0742be451e703b80d9d19e1216c0cd806541c2c88c17f885d4dbb0e1df729cfb

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_506af3532b2ef2a2e303d600223b0896_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Size 3.7MB
Sample260424-l4chaaft8j
SHA256 0742be451e703b80d9d19e1216c0cd806541c2c88c17f885d4dbb0e1df729cfb
MD5 506af3532b2ef2a2e303d600223b0896
SHA1 f40b43183460cde93ba6076a7e3ac7e992b714e6
SHA512 0ccf1e109b0ebd720851427e8de68ac58dd58e85807c254b471452a3d54883ea505f31d54e7029bde57414ecacc8be8835b32a451aa08d2ee8c4688697608bd5
SSDEEP 49152:M2znMyu08YMih7EQtzO5kJkGYYZTk+T1iH7efPmZzk/Eq6:Miu08YFZhUM6efPm+/q
TLSH
T1E606CF4AFBC6A677D47E067584652314B7B0F4854B22C7AB6AD0BB3D1C323D06E293C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
6	4232	dfsvc.exe
6	4232	dfsvc.exe
6	4232	dfsvc.exe
6	4232	dfsvc.exe
6	4232	dfsvc.exe
6	4232	dfsvc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\ZTM40CZV.0CY\4AA5G6Y7.JTK\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_506af3532b2ef2a2e303d600223b0896_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_none_0b03d694d1d8b740\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0001_none_37ead1580b9e8b2e	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947ec9e5e\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede132	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_83be8a85a3721b60\scre...exe_0000000000000000_001a.0001_none_5d7e288cd2 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3b\Files\ScreenConnect.WindowsClient.exe_6492277df2 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947ec9e5e\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3b\implication!scre..tion_0000000000000000_001a.0001_83b = 68747470733a2f2f68756e746c6569676874672e686f73746564726d6d2e636f6d3a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0001_576a900633d8965d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3b\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0001_none_37ead1580b9e8b2e\DigestValue = 1cfd27a493904264060590e77126092915d043f4	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee99\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0001_none_37ead1580b9e8b2e\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9443	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947ec9e5e	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 680074007400700073003a002f002f00680075006e0074006c006500690067006800740067002e0068006f00730074006500640072006d006d002e0063006f006d003a0038003000340030002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e003f0065003d0053007500700070006f0072007400260079003d0047007500650073007400260068003d00680075006e0074006c006500690067006800740067002e0068006f00730074006500640072006d006d002e0063006f006d00260070003d003800300034003100260073003d00610062006500340061006400650034002d0036003100650062002d0034003800630033002d0038006100370062002d0065003600640036003700640033003900610033003100380026006b003d0042006700490041004100410043006b0041004100420053005500300045007800410041006700410041004100450041004100510043004c006600380065007a00560054007500440065004500680057006d0058006e004b0067004b003500610048004d004700350064004d0042004e002500320066004e004800540030006b006e005800370078007300670044004b0054007500570033004900660079004800480055007000500075005a006b005600390064004b00640054007a004500750066004a006a004c0062003100510050006800640072004e006a0065005a006d0041003700450050007800420078006500560079006e0073006b00750068005600700034004b006e00500055006900340042006700450036006d0059003800790065004900340059006200380036006b005a00390068002500320066006900390036002500320066004100760068004c00750046007900760055005100480075005700330037006b0039005000250032006200530049007400740025003200660066004b00660072004a00710050006700560077006f007200680074006c00670078007900480053005a0030006800650025003200620044006a006c00300047006600640076005400410077004d00630067003100500062006800480041006b006d004d00760034006200730054003600690073007a006600700030003400320052006500500054006500790038003700720069004600500059006e00510066006800250032006200460071004d006500540070006900690056005800650061004c0063005a0043006b0071004a006a004a006100510037006f007800720050003800550052005a0077004900680025003200660067006a0066003400790057004100700070003000580039006600640037006600300067006a006f00770041006700560033004b00360050006800340066003400490025003200660067004f0038004700730078004c004500440069007a002500320066004a00390034007300670073006d004c004b007100430046007700770075006d0079006d006c003200620025003200660032005700260072003d00260069003d0055006e007400690074006c0065006400250032003000530065007300730069006f006e000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9443\Files\ScreenConnect.ClientService.exe_e781b1ee36 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_576a900633d8965d\scre..core_420d02d3849b7992_001a.0001_none_37ead1580b	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede132	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee99\lock!10000000dc20590e881000003c0600000000000000000000 = 30303030313038382c30316463643366613433333965356538	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0001_none_37ead1580b9e8b2e\lock!0e000000dc20590e881000003c0600000000000000000000 = 30303030313038382c30316463643366613433333965356538	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_00000000000000 = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d002200680074007400700073003a002f002f00680075006e0074006c006500690067006800740067002e0068006f00730074006500640072006d006d002e0063006f006d003a0038003000340030002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320036002e0031002e00320035002e0039003500390033002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320036002e0031002e00320035002e0039003500390033002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e00530065007400200063006c006100730073003d002200530079007300740065006d002e00530065006300750072006900740079002e005000650072006d0069007300730069006f006e0053006500740022000d000a00760065007200730069006f006e003d002200310022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d00220028006800740074007000730029003a002f002f00680075006e0074006c006500690067006800740067005c002e0068006f00730074006500640072006d006d005c002e0063006f006d003a0038003000340030002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300030003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 32003000320036002f00300034002f00320034002000310034003a00350034003a00330038000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9443\Files\ScreenConnect.WindowsFileManager.exe.confi = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947ec9e5e\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0001_576a900633d8965d\identity = 68747470733a2f2f68756e746c6569676874672e686f73746564726d6d2e636f6d3a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "AG2ARX271C4G6LBN5KBO6J99"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947ec9e5e\implication!scre..tion_0000000000000000_001a.0001_83b = 68747470733a2f2f68756e746c6569676874672e686f73746564726d6d2e636f6d3a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede132\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_4e3d0764c1a3ee1e	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_576a900633d8965d\scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947ec9e5e\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee99\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_576a900633d8965d\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a1 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 68747470733a2f2f68756e746c6569676874672e686f73746564726d6d2e636f6d3a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede132\implication!scre..tion_0000000000000000_001a.0001_83b = 68747470733a2f2f68756e746c6569676874672e686f73746564726d6d2e636f6d3a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "TLXNDR7KBG0LGQKLZEVZN6BE"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3b	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3b\lock!0c000000dc20590e881000003c0600000000000000000000 = 30303030313038382c30316463643366613433333965356538	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_00000000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee99	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee99\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0001_576a900633d8965d\PreparedForExecution = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_576a900633d8965d\SubstructureCreated = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9443\Files\ScreenConnect.WindowsBackstageShell.exe_89 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_576a900633d8965d\scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede132\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0001_576a900633d8965d\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a1	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0001_576a900633d8965d\appid = 68747470733a2f2f68756e746c6569676874672e686f73746564726d6d2e636f6d3a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e312e32352e393539332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0001_none_37ead1580b9e8b2e\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee99\DigestValue = 38455760b278e0e71c178f0baf8188ceaeaf4644	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\ZTM40CZV.0CY\4AA5G6Y7.JTK\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\TLXNDR7K.BG0\LGQKLZEV.ZN6\scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3b\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1916	2026-04-24_506af3532b2ef2a2e303d600223b0896_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Token: SeDebugPrivilege	4232	dfsvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 4232	1916	2026-04-24_506af3532b2ef2a2e303d600223b0896_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-24_506af3532b2ef2a2e303d600223b0896_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_506af3532b2ef2a2e303d600223b0896_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9443.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\TLXNDR7K.BG0\LGQKLZEV.ZN6\manifests\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9443.cdf-ms
Size 14KB
SHA256 d248dec0709e9629291ea62faefbc58c7e15b1b911267081169a47a7a06201f2
MD5 61e62250a35ddf73f9af8735d023ef15
SHA1 5064e7038f4c1918b67082cbcffb4fe289cfe244
SHA512 c4b48ab3a3a40f604062fa96aadeb8f598ca65ba950b311e31e37936b9dafed7916dfc8dcfa06e195eef0d8f3ebff7e6f7a31b2e8be004caa0eae84db6da7fc0
SSDEEP 192:R3lfwHfSB0FKGivo8fZd2P9BL4mTC/6+9t3OwJ2yu/H9LhpKbvl0Nq65W16iN4:ReK0kGioM8bte/lsivuWciN4
TLSH
T1F062E521F704F433E2629B739CB6EBC167247EA65DA6118B7084373D883119ACF762D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0001_none_37ead1580b9e8b2e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\TLXNDR7K.BG0\LGQKLZEV.ZN6\manifests\scre..core_420d02d3849b7992_001a.0001_none_37ead1580b9e8b2e.cdf-ms
Size 3KB
SHA256 4ca920809c0bd544d36b603b4d6bd56fc03a3e27ed8100f0d119f3c13169e3ac
MD5 13e83bec8ed3ef97cf1afc0375ac9e5a
SHA1 bd466f1a034f5eb715585260336a2fd964de4765
SHA512 a0b9e9df19353abaefc3589267df24ed64d5b64253fa0f4878b983317e3d57d4c2669bd48f40595eacb0fbddc91c1d00d905846c8fd1ac95b2021113ecd4365f
TLSH
T104611F017204DA57E5690732ACE2C6EE67743E53DE45510FB0C47F2F7A326F25212295
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947ec9e5e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\TLXNDR7K.BG0\LGQKLZEV.ZN6\manifests\scre..dows_420d02d3849b7992_001a.0001_none_3c62a93947ec9e5e.cdf-ms
Size 5KB
SHA256 410d9ba2ada87004abc8b5445218ea9c7df6d5e8e450e2d2ffe357d3a1fbb2f5
MD5 2e1efdbb67a47db6380e8010208f24bb
SHA1 8cc9d73133d2ea008769989c2b9381d2c11a3046
SHA512 5259e3ffafd15e0b0cd9fa2eabec0e087acd8309f601d9222d66734a6d2984e38e19bf4809c89276b2c138eaa952e51de683e2332448ef9d802226e8bdd7f2ca
SSDEEP 96:bvA+RxU9LHeV+Ww7WI8Or2WAXezoZkv4pgiqP9O:zRxUNgJ+8lF6GgO
TLSH
T1C9B14301B290DE57D5B90633ACD6D3ED3A367E82DE43030B70D8BB1F7A326D64222195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3b.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\TLXNDR7K.BG0\LGQKLZEV.ZN6\manifests\scre..ient_420d02d3849b7992_001a.0001_none_9931aa7bf4826e3b.cdf-ms
Size 6KB
SHA256 16e7184211d5dd4a350c01f8330f6bd6efacf586a742acceb3686b7d2e5fb0c4
MD5 28611636b275836cacb3e34227db2a9d
SHA1 c27d4f7c0f29b5dab52a5e423cc6d51ac0e3bbc8
SHA512 47b50d9878d33a3153ddc8e52178098fd160027593588a5a7876ba1322a6ceeee35a54aa067f024c46e2824c947a7bbf44bd2c6d976a0991812117f26c9a78c6
SSDEEP 96:hd1NaunTu5VeV+WwwE867udZGTpeUU2/YYhzfecu6qSw4Fd:TLaunTusJw7oGTd7jV
TLSH
T183E1DD11B340DE43E1795633ACA6D3ED3B687E97DE43460B71C0BB2F76321A65A12191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede132.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\TLXNDR7K.BG0\LGQKLZEV.ZN6\manifests\scre..ient_420d02d3849b7992_001a.0001_none_ce002f2a1aede132.cdf-ms
Size 2KB
SHA256 0708857686b25c218452860482a10d8219c943a43832b46ca1343151e3bffb7d
MD5 cd321c56d0e10d35456b60b6501bb421
SHA1 ae2ba68f778a52bd0067f77dca2cba797537710c
SHA512 c2b6102bae16d75bd4fde71ca6ecda265074fb05686fe9d36e8c83675258604decfec2909046eba3695f20244df7667381864d92b663b1b91ddfd6b4c676a63a
TLSH
T1DC51AB057684EAA7E67A0233ECD2D3DD32357E82DF17030BB190BB6F3A316C55612092
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0001_none_0b03d694d1d8b740.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\TLXNDR7K.BG0\LGQKLZEV.ZN6\manifests\scre..tion_0000000000000000_001a.0001_none_0b03d694d1d8b740.cdf-ms
Size 4KB
SHA256 9aea4792b2a313df3ca612533174bfb3d4d9d971cdb5d4916f5ae9d0573e96d9
MD5 0bbcf5b9cade75beff10318571a39955
SHA1 1be5764012dfc1d5323ed9ef7435fbff063096ba
SHA512 f54593ecb6f3f255cfbb7f7651959b8a3f2ae933fea2c94810478f4196bc3c746a493bfa3e939e516f717bcf6f53aa02ecdac003c0b6ce835f96dc63989c1ee2
SSDEEP 48:2P/mrIEZAjIvMtrgyRu9o0m5RD7gU7gFUTUEjkKXt4sQgbmZFms4Ch+UQRcT:UOUrGMfEW0m5R/gUm4kAQPfmvVUQR2
TLSH
T18F915280B780E923D61447339CE3D2D432357DE60FDA571B30987B2FAD363C59622266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee99.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\TLXNDR7K.BG0\LGQKLZEV.ZN6\manifests\scre..vice_420d02d3849b7992_001a.0001_none_e93e69a0a15dee99.cdf-ms
Size 4KB
SHA256 9485ba35c5288bb11a5e923ef257ef72bf480e31a0d22ba150d12b26f5412c11
MD5 7e4e2001637b4524bdb3c5a4efc3e793
SHA1 fe02bab8479baee992511994757b5753b11f432f
SHA512 80125a006aea155bd5ee1d42216cbd15cb7a954ebb01b7190245a8e336b07dfcc4c381bbe1b1a32dd8afd7a311e216feed1ad86c50b79dbb0651974503b94a23
SSDEEP 96:CfQYSOleV+Ww8E4cbNWV02Tjevo1rQpJDKuQiV:CmJ2hyhCdV
TLSH
T1CDA17B017290EDA7D56906339C91C3DD3A32BD82DE53534BB1C47F2F76326CA6722295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\TLXNDR7K.BG0\LGQKLZEV.ZN6\scre...exe_0000000000000000_001a.0001_none_5d7e288cd21d9443\ScreenConnect.ClientService.exe
Size 93KB
SHA256 552c661487939e89c8dd64a1744d7bc19629ed20a8439d66d416b31a3fc35bfb
MD5 53a1ecc118f3779ce87f45a35e645397
SHA1 8ddf93fdb37800f63cf28e269d9eaf6093bfb0ae
SHA512 9a3d4a1b4f46679c1761510e22a3f5bf4ce30783047a6200567facbb60df6bc66c3c97316a71aefff665561724c1be5cb2e667448d78948398252b294a4b1078
SSDEEP 1536:ug1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgkT0HM37T1j:/hbNDxZGXfdHrX7rAc6myJkgkT0H+l
TLSH
T133935B13B5C28872D473093158E1DAB09A3FF9615E61DEAB3788022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\TLXNDR7K.BG0\LGQKLZEV.ZN6\scre..tion_0000000000000000_001a.0001_576a900633d8965d\ScreenConnect.WindowsClient.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

K5AHB1AX.5GW.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6MKT6E91.QLJ\K5AHB1AX.5GW.application
Size 118KB
SHA256 2ef8de9aa2d5fa04243ddc1045ab1b3b5f9a891f901ca1cd194387655a1b8990
MD5 b6e1b34e957aabf68b2cd99cf5381887
SHA1 020c55746da05790a5af23ef03580b18c96a642b
SHA512 9119a3da1bd366bc21b3e73d2658eec17b3697bbc8878254c1419fdc6b70565beae3de13c71980ea8f86cb89b9624e6d488b4639baf3a7d1c3a51f376931dd5a
SSDEEP 1536:w/iBHhe2WCRSmQfn4/5EHSZ5GE/uLTvooycu3ceCtcceCtyKQ/IuKE:w/YHhlWCRbW22XOcu3xIcxIyX1
TLSH
T151C3A53ACE34F4C0477D7021D0A52D673D812B939B731BBCD90A186B0E69796EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZTM40CZV.0CY\4AA5G6Y7.JTK\ScreenConnect.Client.dll
Size 633KB
SHA256 1a484431de9b806dcbe40472affa54ca47588eab29a4ba997980b79eaccc0eed
MD5 40f8bba54fb085e25bb31cdac0ba2e26
SHA1 87faa7b88b6256a0ad055ad7cfa8b23b20236619
SHA512 3e231f55fa145a6000474f4036766ebd01336f55bdcd98cec93671c530643926424d5480ea21330427541c596a459fb66dc9ecfe5515397c53caed10b2a0839b
SSDEEP 12288:ye8IOB7VTzIn/nuxbc4zHTEavSW7OQnin1fJIE:ybjB7knuumzEn8qnFJIE
TLSH
T199D4CF4EAB28BA1ADD6E0B33E1D13224EAF06C9A9957D31F0D64B77C0D76380768D1C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZTM40CZV.0CY\4AA5G6Y7.JTK\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 59a93b012d20a6cd44019a922f71a7dd8bc4b74e989d2d13cb27656201ea8bfb
MD5 c24784cf3a8454ffb9c6c002f6d47dd9
SHA1 2b8c9def3a1830717bc732898e9724cada606d1d
SHA512 b59493947d4a364b0f857eb11d6864d835146f0f5702c4d04d2851e47a33ccf869d8d85c0ba1f91fa7b6e8e1219afa6eb63b1d9bb67f1c8228250016afc476ad
TLSH
T1EA11290191C4FA362F3342D1BEE7E461A76E5B23148E194BB069685F8B29AD687470B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZTM40CZV.0CY\4AA5G6Y7.JTK\ScreenConnect.ClientService.dll
Size 187KB
SHA256 015a7d385d2c684672db22163da6266da8ffbe67280b96c26354da07d90b2181
MD5 10ff5aea35cc0d7e8ae9abc3ac6e524c
SHA1 38455760b278e0e71c178f0baf8188ceaeaf4644
SHA512 c04a6c67d33d08150e013c412487fcddaa1b243958322562e373fe15d79daecca5620f3415897ae0b4206036f68bca94bab7bb1dfcd285a3fdcc20f1a6f6d453
SSDEEP 3072:fo5R8L2tipvOxzwD3VyEU/oucQFV2vUH2sC7:fv2tJdoBUHa
TLSH
T14014AF49F75D9926C59E0E36E451B31042F1B453C9EAD38BAC9C62EE1E467C02B983CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZTM40CZV.0CY\4AA5G6Y7.JTK\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 47c0ba8139e9488d3b2252585b54c5cc627722e38d51718122135f54ffd77455
MD5 f99a2f49bdf125a4b68e105c2e0e8011
SHA1 f3dca3348faa711e3a7a1131bf7751a7a259f404
SHA512 747d23ff8930e823e0106521d71cb560b87201728f9a102c0015735659f7a06d64e4a0edba05eff86efe7c223b8306d5db4da077098d0220982f4fb73d46e07c
TLSH
T16C31F60191C4FB351F3302C1BDE7E4609B9E5722158E290BB059695FCF2DA97834B073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZTM40CZV.0CY\4AA5G6Y7.JTK\ScreenConnect.Core.dll
Size 1.3MB
SHA256 06a4b390c7a452610ca49895a4fa8336ec6fd143d25b0d6274f732f53e80cf65
MD5 e3e39a4145d386ce89827b8227c2ed21
SHA1 1cfd27a493904264060590e77126092915d043f4
SHA512 0b9c25eab8ebc837b24638a2e554923e33a7b41c45ce4dbc26d86b36ab431181e4ec236327e69c47d7821ba929e69fd6b0c8a30a91c0956e47102f50292d79b6
SSDEEP 24576:k7aY+sosxyPm0eQzSYirquhr9+GALHzUpI9q07tCQHNzuVjN:k2znMyu08YMih7EQtza
TLSH
T1BC559E8E7FD5E727CAAD167694A02304A7B0D0D25F23E75B29A0A7BD4C453E87D881CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZTM40CZV.0CY\4AA5G6Y7.JTK\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 9fbd22d5224ed19cae58b921bffd29b9ccc0d42e4f5cb49ebbc6d60964b53b9c
MD5 99d60c0933fbfc8bb21fa795389737f5
SHA1 31caa201e773de0b9aea48986de34cb0e50a6098
SHA512 175e16c1e8501d6dce4763cb797735a520e4cc25466e303281be684d989d5334a600705f5b39c5edf0a74c094d28cbff60cc16586b4158593ce3cbd4529c2859
TLSH
T16E216A0181C8FB261F3302D2BDE7E42197AE5733148D194B7069685FCB1DAD24747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZTM40CZV.0CY\4AA5G6Y7.JTK\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 e7d2516b567af5d172749cb67ed06b65b0f6a1b4da9401bdf0230d92037582e6
MD5 40a9ff09a215ed5f77c695d239d2a811
SHA1 29ecfef397b5f7be80680a7e0e1b8e3e30acdacb
SHA512 4dfc872aaff7d6c6658a1d4bd34f2e2b481a4d285c8bfef532937024579777f1f03b18713093396030755e5b09cca203b34e878dbdc20483967cbee315d53d12
SSDEEP 24576:Zg1mSVTkFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKPL:W5kJkGYYZTk+T1iH7efPmZp
TLSH
T1A295AD41E6C364F6D47B057888BE632AA6743C040355CBFB97D0AE396D337C0AA3A795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZTM40CZV.0CY\4AA5G6Y7.JTK\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 7fb442dc7f3a39a71789f8827a4a10f6879ddad2357901f1b3f04438921e0501
MD5 a220886e12fb68a252bd200d8a52df8e
SHA1 7a0f66e3fc693a98780c5dc575bfa0a3b6fb9098
SHA512 847cfa71c81caf69669f6bbf6525dcd11cadd3fd2a825c8473529966f654b98ec10a65a55e0555e85d3d2b725504ab5e6ca28e97e6e60deaa7fb7cb33716e32d
TLSH
T1CC41F11181C8FA251F3302C2BEEBE431979E5723158E190B70A9AD8BCF29AD78747027
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZTM40CZV.0CY\4AA5G6Y7.JTK\ScreenConnect.WindowsBackstageShell.exe
Size 132KB
SHA256 0738fdec3949138061fb7d4f2afbd35d3eedbeb96803d2a4aea268471e0aa230
MD5 0001b08f86f30b6c73b600d8d2072318
SHA1 108c4932132ce74cc577866b57636afc02c45a4b
SHA512 c2a35c898dd4d299dda7fda93ab4c6041e59e750a67f61ab6c0e1595368f5c42003c0b32880cb3538a26ecd742760423a75aa85ebc719bf1f34abf86b37d14c7
SSDEEP 1536:Md8w1LPnv5EFbovhvskqcqC+GZos9pA+gZilTY3vxpDqfiKmM7H+TCWGc3EJfqMQ:Md8Qx+LkqcqCJZ/HTYGfiKgd3ey/R
TLSH
T1C0D39D817B99D522C5EE0E3BA4E2F21046F1F093CAD3C74B6C94127D7E18BD16E992C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZTM40CZV.0CY\4AA5G6Y7.JTK\ScreenConnect.WindowsClient.exe
Size 1.5MB
SHA256 6bb41965e03a8f8c9d446f069545aa3d88b90c0082564611e5d476fc908dacd8
MD5 01d9500c6332b2abd0eb9f1f6e75ec18
SHA1 41efe92c4c5e7e4e6624a6d090a47564f8e1a662
SHA512 732f778e7b3b86cc0ed49377c22136c803c94e1d13b18e1c068e3895758b50490db500a918e9d21ce1c87eec28dd19c1624d604b1478640379c80721c24ae023
SSDEEP 24576:2e/vLaXyCPMtMft9Zs1LmOZRcUx89AYYvrqd7fFeW5zca:2e/vOXyCodZH8TQCDPX
TLSH
T13B75AD297E85EE3BC95F0B7790652204B3F094918B3BDB472854B7BE2D853C46D48ACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZTM40CZV.0CY\4AA5G6Y7.JTK\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZTM40CZV.0CY\4AA5G6Y7.JTK\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 433f3d4000a80cbf4c44622e741d4c605cb1507c02c16c42b917c711b6aecdaf
MD5 95a63a1a452e5471143d88336568f915
SHA1 84a5de8055620ecc17707c08566bfba42352ae2e
SHA512 0bd34bbf086e9b3e52fc953c5914acaf669246792cf9631bd5862bfbd3e3fc1b6a88e01bae594dbb1d219769b329a2ce28d6b98078f72245de4c9289991d9f76
TLSH
T12A51D21191C4FB251F3302C2BEEBE4709B9E5B23158E190B7099A98FCF2DA97474B027
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZTM40CZV.0CY\4AA5G6Y7.JTK\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 65289faaae4c47f9544d0e0c49b40f5ae4058e206036f97e6bf4ffbfb8442ec5
MD5 acd868201fab5b41dbf8f1ddb622aa47
SHA1 327a28a2f95a33877d49d084d7d753bff2812833
SHA512 5acaa177dd91a1b440be2cc8995854ff9e9bdd6e1f372eac09267f3043c70efdf098d8279a51c9d1dac6cfdd3d4e100d3d100507c16da9eb481bd1eb80195a74
SSDEEP 96:xWLwOhoyTzde2wvyHkHqkyAkdkT6GZYkdqkTRkz4kOpQkOp0ykCAkOpD:oRpeZHjyV+TLZd1T6z9UFU07CVUD
TLSH
T1B9F1BE9688C07D21573381C0FEE39914FD15BF23026E148EBC5D19AF9FA25899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZTM40CZV.0CY\4AA5G6Y7.JTK\ScreenConnect.WindowsFileManager.exe
Size 116KB
SHA256 20babd5227e07ba62518698c334a787ba5459554d56dc56acfd4d0c50b7f7f35
MD5 dba42593e7fac1d884868782584df6b9
SHA1 5234d700fdbe34e649daea3211500bc5fa9c3efc
SHA512 9ca3041a6db172bab1312e00428504db894f8ca11628f8fbd38173121708ae642096cc512caad765b050c8b2eb0e1b84541234c828a0b99a9ee298e674a45c81
SSDEEP 1536:3jDEyOsGO1QDHFHSolRU8WhUcXoO87jI5BLP+VVVVVVVVVVVVVVVVVVVVVVVVVS1:3jY0GO1Io0zcXyjuBLNLtf
TLSH
T1F8C3294135266231DE95C5339452EAB059337F6607FEC6BE3CA1BA3A29F03903E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1916-3-0x0000000002A90000-0x0000000002AA0000-memory.dmp

Download

memory/1916-9-0x0000000002A90000-0x0000000002AA0000-memory.dmp

Download

memory/1916-1-0x0000000000F90000-0x0000000000F98000-memory.dmp

Download

memory/1916-2-0x0000000002A90000-0x0000000002AA0000-memory.dmp

Download

memory/1916-4-0x0000000001160000-0x0000000001170000-memory.dmp

Download

memory/1916-5-0x0000000005290000-0x00000000053E0000-memory.dmp

Download

memory/1916-6-0x00000000055E0000-0x0000000005658000-memory.dmp

Download

memory/1916-12-0x0000000002A90000-0x0000000002AA0000-memory.dmp

Download

memory/1916-0-0x0000000002A90000-0x0000000002AA0000-memory.dmp

Download

memory/1916-7-0x0000000005E70000-0x0000000006416000-memory.dmp

Download

memory/1916-8-0x00000000059A0000-0x0000000005A32000-memory.dmp

Download

memory/1916-11-0x0000000005C30000-0x0000000005E14000-memory.dmp

Download

memory/1916-10-0x0000000002A90000-0x0000000002AA0000-memory.dmp

Download

memory/4232-15-0x00000182D2100000-0x00000182D2110000-memory.dmp

Download

memory/4232-26-0x00000182D5090000-0x00000182D50E0000-memory.dmp

Download

memory/4232-36-0x00000182D5CE0000-0x00000182D5E6A000-memory.dmp

Download

memory/4232-17-0x00000182D2100000-0x00000182D2110000-memory.dmp

Download

memory/4232-48-0x00000182D5A70000-0x00000182D5B12000-memory.dmp

Download

memory/4232-13-0x00000182B7AD0000-0x00000182B7AD8000-memory.dmp

Download

memory/4232-54-0x00000182D5DA0000-0x00000182D5F84000-memory.dmp

Download

memory/4232-42-0x00000182D5C60000-0x00000182D5DB0000-memory.dmp

Download

memory/4232-14-0x00000182D2150000-0x00000182D22D8000-memory.dmp

Download

memory/4232-60-0x00000182D5180000-0x00000182D51B2000-memory.dmp

Download

memory/4232-328-0x00000182D2100000-0x00000182D2110000-memory.dmp

Download

memory/4232-329-0x00000182B7EF0000-0x00000182B7EFC000-memory.dmp

Download

memory/4232-332-0x00000182D2100000-0x00000182D2110000-memory.dmp

Download

memory/4232-331-0x00000182D2400000-0x00000182D2412000-memory.dmp

Download

memory/4232-330-0x00000182D2440000-0x00000182D255E000-memory.dmp

Download

memory/4232-344-0x00000182D2440000-0x00000182D255E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads