000 = 30303030306235342c30316464313638396165396461363435	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0004_160d1601be44e8d5\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\Files\ScreenConnect.WindowsClient.exe_6492277df = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\lock!06000000a9c3580e540b0000f00d0000000000000000000 = 30303030306235342c30316464313638396165396461363435	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0004_160d1601be44e8d5\lock!1d000000b8c3580e540b0000f00d00000000000000000000afae = 30303030306235342c30316464313638396165396461363435	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_27fa83f1ad328157_b8eec52c7628edb7\LastRunVersion = 68747470733a2f2f7472616e737765737465726e2e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0004_160d1601be44e8d5	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0004_160d1601be44e8d5\scre...exe_27fa83f1ad328157_001a.0004_none_afa54f5a7 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3\lock!1c000000a9c3580e540b0000f00d0000000000000000000 = 30303030306235342c30316464313638396165396461363435	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0004_none_7eb8c5e56d0a11db\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0004_none_afa54f5a71f58454\Files\ScreenConnect.WindowsClient.exe.config_f7 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_27fa83f1ad328157_001a.0004_160d1601be44e8d5	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad328 = 30000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad328 = 680074007400700073003a002f002f007400720061006e0073007700650073007400650072006e002e00730063007200650065006e0063006f006e006e006500630074002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006d0061006e00690066006500730074000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad328 = 460061006c00730065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188\implication!scre..tion_27fa83f1ad328157_001a.0004_ff = 68747470733a2f2f7472616e737765737465726e2e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0004_160d1601be44e8d5\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d8	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\lock!0800000061c2580ed812000034130000000000000000000 = 30303030313264382c30316464313638393964663262333733	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_27fa83f1ad328157_c348fb2751c57185	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0004_160d1601be44e8d5\implication!scre..tion_27fa83f1ad328157_001a.0004_ffb8567 = 68747470733a2f2f7472616e737765737465726e2e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0004_160d1601be44e8d5\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d8 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "1E0OAOKW1CBECVGWBMQ0ZRJC"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad328 = 54007200750065000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "Y2P0TP6TBAHNNTDG248C8NL3"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3\implication!scre..tion_27fa83f1ad328157_001a.0004_ff = 68747470733a2f2f7472616e737765737465726e2e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0004_none_afa54f5a71f58454\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0004_none_afa54f5a71f58454\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\SizeOfStronglyNamedComponent = 1f82060000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_27fa83f1ad328157_001a.0004_160d1601be44e8d5\PreparedForExecution = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad328 = 680074007400700073003a002f002f007400720061006e0073007700650073007400650072006e002e00730063007200650065006e0063006f006e006e006500630074002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e003f0065003d0053007500700070006f0072007400260079003d0047007500650073007400260068003d0069006e007300740061006e00630065002d006a007a006a007900610076002d00720065006c00610079002e00730063007200650065006e0063006f006e006e006500630074002e0063006f006d00260070003d00340034003300260073003d00610064003800610033006400330033002d0032006500380039002d0034003100330065002d0039006300320065002d0064006500660035003800340036003100610061006100360026006b003d0042006700490041004100410043006b00410041004200530055003000450078004100410067004100410041004500410041005100410052006b00620036007a0075002500320062007300450070006d0046007a006500630068006f0073004c00330039006100250032006200750034005600430052004800490053006700550063005000370071006600630037004c006d0049004d0076007000680063006b0076006d004100650048006a00250032006200740059002500320066004600370078006c003400690047004e0031005100730030004100610054006c006c0063003200580076004f004a004f0078004700540075006800340064004100760065006d00760077007900550036004f004f00250032006600650030006800650034007a00560059007200550061006a00670057004e0038006e00570037005300300038006d0062006f0079005400540059004a004d0034004d006e004f00590055002500320062002500320066003900550044004a007900700051004f0032004f0057002500320062004400250032006200580045002500320062003500490049004d006d005300490041003200520051004b00410025003200620070004c006e0032005000570031004300590035004c00770044006d006d0070006200440065003000540062005200620063005400660073004100420061005800780051006a0064007800590069007200700077004b005a006c006c0061006a0067005600540069002500320066004600520046005100740032007600680051007a005000750045005100640048003400570025003200620076005500580057007000780068003600390043004e0078004d00370064004700700066007500660058003100460041006d004c006300780056007200660063004d0039004e0073004200640078007000690038006f0063005400650069006b006b00720067006e00740076004a0074002500320062004b00660069006b005600620055007700650038006c0072006700250032006200340030006c00550054004a0058005a0073004300790061004f00550061004c0073004d007a0025003200660057006a005a0078002500320062007300260072003d00260069003d0055006e007400690074006c0065006400250032003000530065007300730069006f006e000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0004_none_afa54f5a71f58454\Files\ScreenConnect.WindowsBackstageShell.exe_8 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0004_none_afa54f5a71f58454\Files\ScreenConnect.WindowsFileManager.exe.conf = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\DigestValue = e5e64edf1bfe4fd9bcc596ccc3250a0758232da1	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\lock!0a000000a9c3580e540b0000f00d0000000000000000000 = 30303030306235342c30316464313638396165396461363435	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_27fa83f1ad328157_001a.0004_none_afa54f5a71f58454\implication!scre..tion_27fa83f1ad328157_001a.0004_ff = 68747470733a2f2f7472616e737765737465726e2e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e342e332e393636322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0004_none_afa54f5a71f58454\Files\ScreenConnect.WindowsFileManager.exe_0e21 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_27fa83f1ad328157_001a.0004_none_afa54f5a71f58454\lock!04000000a9c3580e540b0000f00d0000000000000000000 = 30303030306235342c30316464313638396165396461363435	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0004_none_7eb8c5e56d0a11db	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0004_none_afa54f5a71f58454\Files\ScreenConnect.ClientService.exe_e781b1ee3 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0004_160d1601be44e8d5\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70 = 01	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\VE60D1NL.NH8\9G7COYWA.Q93\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\1E0OAOKW.1CB\ECVGWBMQ.0ZR\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1668	2026-07-18_666755a842177cf0d7ebaba3aff0221c_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Token: SeDebugPrivilege	4824	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 4824	1668	2026-07-18_666755a842177cf0d7ebaba3aff0221c_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe	85
PID 4824 wrote to memory of 2900	4824	dfsvc.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-18_666755a842177cf0d7ebaba3aff0221c_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_666755a842177cf0d7ebaba3aff0221c_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Users\Admin\AppData\Local\Apps\2.0\1E0OAOKW.1CB\ECVGWBMQ.0ZR\scre..tion_27fa83f1ad328157_001a.0004_160d1601be44e8d5\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\1E0OAOKW.1CB\ECVGWBMQ.0ZR\scre..tion_27fa83f1ad328157_001a.0004_160d1601be44e8d5\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_27fa83f1ad328157_001a.0004_none_afa54f5a71f58454.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1E0OAOKW.1CB\ECVGWBMQ.0ZR\manifests\scre...exe_27fa83f1ad328157_001a.0004_none_afa54f5a71f58454.cdf-ms
Size 32KB
SHA256 541985448ce86849c74422faa77a2862784af79bfaeda4411f93787e677f5baf
MD5 3b93ca9c56d355f8ac39a5f597ee6a6e
SHA1 5febc118373c06e0c2f0a595683c5cf8450fce5d
SHA512 d14ea33ffdd1edec1364015e471ade79aae5dbb94721507106532b2d62dc4594ae918f2ca12707d1f8453062205e1930f4b07f68387a6fdc3952ed67be32f426
SSDEEP 768:P9i6XaiMOvPL101fgP2am6Yc2bS4VRArHoKVIxlYf:3MObifPLfv2HeMf
TLSH
T1C5E24C11BB91E933C3625732ECA7C7E46724BD924DA1438B7481372F9870BA95F326C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1E0OAOKW.1CB\ECVGWBMQ.0ZR\manifests\scre..core_420d02d3849b7992_001a.0004_none_37b8bef4f413c188.cdf-ms
Size 3KB
SHA256 7e6f4e9bf77955c66f2237873c6ad032b15e5af2652a7c4fe4de3e4587aefea8
MD5 f829cf049b04660e126c7826f55d0cb4
SHA1 a09e7ed385d702f3dc419ea72ceb85802f295730
SHA512 c0503d52127768ba4de359f254ac93ae2f7d3c897b4cf0066ef3eb79cff97527f09330b1b3f20bad2834888d6061b951f8e512b6aa03896ce175924a9b6eb772
TLSH
T166615402B304E753DA6A07326CE1E6EE277C3D83DE85C20F74C47B6F79325A566112A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1E0OAOKW.1CB\ECVGWBMQ.0ZR\manifests\scre..dows_420d02d3849b7992_001a.0004_none_3c3096d63061d4b8.cdf-ms
Size 5KB
SHA256 2f934966181b637d8deff11c4c9b31ec397fb00fe5306dcab9f144a62c040ce9
MD5 d7418f3bb8da1af940bdceb0d09c29c9
SHA1 c77e3a61fd2ac02a91dd2a43082b08ef10317b24
SHA512 b573bc3a5fd143415026b42467152bb9829a2b35b1c20505ffdfc31cd12d48b26a7198513dfd528bf82379c5dd2c6e0d9491f0aa9a82042a79700fdd1a5ccfcf
SSDEEP 96:a4qSl4+heV+Ww7O0IKQr2xBUSzAJuTwnv+s:Ll4nJBKzM2E/
TLSH
T122B15511B294DD1BD5A90633AC9AD3EC2B357E83DE43430B70C4FB6F7A326D65212096
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1E0OAOKW.1CB\ECVGWBMQ.0ZR\manifests\scre..ient_420d02d3849b7992_001a.0004_none_98ff9818dcf7a495.cdf-ms
Size 7KB
SHA256 b94f4463b9736c2464561810035856ecb05514195d5d3124a368a81f0eddb94c
MD5 8fbdfb20caeb0f372abb857ab3111373
SHA1 247fb5e1a94d325c9a29c36af5dd1cfd6f0c1aea
SHA512 baeb0b23ed83ca852e84921aad52fa70ccea837b12bde257b23fe95a35ba1835e8b45b3aba46fce61ff8c77b8cb1de2003d9530f295a22b3d1db12cda5a0b29a
SSDEEP 96:vOOOXxnCTUL4BFeV+WwwOO86D2/g92oUSxjD9/1WsFVxThLgTD:25xnAVBaJxDD2otxjzW+8D
TLSH
T119F1A902B350D916D5B916339C9AC3ED3B683D93DE42830B70C0BF6FB6325E61223095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1E0OAOKW.1CB\ECVGWBMQ.0ZR\manifests\scre..ient_420d02d3849b7992_001a.0004_none_cdce1cc70363178c.cdf-ms
Size 2KB
SHA256 c2c60c1c782a746d1a1a3d510c2a59f3ba14126813decf9c2c46b51a255fb025
MD5 a7236f84836ddfacd6d88fdab5c350f6
SHA1 cc20a7be2a169278d9bf63caa813d3af20696140
SHA512 50461158d02ce5f2c3d7fcef8b262e932eb95d4b39efe59006f7822f537fe47acc7e20aceca9ef1fbdd07bf81e5ee39ca50be06dc4936bef4e7d5767cdba0b17
TLSH
T1BB51B9047684EA67DA6A0633EC96D2E933367D83EF07430BB180BB7F3A312D15612092
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_27fa83f1ad328157_001a.0004_none_7eb8c5e56d0a11db.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1E0OAOKW.1CB\ECVGWBMQ.0ZR\manifests\scre..tion_27fa83f1ad328157_001a.0004_none_7eb8c5e56d0a11db.cdf-ms
Size 22KB
SHA256 56613f588331b52f1640e3259fda642eaa75a53d07e349b7c65af49424893236
MD5 4ac3cfd6ebed1f489b85b7bff72802cf
SHA1 521952cf40765ed5d5338dde0ef1592fead0686f
SHA512 48ab98826edfffdb60be1dcb25e0eb0b4424f7d87e805dc69a6c64cc5b76a0e3a5d026fd5c92394e63fe6e097204cb18adca2b410eae15d057b9842e2472dedd
SSDEEP 384:IR9O2a1dEezyYKEeznljP2psgM7Ybfi17P2aa16YcnVC1bS4VkTkM5jj+zbO:0ha+PL10bfgP2am6Yc2bS4VRxO
TLSH
T121A25C853B91EE53C3225632DCD3C7E87138BD934EC2435B34453B1FA974F1A6A62A89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\1E0OAOKW.1CB\ECVGWBMQ.0ZR\manifests\scre..vice_420d02d3849b7992_001a.0004_none_e90c573d89d324f3.cdf-ms
Size 4KB
SHA256 efde5bb0dd4b25215d3a6cd249553550550fe2e090ba4b0cc73d0e87a2eca611
MD5 34bb014f60a043a0053bdb27028802f0
SHA1 c86f0e6a2417a7da8dff892e4a193935b4687b92
SHA512 145e5a4459191373d0f7e8b7ffaf6697a356cde0d8316e12831145568e84c89c29303d3788ae49ca8588f762295b6db12582ee83b70902b71f53f6bd445e52b1
SSDEEP 96:ijQxDBUIeV+Ww8OO4w8J8ASdBUlwQKKQz7Hva7ZEC:7B8JP8C5dB1QKKKmJ
TLSH
T111A1EE01B381EA27E6A51733ACA6C3DD3B797D83DE42420BB1C07F2F353269657251A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\1E0OAOKW.1CB\ECVGWBMQ.0ZR\scre...exe_27fa83f1ad328157_001a.0004_none_afa54f5a71f58454\ScreenConnect.ClientService.exe
Size 93KB
SHA256 a94ecccb5b88e3860d619fbb3b87ff4af6448240ab65b89d610f348d75e793f2
MD5 70301f4cf14cc29a4312446a02227f4c
SHA1 12c2879ebb5a2df0f1a5eb8706cc3a2c528bccbf
SHA512 51e87115f61680ef5dfcadcca04bb5afeb84416ca94c3f5e5bc362c482c079b67b6a9547240651917a818baa8d02aa0fdcfe326e7ded2054df0af4ce9c3c523f
SSDEEP 1536:jg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgcU0HMW7C:MhbNDxZGXfdHrX7rAc6myJkgcU0Hnu
TLSH
T1B5935B13B5C28872E473093158E0DAB49A3FF9615E61DEAB3788022E4F741C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2giew4dn.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\1E0OAOKW.1CB\ECVGWBMQ.0ZR\scre..tion_27fa83f1ad328157_001a.0004_160d1601be44e8d5\2giew4dn.newcfg
Size 683B
SHA256 ea8cac227e41a216ad811548c5d36e0fd8bc5365d1204e072b4bfe2496fc3966
MD5 7d6fb6560570c6820d645b9b1aa4292b
SHA1 488480150aa0e7237f4249e2a78d382971d29e1c
SHA512 604f1213c5a4c3f4b56741f2018a5134a349672a416a6a417209d3ccd74009e7186f8dd5a9b2d57ae173feef0e068a1941826c2c8ea84f7a33355e586d32e887
TLSH
T18B0144A972C0AE5602B32A32D6214345FE711A9B026560D834AE213B5F305DB07E32DE
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\1E0OAOKW.1CB\ECVGWBMQ.0ZR\scre..tion_27fa83f1ad328157_001a.0004_160d1601be44e8d5\ScreenConnect.WindowsClient.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\1E0OAOKW.1CB\ECVGWBMQ.0ZR\scre..tion_27fa83f1ad328157_001a.0004_160d1601be44e8d5\app.config
Size 686B
SHA256 26c8756edba2c00a35cc7d39c5a39b7b032224b50dd96307e9434373d63b0f04
MD5 a8b0cb6beb791735daef6ff5f5ca550e
SHA1 935a8e80f85e9b36e3ffe53237bdf31d35720549
SHA512 a1e191f9a3732af5a716666bb81e0745d5f1e5108db093876f5122cd8f6d3e939aa1f1163d4edd98927328f1fe4aec2751fc612b1553dcebb08bd5ae24062702
TLSH
T11E01D62831C5BE2A16675E23E6234600EDB08EA31126786D34EE203BDBF55D513F36C7
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\1E0OAOKW.1CB\ECVGWBMQ.0ZR\scre..tion_27fa83f1ad328157_001a.0004_160d1601be44e8d5\user.config
Size 520B
SHA256 ae57e9acdf1c898403b5215ed7a7dd4bffa061c0eaf347278cd0209a68220ac1
MD5 9a46d6c26d58ab0f1a6a1b08ba6f9480
SHA1 937425087250d461bf68a6c879b6f868fcfaf215
SHA512 56b4a2d995786ece14b799fb29f8acf42474c4cf7d3fbff0e4723ce0db53f839b41e83c6e2f118d75056b72e541d15dcee03ff35987323aabe1bd7e2269314f7
TLSH
T11CF0E9A131806D5703A35E23C6114745EE726B9B0555209874AF217A5F315DE07A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

O5XDHL68.HKD.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8XZ0483J.4N0\O5XDHL68.HKD.application
Size 115KB
SHA256 3b279368ff9e112a89ddd506546db42b208aba6f4937bfde98c1a3d542d5adac
MD5 76f215112cb60b68dd7fec2e8e0fd6da
SHA1 ab51ad76f9d47945c84b36ba50cabe2a499c6230
SHA512 ba02ee5e555581134efdfd1b247bf10f1f01abc8303859213bcf3c4451c70592e73a24c4f011c88e40a4133bffdcdf4ef7661610acf0c4d6d8e9cb02197cd6b1
SSDEEP 1536:+vcPLfvG/yXqK+zuLD4UABnjRnfduUW5Ab4KpSE5GP/uLTvooycupKQ/IuKE:+0PLfvG/yYuuBn1nfdvg2XOcupX1
TLSH
T15BB3A53ACE30F4C0477DB021D1A52D6B3D811B93DBB31BACD90A186B0E69756EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VE60D1NL.NH8\9G7COYWA.Q93\ScreenConnect.Client.dll
Size 412KB
SHA256 4010ea184982e71ad71e76b43266488c954f665324b89ef042cea9e463a60c9d
MD5 684aaca94df5fd9852e9c4d5456ef384
SHA1 ab16afe73d257bac410032aee77ff8899f7ea8e7
SHA512 c999493aa480dc09397bcebcfae95324ae1f2ccb86dcc5d7705ce55af040a25d159eebd3e97f46bb50a55e58460ee6b2e4cf02ea9a936468764c2d8f4018f53a
SSDEEP 6144:cS59LDc+c31vpY2Y5sD8ETEavHy+vd7JPYIYyqQni65/PTb:Hpcs2xDHTEavSW7OQniOb
TLSH
T19794C08163E85D6EE9AF1F73F0A1A1344E72BC056182F2EE0D0475F51A7B7828B546E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VE60D1NL.NH8\9G7COYWA.Q93\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 6f4eae4b257cf30340c226bb3ee5d8656c6de79b820714e6727f62eee2044292
MD5 7400597be5c012b58f1c50ecdebf2a1a
SHA1 0c835ed0c70c99900fdabc79321e41c8694b4dca
SHA512 5a7aaf04ab807d602107c068bdc555d1ca0bd15d80ba96f2786cd8f960eb1f718cfcdb24fee1589e8072ab5b5378c28db90863d440d9330e98517d24d3a1acb3
TLSH
T18C11590191C4FA362F3341D1BEE7F46067AE5B23198E194BB0696C9F8B29AD643470B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VE60D1NL.NH8\9G7COYWA.Q93\ScreenConnect.ClientService.dll
Size 91KB
SHA256 6e6aa42b107d3e82b7b7dc18a75eee3f09e9f268788c0a7edbbc617152adf178
MD5 372424eaf4bee00c8a5ffd305d90daf1
SHA1 63e4072286ee670e36a2583ab74cc25008b00431
SHA512 fdc2c59db75a2dc65efd43844badd8d543b1d891f8f1e200bc09300e911700f4a5d56c65ad157f5733f8b5abce3f3273eeac4420a8db1e545e4ac6a1f3004bce
SSDEEP 1536:5z0NAdGN6i9C4+Cm49qAOGWZa+QOV+eLj0GUazxDa91g0O9708aT:5z2pz9EyJ0QOVFjtUazxDa91gr9IBT
TLSH
T1A8936E0293BC992ACDEF1E34B461F1A006B1B903D8E6EBD86DD820DA2A553D15F543DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VE60D1NL.NH8\9G7COYWA.Q93\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 6f4e37343704120b5977eac90f904fa3aa74f111761aa604d5745beca115f727
MD5 57ae8924de501aea2d37892b8d4de231
SHA1 bd6957bbe37e112b9d18e63e6eb2224ca2aecbb8
SHA512 fdee6c86ad2f53b82c8de9e181193a14e6486682f5c055724a6cc31e7832280f9024ff7b95f1eb99aeef02932a6fe212104edda90fb0c36de88bc05bcf4dd8a4
TLSH
T1E431F61591C4FA351F3302C1BDE7E4605B9E5722158E190BB059699FCF29A97434B073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VE60D1NL.NH8\9G7COYWA.Q93\ScreenConnect.Core.dll
Size 577KB
SHA256 eedbd9ba4755f238af397c71b575082e18a31eabacc22abb4949f92fe991e169
MD5 e18e26f3f4c858db12d1419c8fd61a66
SHA1 0042ac48b343fac683063eda17221edc0afbb809
SHA512 fbeb963dc20cc28829ab21b3aa4eb741c1c17cd5e9444eac896c5099b964dc7db6f6a5f277600ea260be7a63e2e07d3ea1fed65940e821bc9a3eba0a40f8e9bb
SSDEEP 6144:hJv2rM+MrJSR1wrpiTw8iXlcY2BbVEBc8fXySJPluAPb2iS/ChwDTax4kxPhUTxQ:T2QTWo4T3ccY2BbV8ZJPlpPb2iLMI
TLSH
T179C48D1A73A48377C9DF0B7AE07055660F71E40424FBE76B7698F4A62CA33848E446E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VE60D1NL.NH8\9G7COYWA.Q93\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 655601939c46f0ec9cf99a4b37bd4622ac768a6eb4f0f558df4ecdec14ca0644
MD5 05ca8de63ce3a248e6cbfee8393ed0e1
SHA1 f789dac448e2e1cc4bda20bfffd99df6f0b4d045
SHA512 e8fe6d077535a5bda969f35bed7c1984e0f550eebf6ca5d9b01b8f0b0af09f14e32fa4e9977aee8d44c90dd0f175e5217f5721c2f57a7f85e7222d5326676f7f
TLSH
T15B21480181C8FA261F3302D2BDE7E42197AE5733188D194A7069689F8B19AD24747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VE60D1NL.NH8\9G7COYWA.Q93\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 305663a05c77c8058569a976db740aa2f20b66583f0381059633b628376570fc
MD5 0379bcd19a4fc8f4cbd8ed0f56912855
SHA1 b7b200a814ca0e5320647b5038bdbe59589dc4a2
SHA512 641ae19c2b23abf54657ea882310bbc2d6a44be8660e5ba36ae27c287034140af7f9393186cce1642b6f12dc47429b45af037cfb5ac8316030449a27576f4763
SSDEEP 24576:kBjf5QN9Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPb:YQN9JkGYYpT0+TFiH7efP2
TLSH
T12B85BD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VE60D1NL.NH8\9G7COYWA.Q93\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 6a0833e60c9e01dbe30a2036f7617953a2ed0f732f0ea0176c3f31463df6ab08
MD5 9e3b8f46a912c7d3efcea309dff71112
SHA1 ae0eb977f9bfbf00e5c46206c145fac1507200b8
SHA512 5898714462c0691bb41e17c165cc4f6e07d01e06cc63b82893490328bca7ec04ea7c6106b211db4bcd8076691365efaaffe020baf02f3f99bbeb5d00fd7b5376
TLSH
T10241F11281C8FA251F3302C2BEEBE431979E5723198E190B7099AD8BCF29AD74747037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VE60D1NL.NH8\9G7COYWA.Q93\ScreenConnect.WindowsBackstageShell.exe
Size 71KB
SHA256 39d8d1c287e8c1788a17705c8af8e325415b47e90071182c46222cc35f2f825a
MD5 f5cb77339bd526af441da24cabd508bb
SHA1 9b9ba940f9289bc7d71ce9d80ac8344c287af195
SHA512 2a273ab40606afe1767e10d3906736a0786087e7c8b99c8ef755b85735f8b5b96739daad7036293d8eaa4c006065bbccff521018716b91c626d5b32dec7ac29a
SSDEEP 768:pzlYsf/wCdOBti13kDeuRsUQHjSzmdvmDSmBsuMQX5E+TCMXESslRq75KYiDLk5N:pRYKtd739PDldvmDqfQX5E+TC7bu5K7K
TLSH
T102637D5023DCD525E9FF2E34B0E1F6600AB3BA6388E1D7D52DA821DA2E137D14F64396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VE60D1NL.NH8\9G7COYWA.Q93\ScreenConnect.WindowsClient.exe
Size 676KB
SHA256 f49ca44ae19ec33053d76aeca7136193095b6583888a0be063b8120c3c9226c7
MD5 9be73339f073919afa6a7a636cb3ac62
SHA1 e5e64edf1bfe4fd9bcc596ccc3250a0758232da1
SHA512 e451b116df25806fff3f5c8d753b26f673d0dfc20574756fc62f5215433e0dd96988310df934bb6c77ec22bb31b3ea052721420f631d000d41d57a4b26c1ab45
SSDEEP 12288:1GafI0dcqD/bp96K0ZSDVkmwY7zvrPfaGOwg24oL0:jg09eMRPvtChoL0
TLSH
T15FE47D3137AC9A7BD5AF0B39F033391867B1E4057289E74FD948A4EA1D8B7848D0539B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VE60D1NL.NH8\9G7COYWA.Q93\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VE60D1NL.NH8\9G7COYWA.Q93\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 ef613a98b6ad15c74d85b533ea914337fb549c8f9b882c78f31616d27a664746
MD5 9ebf4d420218c403bd6eb773227b670a
SHA1 6e6b3f8dd8223cbbccb79b90a63649b06a378eb0
SHA512 dee07c4919b990b845b6ebd6cdb8f70363d0c733180ed53c954ca52b62518e0a43c938d5c4a20b05603f70224d48f964fbe1ea385f78b528be8909ddfa19ea1a
TLSH
T13751C61651C4FA351F3302C1BEEBE4709B9E5722158E190B7099A99FCF2DA97474B037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VE60D1NL.NH8\9G7COYWA.Q93\ScreenConnect.WindowsClient.exe.manifest
Size 25KB
SHA256 a89e3c59652631c6570cd60f0b517e4db1fda7d5cb6fcd649665d19bd574c329
MD5 71100f967929ded269700a6e6ba5bf4a
SHA1 d97f8e60e42b666424aa11f866cadfd66d21f0aa
SHA512 3071ce68dd5c7fa2bff20d5979b5ce4dc9946314e5ece7318cbab08ec5adbc436e86f722b66b863a70c7427a0e038af8ec8f6f7d09869dc8a5d1e799ac8e268d
SSDEEP 384:peKfWQmK01ea6AfaJ2EezobMOwEezuEeznljP2psHM7YMfi17P2aa16YcnVC1bSv:pCaPbMOZPLs0MfgP2am6Yc2bS4VRA
TLSH
T188C24B5A8CC03D1103339190FEE38A24FD493F6305E9009E7D4D15AF9FA5A5AA7A32E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VE60D1NL.NH8\9G7COYWA.Q93\ScreenConnect.WindowsFileManager.exe
Size 91KB
SHA256 a17d01614efd8dea3f32ec8352998025d72c17df9fda7c52f5c65059fa0c49e9
MD5 62d4d210742966cc8fd869a646320fbd
SHA1 8290a28ed1982541e2018baaa4f90ad420c0eac5
SHA512 5570678075d72ac9f80ca1726bc87008a15398118628b1a434e81fdd79ff71d4b216e4f21e57bf88e38a1163d8b21a60dd1b2aa0a291bc7f67ff81da171c0adc
SSDEEP 1536:vUMOISlP4wyHI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVdi167U:kIsAukLCK64
TLSH
T1DA93E55235666235DEC5C033A492E9B198377F6207FDC5BD28A1BE3A39E03903E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1668-5-0x00000000054A0000-0x00000000054C8000-memory.dmp

Download

memory/1668-4-0x0000000005410000-0x00000000054A4000-memory.dmp

Download

memory/1668-1-0x0000000002D40000-0x0000000002D48000-memory.dmp

Download

memory/1668-0-0x0000000005400000-0x0000000005410000-memory.dmp

Download

memory/1668-2-0x0000000005400000-0x0000000005410000-memory.dmp

Download

memory/1668-3-0x0000000002EB0000-0x0000000002EBC000-memory.dmp

Download

memory/1668-6-0x0000000005A80000-0x0000000006024000-memory.dmp

Download

memory/1668-7-0x00000000055B0000-0x0000000005642000-memory.dmp

Download

memory/1668-8-0x0000000005400000-0x0000000005410000-memory.dmp

Download

memory/1668-9-0x0000000008380000-0x0000000008530000-memory.dmp

Download

memory/1668-10-0x0000000005400000-0x0000000005410000-memory.dmp

Download

memory/1668-11-0x0000000005400000-0x0000000005410000-memory.dmp

Download

memory/2900-366-0x0000000000340000-0x00000000003EE000-memory.dmp

Download

memory/2900-402-0x000000001AE90000-0x000000001B018000-memory.dmp

Download

memory/4824-80-0x000002856BBB0000-0x000002856BD60000-memory.dmp

Download

memory/4824-18-0x000002856ADB0000-0x000002856AE00000-memory.dmp

Download

memory/4824-68-0x000002856AB30000-0x000002856AB4A000-memory.dmp

Download

memory/4824-74-0x000002856B8C0000-0x000002856B92C000-memory.dmp

Download

memory/4824-12-0x000002854CF40000-0x000002854CF48000-memory.dmp

Download

memory/4824-86-0x000002856B9B0000-0x000002856BA5E000-memory.dmp

Download

memory/4824-14-0x00000285674D0000-0x00000285674E0000-memory.dmp

Download

memory/4824-35-0x00000285674D0000-0x00000285674E0000-memory.dmp

Download

memory/4824-34-0x00000285677E0000-0x0000028567968000-memory.dmp

Download

memory/4824-62-0x000002856B8F0000-0x000002856B984000-memory.dmp

Download

memory/4824-401-0x00000285677E0000-0x0000028567968000-memory.dmp

Download

memory/4824-13-0x0000028567510000-0x0000028567696000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads