3e43c01eec0eb69c87091791a638320256d4d34cc2fa60c76ce7dd9493cce73b

Analysis

max time kernel
149s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/04/2026, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-26_45420c05ea7571fed382ac10a407ded5_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Size 2.5MB
Sample260426-melv4ady5w
SHA256 3e43c01eec0eb69c87091791a638320256d4d34cc2fa60c76ce7dd9493cce73b
MD5 45420c05ea7571fed382ac10a407ded5
SHA1 c6f066c95bfa6f1b5a80bf1542aae6bfe4c9abe1
SHA512 15f2ef996c1850fc63c386ca4520700b2703a80068edc3f9af65a58945f21e7cdedebd9f974381ac1599f23ffd2b8b756111b0fc8cd405658f62c5fce00aa932
SSDEEP 24576:EDdYu7wYAQepUML1/VFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krs:h/VJkGYYpT0+TFiH7efPIy+
TLSH
T1AAC5BD01F3C666F6C4AF0578947A531AA671FC0503A1DBFB6694AA792D333C08E317A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 7 IoCs

flow	pid	Process
3	1876	dfsvc.exe
3	1876	dfsvc.exe
3	1876	dfsvc.exe
3	1876	dfsvc.exe
3	1876	dfsvc.exe
3	1876	dfsvc.exe
3	1876	dfsvc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\NYR3HRT1.O6R\3KLGGW1R.37B\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-26_45420c05ea7571fed382ac10a407ded5_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049\DigestValue = 5d4cdf6d1b1c625770877bc03c75c36a7c65afe3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_cdfe2ea81af6e381\lock!0e0000002647580e54070000f4130000000000000000000 = 30303030303735342c30316463643536366162383136313532	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_992fa9f9f48b708a\lock!080000002647580e54070000f4130000000000000000000 = 30303030303735342c30316463643536366162383136313532	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_27fa83f1ad328157_9810e5f114c89c90	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_27fa83f1ad328 = 68747470733a2f2f616d657269636f6d2d69742e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32342e393537392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0001_d62d1846079f66a0\appid = 68747470733a2f2f616d657269636f6d2d69742e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32342e393537392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e312e32342e393537392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0001_none_37e8d0d60ba78d7d\Files\ScreenConnect.Core.dll_b96889d378047e27 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_cdfe2ea81af6e381\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_992fa9f9f48b708a	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "1RNE9W1BR3XEA6CD5L874H3R"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad328 = 68747470733a2f2f616d657269636f6d2d69742e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32342e393537392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e312e32342e393537392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_cdfe2ea81af6e381\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32362e312e32342e393537392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049\Files\ScreenConnect.WindowsBackstageShell.exe.c = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_cdfe2ea81af6e381\SizeOfStronglyNamedComponent = 217e060000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0001_none_37e8d0d60ba78d7d\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32362e312e32342e393537392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0001_none_e93c691ea166f0e8\Files\ScreenConnect.ClientService.dll_e781b1c63 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0001_f235bf3d1f494509\pin!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0001_none_7ee8d7c6849dddd0	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "VPE079DMLVXT2B9E2A9JVNG5"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad328 = 460061006c00730065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049\Files\ScreenConnect.WindowsFileManager.exe_0e21 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_cdfe2ea81af6e381\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_cdfe2ea81af6e381\Files\ScreenConnect.Client.dll_fc1d7bd48553fcab = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0001_none_3c60a8b747f5a0ad\Files\ScreenConnect.Windows.dll_fc0d83aff7df0b5 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0001_none_e93c691ea166f0e8\SizeOfStronglyNamedComponent = 4f82010000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0001_none_e93c691ea166f0e8\implication!scre..tion_27fa83f1ad328157_001a.0001_f2 = 68747470733a2f2f616d657269636f6d2d69742e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e312e32342e393537392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049\Files\ScreenConnect.WindowsBackstageShell.exe_8 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_992fa9f9f48b708a\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0001_none_e93c691ea166f0e8\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32362e312e32342e393537392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0001_none_37e8d0d60ba78d7d\lock!0a0000002647580e54070000f4130000000000000000000 = 30303030303735342c30316463643536366162383136313532	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0001_none_7ee8d7c6849dddd0\lock!040000002647580e54070000f4130000000000000000000 = 30303030303735342c30316463643536366162383136313532	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0001_none_cdfe2ea81af6e381	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_992fa9f9f48b708a\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32362e312e32342e393537392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0001_none_e93c691ea166f0e8\DigestValue = a41ffb64a859ff3bd32589ce58ac03a84c0b1955	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0001_none_3c60a8b747f5a0ad\lock!100000002647580e54070000f4130000000000000000000 = 30303030303735342c30316463643536366162383136313532	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e312e32342e393537392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0001_none_37e8d0d60ba78d7d\SizeOfStronglyNamedComponent = 7404090000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0001_none_e93c691ea166f0e8\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_27fa83f1ad328157_001a.0001_d62d1846079f66a0\PreparedForExecution = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0001_d62d1846079f66a0\lock!110000004547580e54070000f41300000000000000000000fdce = 30303030303735342c30316463643536366162383136313532	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049\SizeOfStronglyNamedComponent = 0ae9040000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049\Files\ScreenConnect.WindowsFileManager.exe.conf = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0001_d62d1846079f66a0\scre..ient_420d02d3849b7992_001a.0001_none_992fa9f9f = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0001_none_37e8d0d60ba78d7d\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049\lock!060000002647580e54070000f4130000000000000000000 = 30303030303735342c30316463643536366162383136313532	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0001_d62d1846079f66a0\SubstructureCreated = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_27fa83f1ad328 = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d002200680074007400700073003a002f002f0061006d0065007200690063006f006d002d00690074002e00730063007200650065006e0063006f006e006e006500630074002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320036002e0031002e00320034002e0039003500370039002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003700660061003800330066003100610064003300320038003100350037002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320036002e0031002e00320034002e0039003500370039002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003700660061003800330066003100610064003300320038003100350037002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e00530065007400200063006c006100730073003d002200530079007300740065006d002e00530065006300750072006900740079002e005000650072006d0069007300730069006f006e0053006500740022000d000a00760065007200730069006f006e003d002200310022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d00220028006800740074007000730029003a002f002f0061006d0065007200690063006f006d005c002d00690074005c002e00730063007200650065006e0063006f006e006e006500630074005c002e0063006f006d002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300030003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049\lock!010000002c46580e54070000f4130000000000000000000 = 30303030303735342c30316463643536366162383136313532	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0001_none_992fa9f9f48b708a\DigestValue = 859fd0edba414551a48d598141a58fabbb343715	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\NYR3HRT1.O6R\3KLGGW1R.37B\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\VPE079DM.LVX\T2B9E2A9.JVN\scre..ient_420d02d3849b7992_001a.0001_none_992fa9f9f48b708a\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4412	2026-04-26_45420c05ea7571fed382ac10a407ded5_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Token: SeDebugPrivilege	1876	dfsvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 1876	4412	2026-04-26_45420c05ea7571fed382ac10a407ded5_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-26_45420c05ea7571fed382ac10a407ded5_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-26_45420c05ea7571fed382ac10a407ded5_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  PID:1876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\VPE079DM.LVX\T2B9E2A9.JVN\manifests\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049.cdf-ms
Size 32KB
SHA256 3120da3403fe96c4e39ee62f5cd07ef5772a9ae51ccf91e3fa39fa3cfe5d3c4f
MD5 b2aa3353ed62abf83b83aefdaf918229
SHA1 94663b102025c1c144dddca4ec2aab4fbb11a683
SHA512 508c9fc0f32d854864b815c02b07de5259339d3ebaf8b866e7c139bc9b446678556d00953a0c02d397424385a83c913803987ced5d113a846634a758d5712713
SSDEEP 768:7HPEaZ9UTPL10efgP2am6Yc2bS4VRUPTjC:bXeXicPLfvWLjC
TLSH
T1BBE2085EB686E5B3D2611A31ECF6F63C22547C62CFB1207B3440372DBB35A995E21389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0001_none_37e8d0d60ba78d7d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\VPE079DM.LVX\T2B9E2A9.JVN\manifests\scre..core_420d02d3849b7992_001a.0001_none_37e8d0d60ba78d7d.cdf-ms
Size 3KB
SHA256 b697a512a96e0661ab212c29c3ae39d8b96c2a3be14f1166e35c74667c1db5c5
MD5 cbabe75028ce33c883131cdf086277c1
SHA1 5863e083e4fd98e9b4c32f4e557146c6b34b85b5
SHA512 095ac1eec1956ceee403e8e6155d88b3bddcfd1afb7673c98ec98352179e78626fe7cb4ab3387234b897aa2217ba77e4b7086ce53105739c28a5c27f7e38c6e2
TLSH
T1C96186827284DA13D56A0233ACE1D2EE37797E83DE43530B74C0BB2F7A325A55611295
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0001_none_3c60a8b747f5a0ad.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\VPE079DM.LVX\T2B9E2A9.JVN\manifests\scre..dows_420d02d3849b7992_001a.0001_none_3c60a8b747f5a0ad.cdf-ms
Size 5KB
SHA256 bd5ec22f3b956d777547711d5f9bc49aefd51504c20b03a7006bc329d084c280
MD5 101b066fb13f2cd60f6eb7b9cf832879
SHA1 f4b0bd6195b2a129b1a5db115364e6358cfe2073
SHA512 cb53c5f99fee454e203c47e4cbc6f196f84ef6d6566ebbf1163fbf1a6e7930a1305bfe4e03fd617718fefef9418cfb9e50eb47b4e96692c615771fbb81be88ca
SSDEEP 96:a3A+RxU9LqeV+Ww7bIv3xiMS4n/35YDR4gnPseO:2RxUNlJJ/xi54/QbO
TLSH
T1E0B1CB12B244DE13D5B90633ACE6C3EE2B697D42DE03520B71C8BF1F7A326E65221199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0001_none_992fa9f9f48b708a.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\VPE079DM.LVX\T2B9E2A9.JVN\manifests\scre..ient_420d02d3849b7992_001a.0001_none_992fa9f9f48b708a.cdf-ms
Size 6KB
SHA256 2b846aac46f55d37442d7ca78984f58c4b4f2380f9728617641e3f566ef8931b
MD5 add04a02c4ad8b4ae79bd193cef1faf2
SHA1 57bf177d7918a0662523d3e246d129dfd3918020
SHA512 f34699c1a56151925fb79d7fce5352a8c077f99374232887d08b9d7b9f3f4fe43ccd9dfdbaaa02b03162ef2cfeb566271cc9d0d81eb813c49939566d7217021c
SSDEEP 96:+l1vFaunTq5ceV+Www786GWicsOAJaKgeG7E1C2gYn0UFIkW0V6qITl1t:ILaunTq9JjGhoptk4fT
TLSH
T1E7E16A017785ED13D17C0633AC9AD3ED2765BE86DE43070B71C4BB2FBA325D61A62096
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0001_none_cdfe2ea81af6e381.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\VPE079DM.LVX\T2B9E2A9.JVN\manifests\scre..ient_420d02d3849b7992_001a.0001_none_cdfe2ea81af6e381.cdf-ms
Size 2KB
SHA256 38760a5b1949c1fb0b870b5689626f9f7ddf7558aef1340b9415627ef33376d6
MD5 7884f9ba15278815c2c1c617fe5078b8
SHA1 6d7af6ae80d790e334326c0882296fd1d1d89d97
SHA512 319420911e90e7d945ba31f8ef53a3229dfb05fc1e7bb55ca0fe85d8ece2c1b329fe27b97077ac4bf8eafa74416fbc596665fe07e80a5177e65bb2b2bb9acf2c
TLSH
T1B85189057684EE67D66A0633EC96D2DD33367E82EF47130BB180BB6F3A316C55612096
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_27fa83f1ad328157_001a.0001_none_7ee8d7c6849dddd0.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\VPE079DM.LVX\T2B9E2A9.JVN\manifests\scre..tion_27fa83f1ad328157_001a.0001_none_7ee8d7c6849dddd0.cdf-ms
Size 22KB
SHA256 9436b12ed6e167879150f3f1595d5f8b7c8f2c947ec39f75196bab2bffa8640f
MD5 9c18a30fd8fedb2f32e3491cb9b1977d
SHA1 775ca46b574166fcb4dd4977c8c4cf2f478a0c1c
SHA512 1eca85478f61c876e8566b51a42ea526dbdbc477c7d58031984e8b83d98ee28c939d1a6b4dfe83b88dc81de33870af845fe3b17af1e285f5a248eff3944ab948
SSDEEP 384:4wF9BE7a77EezPBbEeznljP2psgM7Ypfi17P2aa16YcnVC1bS4VkTkM5jUrbE:B8aLPL10pfgP2am6Yc2bS4VRnE
TLSH
T124A24B857B41EE52C3225632DCD3C7E46279BE924EC2835F38453B1F6978F462B21989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0001_none_e93c691ea166f0e8.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\VPE079DM.LVX\T2B9E2A9.JVN\manifests\scre..vice_420d02d3849b7992_001a.0001_none_e93c691ea166f0e8.cdf-ms
Size 4KB
SHA256 28ca2b324897e8e436fe51c884fe7a73ebdea4fb0d58c9020fa3e1c39283c3ac
MD5 8dac31dafb258bd3a3d7c2a2c819a1f5
SHA1 cf2e8a56ea65f96e9c3a92759995a04dcf026be1
SHA512 fe65f6e0c776b9b4c07f4cb7b4b29f30e87407a68e3d1398ad48a1acbb923e88e8daf7045f7fb2a6a6c81cc80117ea068edd28045c186240b43d2d29f64233c4
SSDEEP 96:wQgSOUeV+Ww874wCgOAXB30cc2n7Jw4JLDPudiV:YJ1F5Rhn/V
TLSH
T1E1A19A0272D0ED67E5A90633ACD2C2DE2A3A7D82DE43170B71C47F2F7A716D64226195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\VPE079DM.LVX\T2B9E2A9.JVN\scre...exe_27fa83f1ad328157_001a.0001_none_afd5613b89895049\ScreenConnect.ClientService.exe
Size 93KB
SHA256 01341bd42426c3d110136cc94433df00dbad690a56593f7cca41a93f698f214a
MD5 751e8bcc20a49aeab090d99a6417919f
SHA1 c2a313826c8fd840e4583435f821229c25ac34bf
SHA512 91b278afa4ef8d917552a9da6f5df3e5c93319a7e69baedca3cfb1f68463f17f16e1649e027bc574136753cea2d77f7cf5dede7c1a3e02ebc1f9131e1245f9b0
SSDEEP 1536:vg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUT0HMm7mT:YhbNDxZGXfdHrX7rAc6myJkgUT0H7iT
TLSH
T117935A13B5C28872D473093158E0DAB09A3FF9615E61DEAB3798022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\VPE079DM.LVX\T2B9E2A9.JVN\scre..tion_27fa83f1ad328157_001a.0001_d62d1846079f66a0\ScreenConnect.WindowsClient.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

TZ3CE56E.ZGD.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\598W8VQP.BRA\TZ3CE56E.ZGD.application
Size 114KB
SHA256 dfbd14b5f2f5343fc34c6f1d31b9dc5cd5820c92d4851bf217cd6c8562ab4563
MD5 540646ee89af0968fd026ebe9dd37f3d
SHA1 4638ac4a1cc95951df4d56942012a2bcb8c1b99d
SHA512 17c3f6eb01ba5a214de1fe5b13bbe4ece60e750023d1c32413fb1e2c9eebe51b0445b4e233858f814f47506941ff1871039e45ae77f11a753c6e2f180815160f
SSDEEP 1536:PvOPLfvy/iBHhe2WCRSmQfn4/5EHSZ5GE/uLTvooycu5KQ/IuKE:P2PLfvy/YHhlWCRbW22XOcu5X1
TLSH
T106B3A53ACE30F4C0477DB021D1A52D673D811B93DBB31BACD90A186B0E69796EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NYR3HRT1.O6R\3KLGGW1R.37B\ScreenConnect.Client.dll
Size 411KB
SHA256 28ff8468ad2db8b41fe9d9a2971dd56fea0aecad14808fe4b31c9b1072d3b129
MD5 62d114c95b604d7ca684759c22c4c688
SHA1 d0563d46f2dc95dc8c18535efe7b18292128c0e6
SHA512 c02280814930d898527708f98061bed64f35b8ec76135b22984c2b5cbcc3d881f1088a3c77d960a52862a423855f99f59d7b13cd05a48539a5d2f0252f8ccaed
SSDEEP 6144:e2E4tiGCnwldvN7ADSD8ETEavHy+vd7JPYIYyqQni65/PGq:IaiGIwNAeDHTEavSW7OQni3q
TLSH
T12294CF8563E8882EEE9F3A73F16162248D72BC55B492E2E94D0C75F51BB338287447D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NYR3HRT1.O6R\3KLGGW1R.37B\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 5963579d8629fc62000fa7af323834f3bdbed73cb85f5754552506dca02a7d0d
MD5 ec9a8a2b454025bc00746cd3b391c02b
SHA1 44c4d1edd49b345e8bb730563e64d7423f935671
SHA512 bf27d0b64ef31aa55d8145d4e38f9766cc3041ae367f1a633c6d32869d3e16cd7404d614e87cd33fa92378b64a0f4971e04d74cea2875428de4fcaebfdca7339
TLSH
T1B111591191C4FA361F3342D1FEE7E460676E5B23048E294BB069685F8B29AD643470B7
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NYR3HRT1.O6R\3KLGGW1R.37B\ScreenConnect.ClientService.dll
Size 90KB
SHA256 9cf2c77df0a1a1e854ec1bbc6940d96f508bfb4b0555a07657c77314803a717e
MD5 cee388546abc6dfb7a766a33a8066ff5
SHA1 a41ffb64a859ff3bd32589ce58ac03a84c0b1955
SHA512 8c1d39bf142048a93c5388ebacc1a409c773ce7ec9f684127a97779a53c4914ef650f8d8474e4d999b12b848ca1ff4d3a697a0888dd1213d6414c703fc3c37f8
SSDEEP 1536:QtZxUAtbcOyfDNq9IxcBoSDW3ieKw/PM3ZRVQbV3l5EpSj/zJX+VugmCD74mGyN:Qa4CDIICCieKnVQbVDEkj/zJX+VugPD7
TLSH
T1BB935C0293AD993BC9DF4E34B461F1610AB1BA13D4E7E7D99D9864E62F063C11F043AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NYR3HRT1.O6R\3KLGGW1R.37B\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 c6428da241e4edf931ca9f99d47058e1f6e2783401b491edf28628264c74b7bf
MD5 9902527b73ea808bbb75f60cfd9f0a49
SHA1 811b2eca8a75f846a5151d6beb779a058eef7c09
SHA512 76271945e2008283cdb0a7da97680e232e825d166dcc404a8aa82be7d15d81cfbbde2c36b6df8187a93ce5f92b358e2a1a4cb704980e22c97f8d326d69ff9039
TLSH
T1D331F61191C4FA351F3302C1BEE7E4605B9E5722158E290BB059A95FCF2DA97434B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NYR3HRT1.O6R\3KLGGW1R.37B\ScreenConnect.Core.dll
Size 572KB
SHA256 92e831159d5e9f2676241ab7ce80060a0b1dc34684f83797aec93b3ecff41139
MD5 f5be8d175195df18890643f146ec4383
SHA1 ef2945ea142cbad107f4731de0ec33b428f1024f
SHA512 998b29e4e66ccc0cf411d8daf661eb25da4f257b16e7a79047316f81b12c49693cabb6a1012db14d398bbe78db48af85a7da01c1fc12a6d067852a144f0dbd6c
SSDEEP 6144:HuPdHSnGdti7Bn2Bomiu7qTOGXwU6eISZl2JILinW5dQifdlb1QS/qhwDTax4kxP:Yd+McMYu7w1jXyadQmbb1QHMy1
TLSH
T151C47D12B39497F7C5AE037EE07053184272FA4564B6E38B65A8D4FA3C923C95D806FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NYR3HRT1.O6R\3KLGGW1R.37B\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 e26a8d6784945e3fb747684e5addfbe2b4d6dd13e09cb38bc368649ee986acf8
MD5 d0554a69af0cff7e4e7e29598577b6a1
SHA1 17094b1065eed42ff07aa6b725328876a1b48f70
SHA512 5d783818d36b4a5799a7a86696c994b8799c21675799780137b0ba62dd72562e202c3a001afebb166c191b7d4f5fa61fd9b8d197d70970683f659e86e8bfdc19
TLSH
T150216A1181C8FA261F3302D2BEE7E42197AE5733148D194B7069685FCB1DAD24747077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NYR3HRT1.O6R\3KLGGW1R.37B\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 2292aac48ad575c6d1ed99c862e3408e254db34b8fea50cf3594aa08f3e875d0
MD5 63d6f975924dee293c5346992cf1b10d
SHA1 33e47573b3b9e384128ca4f66d6ae73f83f3dd89
SHA512 68a464b8c2a7017b7bd24521f995b1962969ebb9f0b088c2673b715df73b30e1461bbf1b111178067f2ff28105953e49ce27612956ec54cc32edf3a191cf6b0b
SSDEEP 24576:S1/VFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTz:o/VJkGYYpT0+TFiH7efPS
TLSH
T1FC85BD41E2C365F5D46B047888BF972AB6743C080365CAFB93D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NYR3HRT1.O6R\3KLGGW1R.37B\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 fce0528fad5368a0f69e53adf873f618770eac851d3eaa75af35ec1766066b23
MD5 4e285c2cb42b1c8b6083b91dd7e678c8
SHA1 e539f6ab0aae219036cc24b6e116af28bcd1afc1
SHA512 eb86a2480c8388267d4c6caed86805b29771ba5f1b5cabcfd6b975cdfc518cef62176ac971219743403dee432af3e06567599087c312c4232aae6e1fe973b543
TLSH
T1F541F11281C8FA250F3302C2BEEBE431979E5723158E190B7099AD8BCF29AD74747077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NYR3HRT1.O6R\3KLGGW1R.37B\ScreenConnect.WindowsBackstageShell.exe
Size 71KB
SHA256 0e6502db9fcae756f42f1e32cbb70b87b54286cc9ea1b7a83f51f57b10975aad
MD5 222611c5a579a6e22a3333dcd3587aba
SHA1 a1cc8b62acbb217146525a20f26e9ef4241e8563
SHA512 c498d3d23f9d0278b6b9b98e497fbe7d70ef02173b079ba03ec8ed3aa235102eefb59ee482288132ee2d9844935d1ac5ccbc0ba93a48825d89d2b515fa02551c
SSDEEP 768:UzlYsf/wCdOBti+3kDeuRsUQHkyik5lvmDSmBsuMQX5E+TCMXESslUqt6LYiDLkN:URYKtdU39PVlvmDqfQX5E+TC7Sa6L7wF
TLSH
T135637E5023DC9535E9FF2E34B4E1F6600AB3BA638CE1D7D52DA821DA2E127C14F64396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NYR3HRT1.O6R\3KLGGW1R.37B\ScreenConnect.WindowsClient.exe
Size 665KB
SHA256 6e95d68102dc761942e67e2337ad8e49d32ee7c8943340489a01e2c56ea6e00b
MD5 1bec5ec41f5a88bab602ba15d6d2879d
SHA1 859fd0edba414551a48d598141a58fabbb343715
SHA512 8c9fda75e2309942041f1c76bdb5989a26767d64086d1502e6184fd9b404f22af652d967a661a4262fe073130947e839005dbc4d540707d6739d3d9b045cd5b1
SSDEEP 6144:CJdXZuij7nl/k+XKzIHWxInzii8IiHx4PAyYES4QtkU/ycMF2/B4IF1ICkJAs1iV:Cw67l/5KM2yuKYmS4QjjIm1ZT/
TLSH
T184E47E1137ACDB7BC4EF0B76A432195517B8E802A585E7CFF640A0E95D863809E067EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NYR3HRT1.O6R\3KLGGW1R.37B\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NYR3HRT1.O6R\3KLGGW1R.37B\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 81c50d427bb9ed2323d996df65548227f4772f6f595f8fa671fccca3e1338b60
MD5 0ce3d8db5ded9604b0c64de520de16fb
SHA1 2403fc18b63d115e6aa29f7be014464dc8ff7a69
SHA512 557becbab43cffa73dc5554af81b30eb70ad15f357f1f981fe7edb19326fa6254b0607b707b7166a6230b96d0e581e93de6a027a4dfc4c705fc90df25960a10b
TLSH
T1E051C51151C4FB250F3302C1BEEBE470979E5722158E290B7099998FCF2DA974787077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NYR3HRT1.O6R\3KLGGW1R.37B\ScreenConnect.WindowsClient.exe.manifest
Size 25KB
SHA256 7581da51f7320569eabee73726ae3be83514b5a7e2989b86914d6d39ff2f30a4
MD5 d50abe1cfcb66eea8191c3895b597507
SHA1 5d4cdf6d1b1c625770877bc03c75c36a7c65afe3
SHA512 1c828385aeea4a75910d81fb5c8b163711ea12b8180b2951af38f46e609fa278fcc8018c50e00cc86f28e48a92d444bde46a3dd4e541c839a2a0252978d2b768
SSDEEP 384:te697gm3U/UGaenfaVXEezImpCMEezuEeznljP2psHM7Y7fi17P2aa16YcnVC1bZ:tbaa4mUtPLs07fgP2am6Yc2bS4VRUi
TLSH
T1BAC23A9A8CC13D21033391D0FFE38A28BD047B6305ED109A7D4D159F9F59A5A67A32EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NYR3HRT1.O6R\3KLGGW1R.37B\ScreenConnect.WindowsFileManager.exe
Size 91KB
SHA256 a40087c78a18f9d177dfe5fa5f0bec2cf113a80c2ffbe4d0ec3d582b067120d5
MD5 ebebb49c1d1e6f35febe4b8d4138f7b5
SHA1 00337a0af8352464407d9b8f114ad798ba99bee5
SHA512 ec5dca6e88e671be2c72afde9e235c0ce47e782bb96931c8d52dc0fe9e138dc14f84caef8bd29275daa75fb414c20000c84e94bc011e3095af4125d67ee4d831
SSDEEP 1536:FHMxIdlP49mjI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVdibp7M:IIPHukLCwpA
TLSH
T1DD93D59235266235DEC5C033A492E9B19C377F6207FDC5BD28A1BA3639E03943E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1876-14-0x0000015348C70000-0x0000015348DF8000-memory.dmp

Download

memory/1876-78-0x000001534CC90000-0x000001534CE40000-memory.dmp

Download

memory/1876-72-0x000001534C9D0000-0x000001534CA64000-memory.dmp

Download

memory/1876-84-0x000001534BB30000-0x000001534BB4A000-memory.dmp

Download

memory/1876-66-0x000001534C9E0000-0x000001534CA8A000-memory.dmp

Download

memory/1876-60-0x000001534C020000-0x000001534C08A000-memory.dmp

Download

memory/1876-21-0x000001534BB60000-0x000001534BBB0000-memory.dmp

Download

memory/1876-355-0x00000153303D0000-0x00000153303E0000-memory.dmp

Download

memory/1876-354-0x0000015349160000-0x0000015349172000-memory.dmp

Download

memory/1876-15-0x00000153303D0000-0x00000153303E0000-memory.dmp

Download

memory/1876-353-0x0000015330550000-0x0000015330559000-memory.dmp

Download

memory/1876-13-0x000001532E6C0000-0x000001532E6C8000-memory.dmp

Download

memory/1876-352-0x000001532EBF0000-0x000001532EBFC000-memory.dmp

Download

memory/4412-12-0x00000000053D0000-0x0000000005434000-memory.dmp

Download

memory/4412-4-0x0000000005010000-0x00000000050A4000-memory.dmp

Download

memory/4412-9-0x0000000005450000-0x0000000005600000-memory.dmp

Download

memory/4412-8-0x0000000005000000-0x0000000005010000-memory.dmp

Download

memory/4412-7-0x0000000005180000-0x0000000005212000-memory.dmp

Download

memory/4412-6-0x0000000005650000-0x0000000005BF6000-memory.dmp

Download

memory/4412-5-0x0000000002A40000-0x0000000002A68000-memory.dmp

Download

memory/4412-10-0x0000000005000000-0x0000000005010000-memory.dmp

Download

memory/4412-3-0x0000000001150000-0x000000000115A000-memory.dmp

Download

memory/4412-2-0x0000000005000000-0x0000000005010000-memory.dmp

Download

memory/4412-1-0x0000000001130000-0x0000000001138000-memory.dmp

Download

memory/4412-11-0x0000000007EE0000-0x00000000084E2000-memory.dmp

Download

memory/4412-0-0x0000000005000000-0x0000000005010000-memory.dmp

Download

memory/4412-18-0x00000000053D0000-0x0000000005434000-memory.dmp

Download

memory/4412-17-0x0000000007EE0000-0x00000000084E2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads