ef8e2ce23f9db3bd32425f5b29f2355e67fcb4ab6110ac1350a3b1645fa887b5

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/04/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-26_288059533f8060a88d72b4c1d4b68a8b_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Size 2.4MB
Sample260426-tpvpbaex4p
SHA256 ef8e2ce23f9db3bd32425f5b29f2355e67fcb4ab6110ac1350a3b1645fa887b5
MD5 288059533f8060a88d72b4c1d4b68a8b
SHA1 fa31e707319fdab3c2197094e739ef84b606f467
SHA512 8c3b1d390924dd1808b8f6f768e5c08e0100d0235e1e527a477e8d14ec34366073c4c6a74f2ed91ad7e7199b01f4f2bca9c894eed762465478358b153f5e0192
SSDEEP 24576:oVm88bg9/fJZp+Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiHi:eAbgHp+JkGYYpT0+TFiH7efPgQ9Zrj
TLSH
T1A7C5BD41F3D65AB6C4AF0538887A961AAA70BC041315CBFB67D4BA752D337C08E357A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
4	4404	dfsvc.exe
4	4404	dfsvc.exe
4	4404	dfsvc.exe
4	4404	dfsvc.exe
4	4404	dfsvc.exe
4	4404	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
3724	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\9ZDV4GAN.P6Q\2VWWD5VT.R8A\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-26_288059533f8060a88d72b4c1d4b68a8b_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "OLZ9RZR3HHD52J9L490ON1YN"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_none_1c8bee40926f0c53\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_3d481723791efc9b\scre..dows_4b14c015c87c1ad8_0019.0008_none_4682c710618	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08\DigestValue = 91b47ea582ff6d8e52a1322da94f32a4dcf381a3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0008_none_420aef2f25353afb\DigestValue = 8dbfc0950e52951dff1a25ea269817701b16bb6e	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0008_none_420aef2f25353afb\Files\ScreenConnect.Core.dll_b96889d378047e27 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_3d481723791efc9b\scre...exe_0000000000000000_0019.0008_none_6f06403892b = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "WZ3ODTR3K7V8X3OEMZLNT14W"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08\SizeOfStronglyNamedComponent = f98f090000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0008_none_420aef2f25353afb\lock!1c0000004a82580e8c0e0000c002000000000000000000002 = 30303030306538632c30316463643562323661333638356338	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0008_none_f35e8777baf49e66\lock!140000004a82580e8c0e0000c002000000000000000000002 = 30303030306538632c30316463643562323661333638356338	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_0019.0008_3d481723791efc9b	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_000000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956\Files\ScreenConnect.ClientService.exe_e781b1ee36f = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0008_none_f35e8777baf49e66\SizeOfStronglyNamedComponent = e44f010000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0008_none_4682c71061834e2b\lock!0c0000008b7f580e34110000b41300000000000000000000f = 30303030313133342c30316463643562323632663063636363	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff\lock!0a0000008b7f580e34110000b41300000000000000000000f = 30303030313133342c30316463643562323632663063636363	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_3d481723791efc9b\lock!1d0000005a82580e8c0e0000c00200000000000000000000fb795d = 30303030306538632c30316463643562323661333638356338	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_95daddc192c1691c	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_000000000000000 = 68747470733a2f2f72656d6f74652e67696e657379732e696e2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956\implication!scre..tion_0000000000000000_0019.0008_3385 = 68747470733a2f2f72656d6f74652e67696e657379732e696e2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_3d481723791efc9b\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08\lock!0e0000008b7f580e34110000b41300000000000000000000f = 30303030313133342c30316463643562323632663063636363	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_000000000000000 = 30000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_3d481723791efc9b	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_3d481723791efc9b\implication!scre..tion_0000000000000000_0019.0008_3385f4bd2 = 68747470733a2f2f72656d6f74652e67696e657379732e696e2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0008_none_f35e8777baf49e66\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0008_none_4682c71061834e2b\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0008_none_420aef2f25353afb\lock!0e0000004a82580e8c0e0000c002000000000000000000002 = 30303030306538632c30316463643562323661333638356338	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_95daddc192c1691c\LastRunVersion = 68747470733a2f2f72656d6f74652e67696e657379732e696e2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0008_none_4682c71061834e2b\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956\Files\ScreenConnect.WindowsClient.exe.config_f7f1 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0008_none_4682c71061834e2b\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956\lock!060000008b7f580e34110000b41300000000000000000000f = 30303030313133342c30316463643562323632663063636363	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\NonCanonicalData	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_3385f4bd2ea1860b\appid = 68747470733a2f2f72656d6f74652e67696e657379732e696e2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_3385f4bd2ea1860b\pin!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0008_none_4682c71061834e2b\DigestValue = 03a0a4d1468805db1a6db23a5603c79bfc61255a	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_3d481723791efc9b\lock!110000009b7f580e34110000b413000000000000000000005c30f2 = 30303030313133342c30316463643562323632663063636363	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956\lock!040000004a82580e8c0e0000c002000000000000000000002 = 30303030306538632c30316463643562323661333638356338	ScreenConnect.WindowsClient.exe
Key deleted	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_000000000000000 = 68747470733a2f2f72656d6f74652e67696e657379732e696e2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_000000000000000 = 680074007400700073003a002f002f00720065006d006f00740065002e00670069006e0065007300790073002e0069006e002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006d0061006e00690066006500730074000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\9ZDV4GAN.P6Q\2VWWD5VT.R8A\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\WZ3ODTR3.K7V\8X3OEMZL.NT1\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4716	2026-04-26_288059533f8060a88d72b4c1d4b68a8b_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Token: SeDebugPrivilege	4404	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 4404	4716	2026-04-26_288059533f8060a88d72b4c1d4b68a8b_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe	84
PID 4404 wrote to memory of 3724	4404	dfsvc.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-04-26_288059533f8060a88d72b4c1d4b68a8b_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-26_288059533f8060a88d72b4c1d4b68a8b_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Users\Admin\AppData\Local\Apps\2.0\WZ3ODTR3.K7V\8X3OEMZL.NT1\scre..tion_0000000000000000_0019.0008_3d481723791efc9b\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\WZ3ODTR3.K7V\8X3OEMZL.NT1\scre..tion_0000000000000000_0019.0008_3d481723791efc9b\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\WZ3ODTR3.K7V\8X3OEMZL.NT1\manifests\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956.cdf-ms
Size 14KB
SHA256 b7ee34ddb21865047c03ac4e03df65cd8ff7721bcdad5d3bef04c294b8d92ccd
MD5 e465dd380408cba3a126d6d203ba2d8a
SHA1 284464fcbf3cbeb7a4b6d1c559d528f83ae62276
SHA512 146cb9486d40abbe0a7d25196eb77f9899e81b9b01f25a24284e817b03254f08273605125a179852d434e5741dd4f5726b3527e552eceeed08e4c9860dd11723
SSDEEP 192:JvEwHH/h+DVieEd5dgBAbml4OF+mCfPa/xvH42Zz4d+y6Hh22raBe/Q3OLod4:JLnZ+DceOmuV953gGJNT2roz38od4
TLSH
T1C5628322FB15E43BE2625A73CCFAD6963F517D661D715047B040333E1C7069AAF322A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0008_none_420aef2f25353afb.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\WZ3ODTR3.K7V\8X3OEMZL.NT1\manifests\scre..core_4b14c015c87c1ad8_0019.0008_none_420aef2f25353afb.cdf-ms
Size 3KB
SHA256 d703fff8daf018bc7673bd562a7f2cdaebf636b48485a751d2a8699edc31624b
MD5 a148a8b55799a7289dfb897faec33d27
SHA1 1ab1e688602a05ff605edf8b7e172bdc0dba015d
SHA512 e52c86f71605c0d44e31815159ef8ce7a5bf1422b7c9ad2662b6ffc6dd15dec4ab9df5e606a951b793622ac579b52c8dcf205d3db2d5fb6de63014bd9f4bd700
TLSH
T1A46199427644DA03D9AD0633ACD9C2ED37747E83DF42860B74C4BB6F7A352F54621291
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0008_none_4682c71061834e2b.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\WZ3ODTR3.K7V\8X3OEMZL.NT1\manifests\scre..dows_4b14c015c87c1ad8_0019.0008_none_4682c71061834e2b.cdf-ms
Size 5KB
SHA256 e199499358201113476238ee4f7333df0da0e820e488ded3d4490bd3a86f8481
MD5 ee3bcf1eb6f03db7b7f9a7c45495bc63
SHA1 6c7c127cd9f4d3d9d6b62a95cffddd2857b8036b
SHA512 d344efd53a11b75c90c3ab818ef6dec39a227bc07de7f08b9a99ec08d2625daab9ba8bcab141b2142cdc17d315965d90daec32e26cd07fbd6ef174721930c680
SSDEEP 96:uYBqcl4FheV+Ww7gkQL6X21kw57CC/wnMqGO:uml48JeQ+2qX3d
TLSH
T10DB1FE11B244C917C57D0633ACA9C3ED2B257E13DE42021B30D8BF6FB9326B69736295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\WZ3ODTR3.K7V\8X3OEMZL.NT1\manifests\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08.cdf-ms
Size 6KB
SHA256 93fadf1d9fd714e618e56696ca0da09c7b82d3a638b48d5f50cc6385d196604e
MD5 838bad219aae4674ed4a0343b853b050
SHA1 77240547e2dc0c2433c474a5cb2a8729226c55ee
SHA512 f3c88b19a75918afdf7e1d8ec2cad067de0f81eab07d7034d34bb011268a79ec13769ec3e8b08d3f13f88e1c44753cd1fa1bcfa2eb92e2d48407f580273cabb4
SSDEEP 96:bhBPPv9aeV+WwwS8Wm2TOtoO6gG56OL6TaKa2wkCEFqNVhA:vPPv7JGmZoQG56OOfXwbS0A
TLSH
T1C6D1B9127300EA17D5B90A33AC9EC3ED27683D56DE52460B70C4BF6F7A322E61721195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\WZ3ODTR3.K7V\8X3OEMZL.NT1\manifests\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff.cdf-ms
Size 2KB
SHA256 d1caaef826a5be5b7f2c980c8174c73f960b6ed01a3dd16506a0c3aabedc5444
MD5 7bb3b1a74bb565d576e4c88458994ce7
SHA1 f972d6555f696ff36c67c9957336ce6360be83a4
SHA512 47af05cafa681c5b68e22acc8d43ddb56fb7375c5bc564590a036dd335d55e8c20b4318cf5a9be678f357880950b8cee3f47fe8a210917a677376a418a83de79
TLSH
T1CE5166057684EA67D56A0633EC96D6DA36327E83DF460307B190BB7F2A712E586120A2
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_0019.0008_none_1c8bee40926f0c53.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\WZ3ODTR3.K7V\8X3OEMZL.NT1\manifests\scre..tion_0000000000000000_0019.0008_none_1c8bee40926f0c53.cdf-ms
Size 4KB
SHA256 6063df48f4294efbbacd5c9515253c92dce8b21dd9a60dffc9b082dddd46aff5
MD5 6302769b2ab3d60f712e02d71ca32b34
SHA1 2bb31d9895ed0ced20ee166a1f8e97069dade4ab
SHA512 5573275f995764ccdb375a386b70afba5840d321803c2e08817fded276a12d2a5071be62bdd2ebfcedda953461b98b0e0108fe22a02851626e4446b249899305
SSDEEP 48:7P/mrIBoAqzIvcp5gf0Ru9o0m5RD70pU7gFUTUEekXf4sQgbmZFms4Ch+UQRc0:zOUgGcTEW0m5R/AUm9kDQPfmvVUQRF
TLSH
T102913F80B780F823D6144732ACD3D2D432357DA64FD7971770987B2FAD363C5A622266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0008_none_f35e8777baf49e66.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\WZ3ODTR3.K7V\8X3OEMZL.NT1\manifests\scre..vice_4b14c015c87c1ad8_0019.0008_none_f35e8777baf49e66.cdf-ms
Size 4KB
SHA256 1651afa3e73b82215d452fe7510f3c8fbf7da44f24e58a7420b41bdd1e843c44
MD5 4e46b366cff322190db27c6a41c46b71
SHA1 1544553d0b71a232a382eafa36ba323d020f2208
SHA512 49b0212a114f7a05ba5506c391c11fa699cb0729dedc402ebbee934cddb9f2cb67c5c9ca8c959c6a5463eb3ab3e2a167587dd604293356cd1454efed24416d9b
SSDEEP 48:22CDEJrNgAqe6S+9ow87gw4W75uvsOAO2V42Wlv4isDhPm8YYYYYYY0i3afU4+jf:22IeV+Ww8S45uZAOr2WlvZsDhPniO5Wf
TLSH
T1CB9176117280ED26D5A90673ECCAC2DD3A36BD82DE43070771C4BB3F7A312D65B26192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\WZ3ODTR3.K7V\8X3OEMZL.NT1\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956\ScreenConnect.ClientService.exe
Size 93KB
SHA256 bf3518da7f1d578453f79be73a094ec905dd357202146508fbc1f9c2816b713e
MD5 a7408881acf32dca752d3752c4deb0e3
SHA1 5fdb8e4d948b8a43136e80b1e73739677769ef8e
SHA512 14b7982a1bc6c1415160f4cf72d249553e694de88cabd3d7570d2ac129288046b9865a7f6fc7fe993bea107d15d1aac8bd909966a38ff6bbdb2a689a21abb793
SSDEEP 1536:wg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg8U0HMG7xq:ZhbNDxZGXfdHrX7rAc6myJkg8U0Hntq
TLSH
T1F6935B13B5C28872D573093158E1DAB09A7FF9215E21DEAB3788022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\WZ3ODTR3.K7V\8X3OEMZL.NT1\scre..tion_0000000000000000_0019.0008_3d481723791efc9b\ScreenConnect.WindowsClient.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9ZDV4GAN.P6Q\2VWWD5VT.R8A\ScreenConnect.Client.dll
Size 400KB
SHA256 b3ecc92c2c046b134eaacf129d64f736c93d0d6d6b5b1e4a56f5ab9229919347
MD5 e7dc5248b17312b013305b6dbf599511
SHA1 834900e5676ec3138caa108b80ec98ce6df0a2b6
SHA512 c3f5b30e0a02bba15cf5127d1762aad2c4cf570c55134733fb121a765545b26a1e5f1b05370d9d84435bb7b4983bbd53b253f72ffa86075b1810c21afd72d88f
SSDEEP 6144:8MSiC+QXJN+ZvH8ETEavHy+vd7JPYIYyqQni65/PGUi:DSF+X5HHTEavSW7OQni3v
TLSH
T18E94CF85B3B84D2DFEAF0A37F46081258E739C456552F66D0E44B9F80AB37928644FE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9ZDV4GAN.P6Q\2VWWD5VT.R8A\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 70cb25a58fb60b0a6b7c36bb9f42ef88c79e174063495f5934b3f6d85c387ae1
MD5 51c20d04cebecf60042b531acb39e66b
SHA1 2ef6f725a4de0815ea1492e153c1bb712f85128a
SHA512 1a5e8473a0e1f11c14dad5cea9d9df83f84b3f037a16fc2907eff013f15af56b9cbfc4a5a34d015e482dd297d7d06c8b6322cd411280b9996cfeeb169f504b79
TLSH
T1A1117B0181C8FA261F3345D1BEE7E021576E1B37048D194BB06968AF8B2DAE683471B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9ZDV4GAN.P6Q\2VWWD5VT.R8A\ScreenConnect.ClientService.dll
Size 78KB
SHA256 7aaa499ecf7454f13f0f9f20aff6da726b93af3aa88b0b401b562dae5e251064
MD5 5b13361a0aa32b9e916ea35cd42ef8f9
SHA1 e8c7c3c1dab447370a7825212f74ddf78effe940
SHA512 e6170a4fb9cb8872bb45062f48942032a344bfe5412400ca6e5426d39815c431056bab3a66e2d173611f72781bdbf1de6d32363f6ee23bd5407534929c66e324
SSDEEP 1536:67xQmiDqhpozTKpA9mH50ascXk/QQV3lTumkbPHg7VEv:67xQmKCpST1O50G0QQVFudguv
TLSH
T1E5733B81A3AC9E26C9DF4E787465B0450F709A02D4E7FBDD9D8DE4EA1E563C12A003DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9ZDV4GAN.P6Q\2VWWD5VT.R8A\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 49e27a38d409fe5c0a43c6699a9cf59ea1217a3849bd0c960446419465491f19
MD5 1be7c70aa2028d663c6b309b2117d3e9
SHA1 bd66f87e63abef662d83f76387ff5c1cf86778bd
SHA512 7a8358786ff2da6b18b660906d7053c2fa532ece2c9f795e5956be9150f559510718e8f994db9c999a4752a964b8e04d91c4cf6f1b5878d6393b6b67ff94b7dc
TLSH
T1F031E90641C4FA251F3305C1BEE7E061975E1B33158E1947705969AB8F2DAA6434B173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9ZDV4GAN.P6Q\2VWWD5VT.R8A\ScreenConnect.Core.dll
Size 553KB
SHA256 8956ab1cd6a01cff92c92a09457ef358b4b19f0c10057ab249bb9b89ab8b04a4
MD5 b742a1a536ef49df880d947f9cd0cd74
SHA1 8dbfc0950e52951dff1a25ea269817701b16bb6e
SHA512 bad6c9d387a348d80d92519f3fb7234af394bb7f0e1f580ebc0957f0a94e18aa756bbdd1d96e987f6f55818ad515efa20df332926e864ff8f1901e6ce1f87685
SSDEEP 12288:kxzn3KCeQqm1mHw3TFvG5qm7ab26X/fjX:ym88bg9/fr
TLSH
T17FC47E9133988B2AC5EF4B3BE470D5542A71E524B00EE35B2A99F5E51E8234B4E0C7F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9ZDV4GAN.P6Q\2VWWD5VT.R8A\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 9f7309be4a882407e28f72e88dbe231a61d7f3053dafdca0fd09635db7a8aa3e
MD5 fe3a1e0fded1c37a24639eced8ad375d
SHA1 1eea9a8178ff7cd427e39b6064f83a4f1b411939
SHA512 3c799aa4fa1d162b6a60beb29983e79255578fa515aa41a2044a63109ed5af304c430b1c0594d355fc5ba4cf75451a49d7649c6ad93c8b5928a0034fccde9dc7
TLSH
T13921370181C8FA261F3302D2BEE7E421979E5B33188D194B7469699FCB2DAD64747173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9ZDV4GAN.P6Q\2VWWD5VT.R8A\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 6afd930812e3ebc361dfd2b31ee8c91954910310b6fa582aba30ffb97c3772ca
MD5 76abdcb39c43951b10be38c4aa856399
SHA1 03a0a4d1468805db1a6db23a5603c79bfc61255a
SHA512 1d1350a51182cea62bb9fcfb5b91de1fac9516e5909cc40f28c1b5583baf3a7f563f93a8041bd18931b42796b9ef684644372c7e511472aaf1a4566ee4146e3c
SSDEEP 24576:sZp+Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTg:2p+JkGYYpT0+TFiH7efPJ
TLSH
T15A85AD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE356D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9ZDV4GAN.P6Q\2VWWD5VT.R8A\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 fb227967fdc274033f30658ef676b0d52046ad0651e25b8d2e91fd9eeed0e20b
MD5 22616b43f27ee1726717b1807bc8cb31
SHA1 3d2626f66fdaa8fbe961f4be1a6d5cde9ed4cc7f
SHA512 9cb1a995328d6fb087246debf130b082af4584ce5922522f862f6f7dfbd72ab0ae6e51c03911209da6b85eb62b48406c8063f1899e95db7a42fffdaefffcce2e
TLSH
T1DE41D31281C8FA250F3301C27EEBE431979E5733158E194B7499A99BCF29AE74747137
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9ZDV4GAN.P6Q\2VWWD5VT.R8A\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 93a0b159508a6bcee3e1ef12583bc3d3c1e3c68d2ef4762cef4730b79da2e6d9
MD5 2d1fe7c2b7d66689f0f1ded2f053c4fb
SHA1 05536274c78f28c2ac1f6cdcf6b497dbda3ec528
SHA512 8f8bf04b0398bbd108ce0cf29cf38a6ad62fa4519968a81e581490dd1c406963cd8b30edbc5ae4d04a0a529ef1fd563f0280207eb4b2d47d54d9cf75bef3777d
SSDEEP 1536:5oSOs/MRZFe9aL6DvmDTyQX5E+TC7dh2syGbci73F:5oTsCZFe9BmyQOtgijF
TLSH
T121538E4163E84619C9FF2E7CB8F2A1141EB1AA439441EBAE0DCD65EA1E537815F203F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9ZDV4GAN.P6Q\2VWWD5VT.R8A\ScreenConnect.WindowsClient.exe
Size 603KB
SHA256 5de6723741049d2c3758e23c0c31d395190daf93dec2d01a5dc439cb35fdb08f
MD5 3e5a9751efa15e3afa5366ecfb608e9e
SHA1 91b47ea582ff6d8e52a1322da94f32a4dcf381a3
SHA512 a74c31651fc5e8a93f245dffeb12a222d74052d30b637195ccdcb304793815d8edd02d5e9d4d805576ef19e25810b86d64543d6214881137e1caa8049e240ede
SSDEEP 12288:XJdIARli93cAz7QWG+xNXe9siyT3zf9mu7:Tli9bBlTzou7
TLSH
T167D46C2173BCDA3BC8BF0779B0E118645FB0F8156685E78E8904A9D90FD739A49443EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9ZDV4GAN.P6Q\2VWWD5VT.R8A\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9ZDV4GAN.P6Q\2VWWD5VT.R8A\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 a214ad73f8ffec66c5016378b49bb8420f2981b6cfc3e85615bec7a98f6a1ce6
MD5 d09d1f06de79e0e5b5d8eebeb335a0aa
SHA1 5ce0444fb3ff752f7dbd49f44b7231623e916054
SHA512 714a145fec28ab5ae0ed807e94487dce2e21e20610033ab546721fe15c34092857d2a1d2c9af248b8aba62e12de7519b8254bf808f4ccee4616598d602d43b1a
TLSH
T1D851B40641C8FA210F3305C1BEEBE471979E5B32158E19477099A99FCF2DAA7474B137
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9ZDV4GAN.P6Q\2VWWD5VT.R8A\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 dc744414c091c151051b26595543f460d2ede5979d901a22639b8afc7db18a38
MD5 4b0b88b99852888faa41a0a59a4099c6
SHA1 03a0471dee3c95766254f93bb7439f659358f2ff
SHA512 e21a8e7dee59611f41b616e86c0a6337976a995df97df1d95f7fabed119709a974ec0f7fd45571ea76dc0d3021e453ed7a14d2118779395b5719eb6dd42072e6
SSDEEP 96:xWLwOhoyTuYe2wvyuk6koBkydrRkrkbqk49kF4kOpQkOprkAAkOpD:oR5e0ToKkr6Av4eF9UFUAAVUD
TLSH
T113F1AA9684C07C21573291C0FEE39924BE057F7302AE148ABC4D19BF9F765899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9ZDV4GAN.P6Q\2VWWD5VT.R8A\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 14808cb0711c2857ce5b23f113678ff802d3e9080af45683391a3e05a6a344bf
MD5 ad4980345fe0503bec34c375ae41b5e9
SHA1 fad8c08d7059ee68406f820651d493e11821e393
SHA512 0344fbcae984396e5bfa17022ce448d9fefe0d6bd98a2fe33dd0b47138bf48808d396f197024f3579f6a6fc7ff8b9b2d2254a54c7587106b3707f6bda2d93c8d
SSDEEP 1536:+tyrl44qzblI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7qO7z:dJWukLd+On
TLSH
T1BD83E58235762231DF85C5379492C9B59C366F22133DC5BD2DA2FE3A69F13443A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W7QOAHOK.QJ3.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LYKWLVTG.LM7\W7QOAHOK.QJ3.application
Size 109KB
SHA256 c22c6e22722a5f55b54843c06aa78f8478878b1fa87599348af5c4569efabad1
MD5 0d1bc97b3e83799a5ee85a58d2b18c4e
SHA1 cb64aac98f6bdaf34c1bf48de0b09a5c15a46515
SHA512 ff45c17764207e99c617302ba7db35b92a6091c65fbde95d29d0c5db097539326efeba11cd338140de4c0eacf9a1d6ab716a00cb0828e96bc518ddc8f4073a74
SSDEEP 1536:s/iBHhe2WCRSmQfn4/5EHSZ5GE/uLTvooycuy+JEnr+L:s/YHhlWCRbW22XOcu6rg
TLSH
T1D1B3733A8E30F0C4437DB831D1652D673D812B93DB720BACD90A286B0D6D796EF5A65C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3724-342-0x0000000000C30000-0x0000000000CCA000-memory.dmp

Download

memory/3724-356-0x000000001B7E0000-0x000000001B7F8000-memory.dmp

Download

memory/3724-359-0x0000000002D20000-0x0000000002D2C000-memory.dmp

Download

memory/3724-360-0x000000001EB60000-0x000000001EBCB000-memory.dmp

Download

memory/4404-48-0x0000013709F00000-0x0000013709F10000-memory.dmp

Download

memory/4404-330-0x0000013709F00000-0x0000013709F10000-memory.dmp

Download

memory/4404-64-0x0000013726230000-0x00000137262BE000-memory.dmp

Download

memory/4404-398-0x0000013722B40000-0x0000013722BAB000-memory.dmp

Download

memory/4404-37-0x0000013726210000-0x0000013726278000-memory.dmp

Download

memory/4404-17-0x0000013709F00000-0x0000013709F10000-memory.dmp

Download

memory/4404-52-0x0000013726500000-0x00000137266AE000-memory.dmp

Download

memory/4404-366-0x0000013722B40000-0x0000013722BAB000-memory.dmp

Download

memory/4404-13-0x0000013709F00000-0x0000013709F10000-memory.dmp

Download

memory/4404-58-0x0000013726240000-0x00000137262DA000-memory.dmp

Download

memory/4404-47-0x0000013722B40000-0x0000013722BAB000-memory.dmp

Download

memory/4404-11-0x00000137228C0000-0x0000013722A46000-memory.dmp

Download

memory/4404-10-0x0000013708340000-0x0000013708348000-memory.dmp

Download

memory/4404-46-0x0000013708870000-0x000001370887C000-memory.dmp

Download

memory/4404-43-0x0000013725AD0000-0x0000013725AE8000-memory.dmp

Download

memory/4404-26-0x0000013726010000-0x0000013726060000-memory.dmp

Download

memory/4404-27-0x0000013709F00000-0x0000013709F10000-memory.dmp

Download

memory/4716-0-0x0000000001800000-0x0000000001810000-memory.dmp

Download

memory/4716-5-0x00000000058B0000-0x00000000058D4000-memory.dmp

Download

memory/4716-4-0x0000000005820000-0x00000000058AE000-memory.dmp

Download

memory/4716-3-0x0000000001860000-0x0000000001868000-memory.dmp

Download

memory/4716-2-0x0000000001800000-0x0000000001810000-memory.dmp

Download

memory/4716-1-0x0000000001840000-0x0000000001848000-memory.dmp

Download

memory/4716-6-0x0000000005E90000-0x0000000006434000-memory.dmp

Download

memory/4716-7-0x00000000059E0000-0x0000000005A72000-memory.dmp

Download

memory/4716-8-0x0000000001800000-0x0000000001810000-memory.dmp

Download

memory/4716-9-0x0000000008790000-0x000000000893E000-memory.dmp

Download

memory/4716-12-0x0000000001800000-0x0000000001810000-memory.dmp

Download

memory/4716-15-0x00000000058D0000-0x00000000058D6000-memory.dmp

Download

memory/4716-16-0x0000000008940000-0x0000000008EF3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads