ef8e2ce23f9db3bd32425f5b29f2355e67fcb4ab6110ac1350a3b1645fa887b5

Analysis

max time kernel
149s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/04/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-26_288059533f8060a88d72b4c1d4b68a8b_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Size 2.4MB
Sample260426-tpvpbaex4p
SHA256 ef8e2ce23f9db3bd32425f5b29f2355e67fcb4ab6110ac1350a3b1645fa887b5
MD5 288059533f8060a88d72b4c1d4b68a8b
SHA1 fa31e707319fdab3c2197094e739ef84b606f467
SHA512 8c3b1d390924dd1808b8f6f768e5c08e0100d0235e1e527a477e8d14ec34366073c4c6a74f2ed91ad7e7199b01f4f2bca9c894eed762465478358b153f5e0192
SSDEEP 24576:oVm88bg9/fJZp+Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiHi:eAbgHp+JkGYYpT0+TFiH7efPgQ9Zrj
TLSH
T1A7C5BD41F3D65AB6C4AF0538887A961AAA70BC041315CBFB67D4BA752D337C08E357A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
2	3724	dfsvc.exe
2	3724	dfsvc.exe
2	3724	dfsvc.exe
2	3724	dfsvc.exe
2	3724	dfsvc.exe
2	3724	dfsvc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\VARAPMN9.0LM\4VPA5CRH.HGQ\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-26_288059533f8060a88d72b4c1d4b68a8b_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "RPZPT9JY4BCON74BNR6GOPNO"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956\Files\ScreenConnect.WindowsFileManager.exe_0e21 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_none_1c8bee40926f0c53\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956\Files\ScreenConnect.ClientService.exe_e781b1ee3 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 460061006c00730065000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_none_1c8bee40926f0c53	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_3385f4bd2ea1860b\scre...exe_0000000000000000_0019.0008_none_6f0640389	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08\Files\ScreenConnect.WindowsClient.exe_6492277df = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0008_none_f35e8777baf49e66\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0008_none_f35e8777baf49e66\Files\ScreenConnect.ClientService.dll_e781b1c63 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0008_none_4682c71061834e2b\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08\DigestValue = 91b47ea582ff6d8e52a1322da94f32a4dcf381a3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff\lock!0a0000008678580e8c0e000008130000000000000000000 = 30303030306538632c30316463643562323733663433303066	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_3d481723791efc9b	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_3d481723791efc9b\scre..vice_4b14c015c87c1ad8_0019.0008_none_f35e8777b	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0008_none_420aef2f25353afb\implication!scre..tion_0000000000000000_0019.0008_33 = 68747470733a2f2f72656d6f74652e67696e657379732e696e2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_0000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 54007200750065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0008_none_420aef2f25353afb\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_none_1c8bee40926f0c53\SizeOfStronglyNamedComponent = 34c7010000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956\Files\ScreenConnect.WindowsBackstageShell.exe_8 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_3385f4bd2ea1860b\appid = 68747470733a2f2f72656d6f74652e67696e657379732e696e2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0008_none_f35e8777baf49e66\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0008_none_4682c71061834e2b	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_3d481723791efc9b\scre..dows_4b14c015c87c1ad8_0019.0008_none_4682c7106	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_3d481723791efc9b\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_0000000000000 = 68747470733a2f2f72656d6f74652e67696e657379732e696e2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956\DigestValue = 03a0471dee3c95766254f93bb7439f659358f2ff	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_3d481723791efc9b\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d013 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff\Files\ScreenConnect.Client.dll_fc1d7bd48553fcab = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0008_none_4682c71061834e2b\DigestValue = 03a0a4d1468805db1a6db23a5603c79bfc61255a	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff\DigestValue = 834900e5676ec3138caa108b80ec98ce6df0a2b6	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_3d481723791efc9b\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0008_none_420aef2f25353afb\DigestValue = 8dbfc0950e52951dff1a25ea269817701b16bb6e	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_95daddc192c1691c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0008_3d481723791efc9b\scre...exe_0000000000000000_0019.0008_none_6f0640389	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0008_none_420aef2f25353afb	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_0000000000000 = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d002200680074007400700073003a002f002f00720065006d006f00740065002e00670069006e0065007300790073002e0069006e002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320035002e0038002e0033002e0039003400360036002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320035002e0038002e0033002e0039003400360036002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e00530065007400200063006c006100730073003d002200530079007300740065006d002e00530065006300750072006900740079002e005000650072006d0069007300730069006f006e0053006500740022000d000a00760065007200730069006f006e003d002200310022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d00220028006800740074007000730029003a002f002f00720065006d006f00740065005c002e00670069006e0065007300790073005c002e0069006e002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300030003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_3385f4bd2ea1860b\pin!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0008_3d481723791efc9b\implication!scre..tion_0000000000000000_0019.0008_3385f4b = 68747470733a2f2f72656d6f74652e67696e657379732e696e2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0008_none_420aef2f25353afb\lock!100000008678580e8c0e000008130000000000000000000 = 30303030306538632c30316463643562323733663433303066	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0008_none_4682c71061834e2b\lock!0c0000008678580e8c0e000008130000000000000000000 = 30303030306538632c30316463643562323733663433303066	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956\implication!scre..tion_0000000000000000_0019.0008_33 = 68747470733a2f2f72656d6f74652e67696e657379732e696e2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e382e332e393436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\VARAPMN9.0LM\4VPA5CRH.HGQ\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\2LEB09DK.3OV\ONRXQZPT.1L2\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4084	2026-04-26_288059533f8060a88d72b4c1d4b68a8b_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Token: SeDebugPrivilege	3724	dfsvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 3724	4084	2026-04-26_288059533f8060a88d72b4c1d4b68a8b_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-26_288059533f8060a88d72b4c1d4b68a8b_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-26_288059533f8060a88d72b4c1d4b68a8b_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\2LEB09DK.3OV\ONRXQZPT.1L2\manifests\scre...exe_0000000000000000_0019.0008_none_6f06403892b3e956.cdf-ms
Size 14KB
SHA256 81e9a0de2ec14b2a1801e135332f8ff0c0aaf9601ff46e1d70ac46cf0f99c8e8
MD5 bc44485835d750069cf20013794f999a
SHA1 e334ce260a578640b7f2e25308e7218e2feb5f37
SHA512 f244471deb495aedf4a00b8d37d7c1805288b5c062009bc3c570dce329490b82b3f6dbb02d39c5e399d1c17d15563a70f67298d1a1ded866ca419168e4482c9f
SSDEEP 192:UvEwHH/hiDrieEdfXjrerererSrZIQGV67gqxsd4:ULnZiD2eU+++a7sd4
TLSH
T1CD627301B7D6E832E2551733DCEAC2E47232BCE55F96135B70443B2EED712CA8A23695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0008_none_420aef2f25353afb.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\2LEB09DK.3OV\ONRXQZPT.1L2\manifests\scre..core_4b14c015c87c1ad8_0019.0008_none_420aef2f25353afb.cdf-ms
Size 3KB
SHA256 a39180f4f72571027a54d82a55bfc48f8caac575836455570b9dd0a7e1ecbeaa
MD5 2e41cb2cdedb74a37f47b11a1def87a4
SHA1 975fc39657ce31e7910ebbfd1e5e7f0e963cc122
SHA512 2911480aaf6a11f68552752d24e16b1ba9b1d24a391cf9edafc8bec6aafc293bb7f1470492a97f06c5dcef1ea7d61864891f1412528d1e17e4e42dbb8351abca
TLSH
T1F661CE42B244E913C9690633ACD5C2EE37747E83DF42460B74C4BF2F7A316F546112A1
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0008_none_4682c71061834e2b.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\2LEB09DK.3OV\ONRXQZPT.1L2\manifests\scre..dows_4b14c015c87c1ad8_0019.0008_none_4682c71061834e2b.cdf-ms
Size 5KB
SHA256 faa36b2ddb67140dc7f855515b24650e1b5f8ba11ed3afba15e5c1e2944a0b90
MD5 c1faf9365dfed5ee5b73663a5c5967e0
SHA1 ddfc0ef000197b56e1fd3616816d1b002b15f92d
SHA512 fdb10858dff2b4077c4d6e918d2ed893deb9012eb008ed5a30d675cf3a69dfc89b761eec88a88ad4bd48c6294e714a7ce9d00655adae5cb0135b43af2fe9cf9a
SSDEEP 96:sBqcl4FheV+Ww7gk/WGgyHmzSNp9QHAzUvewwnMqGO:6l48JeOMrvOA0eT3d
TLSH
T137B110117304D957D5B90633ACA9C3EE2B687D53CE42060B30D4BF2F76322FA8721264
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\2LEB09DK.3OV\ONRXQZPT.1L2\manifests\scre..ient_4b14c015c87c1ad8_0019.0008_none_a351c8530e191e08.cdf-ms
Size 6KB
SHA256 e8c005c6e2c7d9f632aa32afa59d3492cb917d75fa5460ae2f9ba1111ee51b61
MD5 895ada27d5ffb6587276a4e82b4b9a0d
SHA1 b4cda30364932cfc72ba144a47a63a1e1d05cf9e
SHA512 b030d00267b82a5e8d89604a4f1320b555ec70e3d8825d0a89f71fd7b46c2334abf922dba52a913ddb5908aaa642066aa009fc09a1fe10c8c5dd698c10420c7d
SSDEEP 96:thBPPv9CeV+WwwS8WpOr2WAvgoG6v+WaOoMKFqNVhA:hPPvTJGplaZNX0A
TLSH
T106D144127280EE57D1BD0A33ACDAD2ED32367E96DE43070B70C4BB6F7A322E61612051
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\2LEB09DK.3OV\ONRXQZPT.1L2\manifests\scre..ient_4b14c015c87c1ad8_0019.0008_none_d8204d01348490ff.cdf-ms
Size 2KB
SHA256 5d439cb0dced6c811309f11647ccbea32cec3a8c9b57b8b9064505fd8a9b8b41
MD5 7fd69b830f6a1d80305663d09ef4a505
SHA1 428bec6a4f6c0de8b09ee5f0364b55b41591adb0
SHA512 13fc4955987a7e10f6a4b815017370126f4d18863d9ca704c4d12a2d248a4432925689724a8e3e94a85fbbcb187b9223c8f9a585a5e9731b16bfd03b1cd63be2
TLSH
T10851C9043644FA6BDA7A0732BC92CEE932A23E42DE750237B5D03B7F6BF11994616065
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_0019.0008_none_1c8bee40926f0c53.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\2LEB09DK.3OV\ONRXQZPT.1L2\manifests\scre..tion_0000000000000000_0019.0008_none_1c8bee40926f0c53.cdf-ms
Size 4KB
SHA256 e2e9eaf0d6b787314a078a3d7ec7a237bb45dfc96870c35b5ca5d5dbe8638213
MD5 999428713c16ce529ad04f3961100eb6
SHA1 d3a5c763ec97b323428d3a9527071ca2ad5d28f2
SHA512 37bde2ea88dd96499f6d1c55c21600dc1b2947a331334e3a46ee394bb02b008b8b2b210ae70b8b590f1010640f8634b82dcf5ceee6a8ed0cba74de4a78517601
SSDEEP 48:1P/mrIBoAqzIvTwgf0Ru9o0m5RD70pU7gFUTUEekXfYsQgbmZFms4Ch+UQRc0:ZOUgGcEW0m5R/AUm9kjQPfmvVUQRF
TLSH
T1A6913E80B780F823D6144732ACD3D2D432357DA60FD7971770987B2FAD363C19622266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0008_none_f35e8777baf49e66.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\2LEB09DK.3OV\ONRXQZPT.1L2\manifests\scre..vice_4b14c015c87c1ad8_0019.0008_none_f35e8777baf49e66.cdf-ms
Size 4KB
SHA256 f18edd3188043ceaf0e2a05ed59f7790b9e0ebc4e592d518f54f462457db6058
MD5 06a10d70b2ce3a2de72a85e5b775a16a
SHA1 854ac76f86031cf7e41b62a96c92f0b367de0c8f
SHA512 520109d8c58f096b73530e62aa36f56d54080258b6fa4640cd02ef8688a0381a2bd435b55a31d1f37db2684ceddf7c9bce076e0bf3e50c0f7fc229f4d3fc30e1
SSDEEP 48:W2CDEJrdgAqe6S+9ow87gw4W75uv/04qo1gN2VyWani3afU4+jf:W24eV+Ww8S45uU43gN24viO5Wf
TLSH
T1EC91AA117380E96AE6A90A33EC96C2DD2636BD82DE43070771C47B3F7A316DA5B21192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\2LEB09DK.3OV\ONRXQZPT.1L2\scre..tion_0000000000000000_0019.0008_3d481723791efc9b\ScreenConnect.WindowsClient.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

CBT31KVQ.N0P.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\BTYAVYLH.0B0\CBT31KVQ.N0P.application
Size 109KB
SHA256 c22c6e22722a5f55b54843c06aa78f8478878b1fa87599348af5c4569efabad1
MD5 0d1bc97b3e83799a5ee85a58d2b18c4e
SHA1 cb64aac98f6bdaf34c1bf48de0b09a5c15a46515
SHA512 ff45c17764207e99c617302ba7db35b92a6091c65fbde95d29d0c5db097539326efeba11cd338140de4c0eacf9a1d6ab716a00cb0828e96bc518ddc8f4073a74
SSDEEP 1536:s/iBHhe2WCRSmQfn4/5EHSZ5GE/uLTvooycuy+JEnr+L:s/YHhlWCRbW22XOcu6rg
TLSH
T1D1B3733A8E30F0C4437DB831D1652D673D812B93DB720BACD90A286B0D6D796EF5A65C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VARAPMN9.0LM\4VPA5CRH.HGQ\ScreenConnect.Client.dll
Size 400KB
SHA256 b3ecc92c2c046b134eaacf129d64f736c93d0d6d6b5b1e4a56f5ab9229919347
MD5 e7dc5248b17312b013305b6dbf599511
SHA1 834900e5676ec3138caa108b80ec98ce6df0a2b6
SHA512 c3f5b30e0a02bba15cf5127d1762aad2c4cf570c55134733fb121a765545b26a1e5f1b05370d9d84435bb7b4983bbd53b253f72ffa86075b1810c21afd72d88f
SSDEEP 6144:8MSiC+QXJN+ZvH8ETEavHy+vd7JPYIYyqQni65/PGUi:DSF+X5HHTEavSW7OQni3v
TLSH
T18E94CF85B3B84D2DFEAF0A37F46081258E739C456552F66D0E44B9F80AB37928644FE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VARAPMN9.0LM\4VPA5CRH.HGQ\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 70cb25a58fb60b0a6b7c36bb9f42ef88c79e174063495f5934b3f6d85c387ae1
MD5 51c20d04cebecf60042b531acb39e66b
SHA1 2ef6f725a4de0815ea1492e153c1bb712f85128a
SHA512 1a5e8473a0e1f11c14dad5cea9d9df83f84b3f037a16fc2907eff013f15af56b9cbfc4a5a34d015e482dd297d7d06c8b6322cd411280b9996cfeeb169f504b79
TLSH
T1A1117B0181C8FA261F3345D1BEE7E021576E1B37048D194BB06968AF8B2DAE683471B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VARAPMN9.0LM\4VPA5CRH.HGQ\ScreenConnect.ClientService.dll
Size 78KB
SHA256 7aaa499ecf7454f13f0f9f20aff6da726b93af3aa88b0b401b562dae5e251064
MD5 5b13361a0aa32b9e916ea35cd42ef8f9
SHA1 e8c7c3c1dab447370a7825212f74ddf78effe940
SHA512 e6170a4fb9cb8872bb45062f48942032a344bfe5412400ca6e5426d39815c431056bab3a66e2d173611f72781bdbf1de6d32363f6ee23bd5407534929c66e324
SSDEEP 1536:67xQmiDqhpozTKpA9mH50ascXk/QQV3lTumkbPHg7VEv:67xQmKCpST1O50G0QQVFudguv
TLSH
T1E5733B81A3AC9E26C9DF4E787465B0450F709A02D4E7FBDD9D8DE4EA1E563C12A003DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VARAPMN9.0LM\4VPA5CRH.HGQ\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 49e27a38d409fe5c0a43c6699a9cf59ea1217a3849bd0c960446419465491f19
MD5 1be7c70aa2028d663c6b309b2117d3e9
SHA1 bd66f87e63abef662d83f76387ff5c1cf86778bd
SHA512 7a8358786ff2da6b18b660906d7053c2fa532ece2c9f795e5956be9150f559510718e8f994db9c999a4752a964b8e04d91c4cf6f1b5878d6393b6b67ff94b7dc
TLSH
T1F031E90641C4FA251F3305C1BEE7E061975E1B33158E1947705969AB8F2DAA6434B173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VARAPMN9.0LM\4VPA5CRH.HGQ\ScreenConnect.ClientService.exe
Size 93KB
SHA256 bf3518da7f1d578453f79be73a094ec905dd357202146508fbc1f9c2816b713e
MD5 a7408881acf32dca752d3752c4deb0e3
SHA1 5fdb8e4d948b8a43136e80b1e73739677769ef8e
SHA512 14b7982a1bc6c1415160f4cf72d249553e694de88cabd3d7570d2ac129288046b9865a7f6fc7fe993bea107d15d1aac8bd909966a38ff6bbdb2a689a21abb793
SSDEEP 1536:wg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg8U0HMG7xq:ZhbNDxZGXfdHrX7rAc6myJkg8U0Hntq
TLSH
T1F6935B13B5C28872D573093158E1DAB09A7FF9215E21DEAB3788022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VARAPMN9.0LM\4VPA5CRH.HGQ\ScreenConnect.Core.dll
Size 553KB
SHA256 8956ab1cd6a01cff92c92a09457ef358b4b19f0c10057ab249bb9b89ab8b04a4
MD5 b742a1a536ef49df880d947f9cd0cd74
SHA1 8dbfc0950e52951dff1a25ea269817701b16bb6e
SHA512 bad6c9d387a348d80d92519f3fb7234af394bb7f0e1f580ebc0957f0a94e18aa756bbdd1d96e987f6f55818ad515efa20df332926e864ff8f1901e6ce1f87685
SSDEEP 12288:kxzn3KCeQqm1mHw3TFvG5qm7ab26X/fjX:ym88bg9/fr
TLSH
T17FC47E9133988B2AC5EF4B3BE470D5542A71E524B00EE35B2A99F5E51E8234B4E0C7F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VARAPMN9.0LM\4VPA5CRH.HGQ\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 9f7309be4a882407e28f72e88dbe231a61d7f3053dafdca0fd09635db7a8aa3e
MD5 fe3a1e0fded1c37a24639eced8ad375d
SHA1 1eea9a8178ff7cd427e39b6064f83a4f1b411939
SHA512 3c799aa4fa1d162b6a60beb29983e79255578fa515aa41a2044a63109ed5af304c430b1c0594d355fc5ba4cf75451a49d7649c6ad93c8b5928a0034fccde9dc7
TLSH
T13921370181C8FA261F3302D2BEE7E421979E5B33188D194B7469699FCB2DAD64747173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VARAPMN9.0LM\4VPA5CRH.HGQ\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 6afd930812e3ebc361dfd2b31ee8c91954910310b6fa582aba30ffb97c3772ca
MD5 76abdcb39c43951b10be38c4aa856399
SHA1 03a0a4d1468805db1a6db23a5603c79bfc61255a
SHA512 1d1350a51182cea62bb9fcfb5b91de1fac9516e5909cc40f28c1b5583baf3a7f563f93a8041bd18931b42796b9ef684644372c7e511472aaf1a4566ee4146e3c
SSDEEP 24576:sZp+Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTg:2p+JkGYYpT0+TFiH7efPJ
TLSH
T15A85AD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE356D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VARAPMN9.0LM\4VPA5CRH.HGQ\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 fb227967fdc274033f30658ef676b0d52046ad0651e25b8d2e91fd9eeed0e20b
MD5 22616b43f27ee1726717b1807bc8cb31
SHA1 3d2626f66fdaa8fbe961f4be1a6d5cde9ed4cc7f
SHA512 9cb1a995328d6fb087246debf130b082af4584ce5922522f862f6f7dfbd72ab0ae6e51c03911209da6b85eb62b48406c8063f1899e95db7a42fffdaefffcce2e
TLSH
T1DE41D31281C8FA250F3301C27EEBE431979E5733158E194B7499A99BCF29AE74747137
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VARAPMN9.0LM\4VPA5CRH.HGQ\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 93a0b159508a6bcee3e1ef12583bc3d3c1e3c68d2ef4762cef4730b79da2e6d9
MD5 2d1fe7c2b7d66689f0f1ded2f053c4fb
SHA1 05536274c78f28c2ac1f6cdcf6b497dbda3ec528
SHA512 8f8bf04b0398bbd108ce0cf29cf38a6ad62fa4519968a81e581490dd1c406963cd8b30edbc5ae4d04a0a529ef1fd563f0280207eb4b2d47d54d9cf75bef3777d
SSDEEP 1536:5oSOs/MRZFe9aL6DvmDTyQX5E+TC7dh2syGbci73F:5oTsCZFe9BmyQOtgijF
TLSH
T121538E4163E84619C9FF2E7CB8F2A1141EB1AA439441EBAE0DCD65EA1E537815F203F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VARAPMN9.0LM\4VPA5CRH.HGQ\ScreenConnect.WindowsClient.exe
Size 603KB
SHA256 5de6723741049d2c3758e23c0c31d395190daf93dec2d01a5dc439cb35fdb08f
MD5 3e5a9751efa15e3afa5366ecfb608e9e
SHA1 91b47ea582ff6d8e52a1322da94f32a4dcf381a3
SHA512 a74c31651fc5e8a93f245dffeb12a222d74052d30b637195ccdcb304793815d8edd02d5e9d4d805576ef19e25810b86d64543d6214881137e1caa8049e240ede
SSDEEP 12288:XJdIARli93cAz7QWG+xNXe9siyT3zf9mu7:Tli9bBlTzou7
TLSH
T167D46C2173BCDA3BC8BF0779B0E118645FB0F8156685E78E8904A9D90FD739A49443EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VARAPMN9.0LM\4VPA5CRH.HGQ\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VARAPMN9.0LM\4VPA5CRH.HGQ\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 a214ad73f8ffec66c5016378b49bb8420f2981b6cfc3e85615bec7a98f6a1ce6
MD5 d09d1f06de79e0e5b5d8eebeb335a0aa
SHA1 5ce0444fb3ff752f7dbd49f44b7231623e916054
SHA512 714a145fec28ab5ae0ed807e94487dce2e21e20610033ab546721fe15c34092857d2a1d2c9af248b8aba62e12de7519b8254bf808f4ccee4616598d602d43b1a
TLSH
T1D851B40641C8FA210F3305C1BEEBE471979E5B32158E19477099A99FCF2DAA7474B137
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VARAPMN9.0LM\4VPA5CRH.HGQ\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 dc744414c091c151051b26595543f460d2ede5979d901a22639b8afc7db18a38
MD5 4b0b88b99852888faa41a0a59a4099c6
SHA1 03a0471dee3c95766254f93bb7439f659358f2ff
SHA512 e21a8e7dee59611f41b616e86c0a6337976a995df97df1d95f7fabed119709a974ec0f7fd45571ea76dc0d3021e453ed7a14d2118779395b5719eb6dd42072e6
SSDEEP 96:xWLwOhoyTuYe2wvyuk6koBkydrRkrkbqk49kF4kOpQkOprkAAkOpD:oR5e0ToKkr6Av4eF9UFUAAVUD
TLSH
T113F1AA9684C07C21573291C0FEE39924BE057F7302AE148ABC4D19BF9F765899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VARAPMN9.0LM\4VPA5CRH.HGQ\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 14808cb0711c2857ce5b23f113678ff802d3e9080af45683391a3e05a6a344bf
MD5 ad4980345fe0503bec34c375ae41b5e9
SHA1 fad8c08d7059ee68406f820651d493e11821e393
SHA512 0344fbcae984396e5bfa17022ce448d9fefe0d6bd98a2fe33dd0b47138bf48808d396f197024f3579f6a6fc7ff8b9b2d2254a54c7587106b3707f6bda2d93c8d
SSDEEP 1536:+tyrl44qzblI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7qO7z:dJWukLd+On
TLSH
T1BD83E58235762231DF85C5379492C9B59C366F22133DC5BD2DA2FE3A69F13443A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3724-14-0x0000017F7E0A0000-0x0000017F7E228000-memory.dmp

Download

memory/3724-62-0x0000017F7E000000-0x0000017F7E010000-memory.dmp

Download

memory/3724-47-0x0000017F7E000000-0x0000017F7E010000-memory.dmp

Download

memory/3724-57-0x0000017F7E760000-0x0000017F7E7FA000-memory.dmp

Download

memory/3724-44-0x0000017F7DF30000-0x0000017F7DF48000-memory.dmp

Download

memory/3724-60-0x0000017F7BE10000-0x0000017F7BE1C000-memory.dmp

Download

memory/3724-61-0x0000017F19ED0000-0x0000017F19EE2000-memory.dmp

Download

memory/3724-13-0x0000017F7BA00000-0x0000017F7BA08000-memory.dmp

Download

memory/3724-66-0x0000017F7E6C0000-0x0000017F7E74E000-memory.dmp

Download

memory/3724-38-0x0000017F7E6C0000-0x0000017F7E728000-memory.dmp

Download

memory/3724-28-0x0000017F7E000000-0x0000017F7E010000-memory.dmp

Download

memory/3724-27-0x0000017F7DF60000-0x0000017F7DFB0000-memory.dmp

Download

memory/3724-18-0x0000017F7E000000-0x0000017F7E010000-memory.dmp

Download

memory/3724-334-0x0000017F7E000000-0x0000017F7E010000-memory.dmp

Download

memory/3724-15-0x0000017F7E000000-0x0000017F7E010000-memory.dmp

Download

memory/3724-51-0x0000017F7EDF0000-0x0000017F7EF9E000-memory.dmp

Download

memory/4084-0-0x0000000004F80000-0x0000000004F90000-memory.dmp

Download

memory/4084-12-0x00000000052F0000-0x000000000549E000-memory.dmp

Download

memory/4084-10-0x0000000004D60000-0x0000000004DC4000-memory.dmp

Download

memory/4084-11-0x0000000004F80000-0x0000000004F90000-memory.dmp

Download

memory/4084-9-0x0000000004F80000-0x0000000004F90000-memory.dmp

Download

memory/4084-8-0x0000000004F80000-0x0000000004F90000-memory.dmp

Download

memory/4084-7-0x0000000005070000-0x0000000005102000-memory.dmp

Download

memory/4084-6-0x0000000005540000-0x0000000005AE6000-memory.dmp

Download

memory/4084-5-0x0000000004F30000-0x0000000004F54000-memory.dmp

Download

memory/4084-4-0x0000000004E80000-0x0000000004F0E000-memory.dmp

Download

memory/4084-3-0x0000000004E00000-0x0000000004E08000-memory.dmp

Download

memory/4084-2-0x0000000004F80000-0x0000000004F90000-memory.dmp

Download

memory/4084-1-0x0000000004DE0000-0x0000000004DE8000-memory.dmp

Download

memory/4084-17-0x0000000004D60000-0x0000000004DC4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads