1df2aaf4dec1a974f833aae6bd53a08761d3e862cf38ee058f2c898e60eeb870

Analysis

max time kernel
149s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 10:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_dc6d5dd2fbd08f4aa935df632b447edb_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Size 3.7MB
Sample260801-mhm8bssfld
SHA256 1df2aaf4dec1a974f833aae6bd53a08761d3e862cf38ee058f2c898e60eeb870
MD5 dc6d5dd2fbd08f4aa935df632b447edb
SHA1 97442f35de52ea0c8df9fef9dc8e17102dd959b3
SHA512 17218b75b996e560d2ecf345c93beccf146a74e3622b21bcbe5ebcb45b5fabae9e5522765f0e3789446b79a06b2248a9f5a0a62d2c10fa77f035d2f925450d1c
SSDEEP 49152:P/8CesAp0AEQi47PgGZVJkGYYZTk+T1iH7efPQUaN8zxG6:P/8rsAp0AR7PgHM6efPQ6zv
TLSH
T13406CF4AF7C6A677C43E063584A66304A7B4F4854B62C7EB6AE07B3D1C323D46E253C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
9	2868	dfsvc.exe
9	2868	dfsvc.exe
9	2868	dfsvc.exe
9	2868	dfsvc.exe
9	2868	dfsvc.exe
9	2868	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
1112	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\JEOYQDT7.GXE\K1YKDC0G.94Q\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_dc6d5dd2fbd08f4aa935df632b447edb_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0001_none_3c5ca7bb4807a515	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_cdfa2dac1b08e7e9\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32362e312e32322e393537332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_992ba8fdf49d74f2\implication!scre..tion_0000000000000000_001a.0001_bf3 = 68747470733a2f2f73632e746e61632e75732f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32322e393537332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0001_none_5d78270ed2389afa\SizeOfStronglyNamedComponent = 10cb050000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0001_none_37e4cfda0bb991e5\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0001_none_3c5ca7bb4807a515\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0001_none_e9386822a178f550\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32362e312e32322e393537332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0001_none_5d78270ed2389afa\lock!0400000060a2590e580400001c1300000000000000000000 = 30303030303435382c30316464323161303832373437373634	ScreenConnect.WindowsClient.exe
Key deleted	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0001_none_5d78270ed2389afa	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0001_none_3c5ca7bb4807a515	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0001_none_e9386822a178f550	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0001_none_e9386822a178f550\lock!08000000daa0590e340b00008c1100000000000000000000 = 30303030306233342c30316464323161303739323239363436	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0001_none_3c5ca7bb4807a515	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0001_none_0afdd516d1f3bdf7\lock!0200000060a2590e580400001c1300000000000000000000 = 30303030303435382c30316464323161303832373437373634	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0001_none_5d78270ed2389afa\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e312e32322e393537332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_992ba8fdf49d74f2\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32362e312e32322e393537332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0001_none_3c5ca7bb4807a515\DigestValue = 73a2792bc20d80c6fa762f909f7eda856d19fff4	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_8cb4d7a3fe2615e3	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 460061006c00730065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0001_none_5d78270ed2389afa\implication!scre..tion_0000000000000000_001a.0001_bf3 = 68747470733a2f2f73632e746e61632e75732f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32322e393537332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0001_none_e9386822a178f550	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_79e3f3e66ecd8062\scre..core_420d02d3849b7992_001a.0001_none_37e4cfda0b = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_992ba8fdf49d74f2\Files\ScreenConnect.WindowsClient.exe_6492277df2 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_79e3f3e66ecd8062\scre..vice_420d02d3849b7992_001a.0001_none_e9386822a1	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0001_79e3f3e66ecd8062\identity = 68747470733a2f2f73632e746e61632e75732f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32322e393537332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e312e32322e393537332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_none_0afdd516d1f3bdf7	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0001_none_37e4cfda0bb991e5	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0001_none_3c5ca7bb4807a515\lock!0c000000daa0590e340b00008c1100000000000000000000 = 30303030306233342c30316464323161303739323239363436	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0001_none_5d78270ed2389afa\lock!06000000daa0590e340b00008c1100000000000000000000 = 30303030306233342c30316464323161303739323239363436	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0001_none_37e4cfda0bb991e5\lock!1c00000070a2590e580400001c1300000000000000000000 = 30303030303435382c30316464323161303832373437373634	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_cdfa2dac1b08e7e9\lock!1600000070a2590e580400001c1300000000000000000000 = 30303030303435382c30316464323161303832373437373634	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0001_none_e9386822a178f550\lock!1400000070a2590e580400001c1300000000000000000000 = 30303030303435382c30316464323161303832373437373634	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0001_none_3c5ca7bb4807a515\implication!scre..tion_0000000000000000_001a.0001_bf3 = 68747470733a2f2f73632e746e61632e75732f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32322e393537332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_992ba8fdf49d74f2\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32362e312e32322e393537332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0001_none_5d78270ed2389afa\Files\ScreenConnect.WindowsBackstageShell.exe.co = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_cdfa2dac1b08e7e9\lock!0a000000daa0590e340b00008c1100000000000000000000 = 30303030306233342c30316464323161303739323239363436	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0001_79e3f3e66ecd8062	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "Z4GCC3CE3T2A4YWGR1HRHPLQ"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0001_none_3c5ca7bb4807a515\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32362e312e32322e393537332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0001_none_3c5ca7bb4807a515\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_79e3f3e66ecd8062\scre..ient_420d02d3849b7992_001a.0001_none_cdfa2dac1b = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_8cb4d7a3fe2615e3\LastRunVersion = 68747470733a2f2f73632e746e61632e75732f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32322e393537332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e312e32322e393537332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0001_none_37e4cfda0bb991e5\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32362e312e32322e393537332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_992ba8fdf49d74f2\DigestValue = 9af326d317bdd9c633d82b9104267fd692cb0478	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0001_none_37e4cfda0bb991e5\DigestValue = 56fd54ef2ac56a2bb6b60ff5c72a217ea0a5b8df	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0001_none_37e4cfda0bb991e5\lock!10000000daa0590e340b00008c1100000000000000000000 = 30303030306233342c30316464323161303739323239363436	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0001_79e3f3e66ecd8062	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	ScreenConnect.WindowsClient.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\JEOYQDT7.GXE\K1YKDC0G.94Q\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\Z4GCC3CE.3T2\A4YWGR1H.RHP\scre..ient_420d02d3849b7992_001a.0001_none_992ba8fdf49d74f2\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3352	2026-08-01_dc6d5dd2fbd08f4aa935df632b447edb_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Token: SeDebugPrivilege	2868	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 2868	3352	2026-08-01_dc6d5dd2fbd08f4aa935df632b447edb_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe	89
PID 2868 wrote to memory of 1112	2868	dfsvc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-01_dc6d5dd2fbd08f4aa935df632b447edb_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_dc6d5dd2fbd08f4aa935df632b447edb_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Users\Admin\AppData\Local\Apps\2.0\Z4GCC3CE.3T2\A4YWGR1H.RHP\scre..tion_0000000000000000_001a.0001_79e3f3e66ecd8062\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\Z4GCC3CE.3T2\A4YWGR1H.RHP\scre..tion_0000000000000000_001a.0001_79e3f3e66ecd8062\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:1112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0001_none_5d78270ed2389afa.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\Z4GCC3CE.3T2\A4YWGR1H.RHP\manifests\scre...exe_0000000000000000_001a.0001_none_5d78270ed2389afa.cdf-ms
Size 14KB
SHA256 4776f1320181f0f424e4c5d08b1df2f2705030875e2b644b221b068a80cff0d9
MD5 2134f1da31468f0a012f0d327d3a479d
SHA1 616fd5b0bb9181a4b51b6d0dc36836623f13cee9
SHA512 85c168c6f476bc3929e3856a977112d16847e1ad3ec62195762342c59e7f5f34e83a75d047f29488570e6ff0012742a8bcbc322a18dcc806ce6d967f8b9005c1
SSDEEP 192:n3swHfSIy+bMwV77Tet2rXrMrIVs9ZZhGoIz7g0FN4:nLzy+n77T1bw+iY4
TLSH
T110628501BBD2E932E2512773DCDAD3D47232BCE55F96135B30843B2EAD712C98A23695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0001_none_37e4cfda0bb991e5.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\Z4GCC3CE.3T2\A4YWGR1H.RHP\manifests\scre..core_420d02d3849b7992_001a.0001_none_37e4cfda0bb991e5.cdf-ms
Size 3KB
SHA256 fb39b2f282958f4cc900d42acb16a1561c4c4a9bcac8cfd0ac855ccc12c2096f
MD5 102e510331871913c03e144f64413936
SHA1 b5d29de63160c7ec416c3d34c716c01431e0e16d
SHA512 855f6a89cd542bf18188125c689fc9ddeb86a73c55522f1d05fc9c230f2f0562522b02a3ffa5e63c99b92814969bb4f0101d1a821ac57557c95b42fdacb31c3e
TLSH
T1B661DF41B308DA13D9AA0733ACE5D2EE27743E83DE41520FB4C47F2F79325B65611265
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0001_none_3c5ca7bb4807a515.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\Z4GCC3CE.3T2\A4YWGR1H.RHP\manifests\scre..dows_420d02d3849b7992_001a.0001_none_3c5ca7bb4807a515.cdf-ms
Size 5KB
SHA256 0298b1c4ad50c3517a960f3de5c3b2210f465cbaa1c70d75fc096d396530b036
MD5 58dc34b8238ee4a5ec3a0ec989833c18
SHA1 6b3198eb300d21ae2d8de7f4866bd70c8ed8c188
SHA512 f33bda1adc8ea504a98aed18f74e0a7873bbe7be33e8b05a4cc16c0b6430996f1ab498b2ced7f569796dc24ac2a17c2bacd35403204a4f7af4e23c4b23a25fbe
SSDEEP 96:NhW+RzfaLKeV+Ww7DI6zn22bHkzUgOwXcwimdiF:dRzoFJNQ2SI3XKBF
TLSH
T191B18701B390D917E5B90633AC95C3ED3B75BE86DE03030B71E4BB2FBA326D69611195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0001_none_992ba8fdf49d74f2.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\Z4GCC3CE.3T2\A4YWGR1H.RHP\manifests\scre..ient_420d02d3849b7992_001a.0001_none_992ba8fdf49d74f2.cdf-ms
Size 6KB
SHA256 3970d62e3eb49895f958e0ed3bcff4d20f6046a417b648fe81e1eabfb730f29d
MD5 c29b52562b94e040462b5ff5169b4ba5
SHA1 38326b1142a006afeb43e2a8a45c32707f22d1d2
SHA512 c461a8e0784f2393629c09dabb88a17f26338dfe0064a46ec0a127c6822141ce34930dad75d6a938387cda3f7f8148db0339707b8126f7a71b311794610cac4c
SSDEEP 96:6wN8BQaunTf5IeV+Wwwz861Vk2lVsgYNH+7TCGnyksuICF:6KpaunTfJJr1fPjfndL
TLSH
T16CE13201B394EE17D1B91633AC96C3EC7725BE86DE43070B71C0BB2F7A322E65A12095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0001_none_cdfa2dac1b08e7e9.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\Z4GCC3CE.3T2\A4YWGR1H.RHP\manifests\scre..ient_420d02d3849b7992_001a.0001_none_cdfa2dac1b08e7e9.cdf-ms
Size 2KB
SHA256 46040da48395934c27cc242b0d8ab29a5e00c3a824c1a0b0e4d1a73e5b9d5d2a
MD5 dcddc59c8453731b4d1a0fae722ff3c1
SHA1 d5adabf2f548edcdecbaee70b69c14bd55792bee
SHA512 b98cb4f48a793548e6233fd17e55502e1163db976af3f9140efbf248d2862fc8167f12a1e9e256a27963bf8d29ebccaa0a12445c3ef2b63d1a79cd56e3c00470
TLSH
T1725165057784EA67E66A0633AC92D3E933357E82EF47030BB180BB7F2A716D15612092
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0001_none_0afdd516d1f3bdf7.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\Z4GCC3CE.3T2\A4YWGR1H.RHP\manifests\scre..tion_0000000000000000_001a.0001_none_0afdd516d1f3bdf7.cdf-ms
Size 4KB
SHA256 e4be3cff048f58b3ea34df0dfb4b00d1bf257fbea9e0bcf0f7856cacec736e49
MD5 e6996e66f5ef21c08f5a9bbee8d31a0d
SHA1 2523d265bf13214e3b9dea1507101b8187cbcd41
SHA512 f2d874aeb90255ba7912c4f157025bf13afe0484b1a6955785178a9fefe26e1b41e7917cade1cefca565552e91090abf071903ee799654b79fc9cae3f935636d
SSDEEP 48:rfP/mrIgAjIvCXjgDTRu9o0m5RD7DU7gFUTUEjklXt4sQgbmZFms4Ch+UQRci:bOUTGfEW0m5R/DUm4kXQPfmvVUQRL
TLSH
T13D912F80B780E833D6144772ACE3D2D032357DA64FD7871B70987B2FAD367C59622266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0001_none_e9386822a178f550.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\Z4GCC3CE.3T2\A4YWGR1H.RHP\manifests\scre..vice_420d02d3849b7992_001a.0001_none_e9386822a178f550.cdf-ms
Size 4KB
SHA256 371719401d9b0c95e9b91aecd7bfc518c3f892503d15f4da485143b17a8d0a20
MD5 733478e5522739048bdf8e854ffa1b8b
SHA1 0c86432c5308f51371fcd97494af49688d9cd892
SHA512 61c2dd76ad4059a503ef6e264f93c1b60ccc082929c147cca443c200dd316c6e3d876b44a66e012807eab224a0e49490393e230d8eb6a529301d1a759855d3bd
SSDEEP 96:zQotc9eV+Ww8z4csqvs/PuMmYQuaKQK5kyF+C:QCJNvYspKW8
TLSH
T123A155017380ED67D16A0633AC96C3DD2B36BE82DE42130B71D4BF2F3A716D69726095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

M43936HQ.LY6.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9NM1JA8A.NQ9\M43936HQ.LY6.application
Size 103KB
SHA256 3729f995f5ca670327234a922c1d09a9703478374e33ef31e64af7eefd7e67cb
MD5 66430fbb38200b4f97078612400bdef8
SHA1 adf041d6f785c0df2d7664ac6cbfe18ee66e95a5
SHA512 7f9a11b3b2c9260c1d0840a68c1bbbdad61054ad3461fbbf089ee03297c756323bafb1266e3f23fac937a1a1175b57c15781371e24aaf754ed8003866e91cc0e
SSDEEP 1536:7/iBHhe2WCRSmQfn4/5EHSZ5GE/uLTvooycuF2JYKQ/IuKE:7/YHhlWCRbW22XOcuF2JYX1
TLSH
T14DA3723ACE30F4C0477DB021D1A52D673D811B93DB731BACE90A186B0E69796EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JEOYQDT7.GXE\K1YKDC0G.94Q\ScreenConnect.Client.dll
Size 627KB
SHA256 3fc7102580f90887ab0e4fd7e108ffb39d9e36534b29dc3cafc0bf10467a94cc
MD5 27c02d668fcfc55020ba75063bc85563
SHA1 91d3a411e69d3098b89c4e56cf9f0f4b8dfab565
SHA512 dc6473ca7aa7bfdb3404af4f36609629eaf3f07034531ffec4d90c6d6f63baa4bdd197eef59fcde3ef4d794c831e10cb3acff1ae2dc243121f3a1314d832c0d7
SSDEEP 12288:7ihGnk1kEWlCpr/auIiEbmtzHTEavSW7OQninLiCE:gUkqEvkm5zEn8qnLiCE
TLSH
T126D4CF4EAB5BBA2AED2E0B33E6D22214D6B16C8B9657D31F0D58767C0D723C4368D1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JEOYQDT7.GXE\K1YKDC0G.94Q\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 99ab338d0370b2119c13fab529cf2ddfe70244bd8dce222d70388f0cbff6207e
MD5 4a4acb3d97f3f9fc6dd489a5088a580f
SHA1 8170e42efe50e2476819350697e1810b272fd094
SHA512 1f6c9f133e865d2325f5670f762d7a5127180d82048533bae8eee7e436b5f6df12aa6064a9ef6c646691983ed088524d4518464c97bc7b87aa291650f6862391
TLSH
T1F4117F0191C4FA362F3342D1BDE7E420576E5B33148E154BB069685F8B29BD743470B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JEOYQDT7.GXE\K1YKDC0G.94Q\ScreenConnect.ClientService.dll
Size 174KB
SHA256 a017d0c0cd76141c117fd0a4f36665a647459294586b76a6edccb863b8148f41
MD5 439628eff70ce81c304308595bc43703
SHA1 991bdb4432c3c9d59c06b311eb58cebdd14b4d44
SHA512 26056d68a52a43db847ac1e6db227e3afcc7bb78851f95b5847754b73a6c3827f48ff2adf0d49157a4960c2c89ea2180b2df4526ce3485c80db8b0e4f75bd150
SSDEEP 3072:9dDDAVOQIhfToHux9kG77T9cBuP1LQOVaE2NUO:L37/VToHWHTyBuPhsEU
TLSH
T13F04BF49B78DD466D5AE0E3BF4A2B31052F1A483DAE6C34B7C9862ED0E557C02F583C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JEOYQDT7.GXE\K1YKDC0G.94Q\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 96e648a6975db112010b76d92eed305830e54cc2aaa7a45d09672a0da865c296
MD5 4901a32c964ff94d24cfade5340d498a
SHA1 d8b19a5793282e3bc800e783067df0ec44448a7e
SHA512 dda1cf45fadb433503e76a60b7c0f32fa81e807cceea1a817dc32a49b728f02184ffba49af113b077eb05d75a674b3b811fdb3a7b62e54204157e879fb509828
TLSH
T1FE31F50191C4FA351F3302C1BEE7E4609B9E5B22198E190BB09A695FCF29A97434B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JEOYQDT7.GXE\K1YKDC0G.94Q\ScreenConnect.ClientService.exe
Size 93KB
SHA256 c33178431989f7c07990d9bcaae98d979952913f1c2ec6ea2e1be800bd908ace
MD5 b3fab2382e7c3216c33cbde92301baad
SHA1 891102ab1096a67a044b98b8621c7d933af780b4
SHA512 6fcceb64d1452aa35867770ec39b4e55afa3026e9a934222fd7df075542820821ede2c6288626f2ba12884c95e6335bc1619939ea455238708adb43df12232f5
SSDEEP 1536:9g1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg0T0HMs7fJ:OhbNDxZGXfdHrX7rAc6myJkg0T0HZt
TLSH
T110935B13B5C28872D573093158E0DAB09A3FF9615E21DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JEOYQDT7.GXE\K1YKDC0G.94Q\ScreenConnect.Core.dll
Size 1.3MB
SHA256 91395fd9d3d73f7ae1cfc03ced567c41723af3f7c89f9e2dfc723f04c998e43b
MD5 809940a4ef998e8a6e3f7cbcbf5eb116
SHA1 56fd54ef2ac56a2bb6b60ff5c72a217ea0a5b8df
SHA512 eeeaa0fa983f7f693c4b61d77d3e5f0b8dd822a3ad378ebfff579a0e4bcfd828f7f1f8491dd03fb806c02783417dee690915b311d4a57dd39e2f82516a2540d7
SSDEEP 24576:cIL5B780ayXesApw/S0p9CmAtCQHCVSUU3:h/8CesAp0AEQi4N
TLSH
T185558D8E7B89E327C96D067384A05244A7B4D1E29F33D75B2AE4B73D4C993A87D481CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JEOYQDT7.GXE\K1YKDC0G.94Q\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 7e002b2f2bdbbd6eb8c98cbd627c6b73ea5c9dfbd9f5ce5e92294b673a946366
MD5 1e7700ffa4dc6f3556ee97770336fe1f
SHA1 23cbd7d0801028682bade551722180f016dad3e0
SHA512 e9847ad3f762e1e671d401fca84cb61a90c8cd79574f9cdae948e86c088f5b6e51c133f66c26e3ca17ad4481ceeb182eb55204b35e56d941223b74b046b1c578
TLSH
T1E8216A0181C8FA261F3302D2BDE7E42197AE5B33188D194B7069685FCB1DAD24747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JEOYQDT7.GXE\K1YKDC0G.94Q\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 e1fc8b745d4c7df758ad73262d49ddc00b41bb030f42f406ab4152806d955939
MD5 9e60031a8df3c15413960b0cbb7c3aac
SHA1 73a2792bc20d80c6fa762f909f7eda856d19fff4
SHA512 9fdf2deb8f75bcf16d220a803a1c4b2976c14567a0958acb862232f20d8f2e624dc000aaee1d9f5c4e9442c615fb6d230fbbb2c631e65d7df811659843f4260d
SSDEEP 24576:6PgarZ/yMFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKM:6PgGZVJkGYYZTk+T1iH7efPQUt
TLSH
T1CF95BD45E2C364FAD46B047888BE632AA7743C040755CBFB97D0AE3A6D337C09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JEOYQDT7.GXE\K1YKDC0G.94Q\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 079ae3e0db442f62da40e728a4974a4ccf081a47c7b1f554c3854868422ebc7e
MD5 6415f0c6769f315ac21ec1f274bf2028
SHA1 042bee915f69ab0f7be6cfd7d321fe90ffb9ad0a
SHA512 bf49326bae0c746ea960230794f1387b37be773a27b241aa6373ae056a4bfd5cd28f49916c71061243905b233a4f2024b2750cdb9b8d7df3cb4b6d667efb7c93
TLSH
T19541F11181C8FA251F3302C2BEEBE431979E5723198E190B7099AD8BCF29AD74747027
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JEOYQDT7.GXE\K1YKDC0G.94Q\ScreenConnect.WindowsBackstageShell.exe
Size 136KB
SHA256 06bd67a8d7f9947612839b9add9f0b00b964dac7f192d4d74f75fc14b921c3ef
MD5 1ac667f4f9b715d7a6d2f71127c232ce
SHA1 8363b7c5d9caeb07220c4e0bef17bf63db396222
SHA512 7157a74535368af4d0f9ebe862901e7d7d99bc0142b526b004c7b9074bb138ae542c1aa253b2c90712f34f6bf50c5baca14b33db6c9c095b62317575555069bc
SSDEEP 3072:qb1rHaZ2EIsTz7ChM2FFJvvH+1I9K07F3nTS:p2lE7CWCJHaI9T7F2
TLSH
T161D39E817758C925CAAE0E3BA4D2F61002B0F59389D3C75B7C9826BD7F19BC12E593C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JEOYQDT7.GXE\K1YKDC0G.94Q\ScreenConnect.WindowsClient.exe
Size 1.5MB
SHA256 84931cb275766dd20c7fe74aaeebf9ef7e942303d7d51ec89bb3889ea5bc625d
MD5 e18f54f4157fd34972d216094882e3b5
SHA1 9af326d317bdd9c633d82b9104267fd692cb0478
SHA512 8d945dda53f6f11e572c4ddc0d2d7d42e87427b7576fd618e6c4bf879fb6228a964b5b3cf0ba39436efc3cc4cb02371fe92a9ccac59f94d89101cfc1c2afdc92
SSDEEP 24576:u7OY8eADWeHgv4tqI+9O/IgIFK/Gl/7RgxNHOa0qAG+he3FTYr:u7A0vU/Gl/FbS4
TLSH
T1ED75AE1E7ED5EE3BC85E4B769061121477F084918B37CB076CA4BBBE2D813846E186DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JEOYQDT7.GXE\K1YKDC0G.94Q\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JEOYQDT7.GXE\K1YKDC0G.94Q\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 3b10caffbfac2cc6386513e55f36a8dfce3f60eb8db881ca8e91e0ba0be06fc4
MD5 b3258cc238bdc4efacc98e7984fa8d19
SHA1 5dc712589e6dc69f869976bb2a79203817e459b1
SHA512 1f1b5c558fe8b7ada0074b77ae50ea28aff5e595fef326f4aadacf22876fabab4e45624d3347491ebe6718da627f7cc90c2896819e72d02561a33e4a72e4ef10
TLSH
T12651D41191C4FB351F3302C2BEEBE470979E5B23198E190B7099A98FCF29A97474B027
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JEOYQDT7.GXE\K1YKDC0G.94Q\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 cc2c7e4085fd0dd568b94ccdde39f4ce175cd3296d4fca1393ba42075b296c24
MD5 d25eccaff709ca2921c9f2f8ebca6c39
SHA1 1f02402051201cd602619afbe2191a940a08cbb0
SHA512 5e2a509e5f7a2de3a368fbee66c5cb0612175d4b7460bd04fa28ca1a108da10ea25abdf2bdbbcbf67878cbe2683a531da1b6dc8e343f26ce7fdc49f89eba560e
SSDEEP 96:xWLwOhoyTgUe2wvyFkgKek1FkkkukZqkFDyke4kOpQkOpPDkwAkOpD:oRte7gKf12hPZFD7e9UFUQwVUD
TLSH
T1FDF1BC9688C07D21573381C0FEE39914BD157F23066E148EBC8D19AF9FB25899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JEOYQDT7.GXE\K1YKDC0G.94Q\ScreenConnect.WindowsFileManager.exe
Size 118KB
SHA256 2f777c026ebdf2f553fbb3c2ef44678e6fe7b005dbbc4ae32aeb29840d346fee
MD5 a4adef7228a71e1635c434bea10982e1
SHA1 0c98caae74d00478e9ec8c2167028e9a414f540b
SHA512 e94d6e7029ef8c1ca8f1dc87020a2e7dfebb0e36b94329653cc5c89fce29ab2ee9bade3ae7bf0d52dde1e7b2343203ea45a8bdbc8ee7b313df698fafac16cd25
SSDEEP 1536:KKSZOaZW4P5sAFnBBbMStOpiI5BLP+VVVVVVVVVVVVVVVVVVVVVVVVVSgFh7wN:0ZOaLGARBBIiuBLN4hsN
TLSH
T11AC33A4135266231DEC5C433A452E9B099337F6607FEC6BE2C61BA3639E13943E99DB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1112-288-0x00000000008B0000-0x0000000000A3A000-memory.dmp

Download

memory/1112-299-0x000000001B630000-0x000000001B660000-memory.dmp

Download

memory/2868-15-0x000002957FB80000-0x000002957FD08000-memory.dmp

Download

memory/2868-17-0x00007FFE601FF000-0x00007FFE60200000-memory.dmp

Download

memory/2868-27-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/2868-36-0x00000295672D0000-0x0000029567320000-memory.dmp

Download

memory/2868-25-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/2868-46-0x0000029580190000-0x000002958031A000-memory.dmp

Download

memory/2868-52-0x0000029580150000-0x00000295802A0000-memory.dmp

Download

memory/2868-24-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/2868-58-0x00000295801F0000-0x00000295803D6000-memory.dmp

Download

memory/2868-23-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/2868-22-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/2868-64-0x0000029567290000-0x00000295672C0000-memory.dmp

Download

memory/2868-70-0x0000029580000000-0x00000295800A0000-memory.dmp

Download

memory/2868-21-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/2868-20-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/2868-300-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/2868-19-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/2868-26-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/2868-298-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/2868-14-0x0000029565440000-0x0000029565448000-memory.dmp

Download

memory/3352-7-0x0000000074B60000-0x000000007531C000-memory.dmp

Download

memory/3352-5-0x0000000074B60000-0x000000007531C000-memory.dmp

Download

memory/3352-12-0x0000000074B72000-0x0000000074B73000-memory.dmp

Download

memory/3352-11-0x0000000008F40000-0x0000000009126000-memory.dmp

Download

memory/3352-8-0x0000000074B60000-0x000000007531C000-memory.dmp

Download

memory/3352-9-0x0000000005C20000-0x00000000061DA000-memory.dmp

Download

memory/3352-13-0x0000000074B60000-0x000000007531C000-memory.dmp

Download

memory/3352-10-0x0000000005890000-0x0000000005922000-memory.dmp

Download

memory/3352-0-0x0000000074B72000-0x0000000074B73000-memory.dmp

Download

memory/3352-6-0x0000000005360000-0x00000000053CA000-memory.dmp

Download

memory/3352-4-0x0000000004FD0000-0x0000000005120000-memory.dmp

Download

memory/3352-3-0x0000000074B60000-0x000000007531C000-memory.dmp

Download

memory/3352-2-0x00000000027E0000-0x00000000027EE000-memory.dmp

Download

memory/3352-16-0x0000000074B60000-0x000000007531C000-memory.dmp

Download

memory/3352-1-0x0000000000F70000-0x0000000000F78000-memory.dmp

Download

memory/3352-18-0x0000000074B60000-0x000000007531C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads