2afe9e924a8dc7264b0cbbe356e3f4248bd9e5019d52e287d8e8ada872569d6c

Analysis

max time kernel
149s
max time network
138s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-23_c8efe06250c95081ac649735476e35e9_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Size 2.4MB
Sample260523-vbqzmsgz5t
SHA256 2afe9e924a8dc7264b0cbbe356e3f4248bd9e5019d52e287d8e8ada872569d6c
MD5 c8efe06250c95081ac649735476e35e9
SHA1 0fec087fbdee4f8a7f46f4b6473cdc6613d001c9
SHA512 63de64ca795dac1d7cbc56213f402d37f1878415b531534d7465de8c9deab8840e1a02c6e4266214481330975a6e8cbc4981a96925014b70e102a05989ffa12e
SSDEEP 24576:pG0QoZ4aH/fMtp8Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiD:E0D4E6p8JkGYYpT0+TFiH7efPzQgmdL
TLSH
T16CC5BE02F3D656B5C46F0638D87A921AAB70BC040315DBFB56D8A9792E337C04E397A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 7 IoCs

flow	pid	Process
2	2084	dfsvc.exe
2	2084	dfsvc.exe
2	2084	dfsvc.exe
2	2084	dfsvc.exe
2	2084	dfsvc.exe
2	2084	dfsvc.exe
2	2084	dfsvc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\B9VQJWR9.PAN\KJ0EBBKN.H6V\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-23_c8efe06250c95081ac649735476e35e9_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0009_none_f3aaa402d647d4dd	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0009_2edb5b65a541b952\pin!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_none_1cd80acbadc242ca	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_fc6eafea63709ad9\scre..ient_4b14c015c87c1ad8_0019.0009_none_d86c698c4	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_fc6eafea63709ad9\scre..core_4b14c015c87c1ad8_0019.0009_none_42570bba4	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "RQX9PG3O65G019LRM5A38NPG"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 32003000320036002f00300035002f00320033002000310036003a00340039003a00330034000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0009_none_f3aaa402d647d4dd\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e392e31302e393534352c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0009_none_46cee39b7cd684a2\SizeOfStronglyNamedComponent = 82b21a0000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0009_none_46cee39b7cd684a2\Files\ScreenConnect.Windows.dll_fc0d83aff7df0b5 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_fc6eafea63709ad9\scre...exe_0000000000000000_0019.0009_none_6f525cc3a	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_0000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0009_none_d86c698c4fd7c776\DigestValue = cfbe1f1dbedfc8a91a2fdf7b118d83e80fcfe1f5	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0009_none_42570bba40887172\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\NonCanonicalData	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0009_none_42570bba40887172	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0009_fc6eafea63709ad9\implication!scre..tion_0000000000000000_0019.0009_2edb5b6 = 68747470733a2f2f736f706f7274652e736f66746c616e642e636f6d2f42696e2f456c73696e6f72652e53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e392e31302e393534352c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0009_none_46cee39b7cd684a2\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32352e392e31302e393534352c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0009_none_f3aaa402d647d4dd\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_fc6eafea63709ad9\scre..dows_4b14c015c87c1ad8_0019.0009_none_46cee39b7	dfsvc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0009_none_a39de4de296c547f\Files\ScreenConnect.WindowsClient.exe_6492277df = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_fc6eafea63709ad9\scre..core_4b14c015c87c1ad8_0019.0009_none_42570bba4 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0009_none_a39de4de296c547f\lock!0c000000a290580e2408000068100000000000000000000 = 30303030303832342c30316463656164343164303062613465	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_0019.0009_fc6eafea63709ad9	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_0000000000000 = 68747470733a2f2f736f706f7274652e736f66746c616e642e636f6d2f42696e2f456c73696e6f72652e53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e392e31302e393534352c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0009_none_6f525cc3ae071fcd\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_fc6eafea63709ad9\scre..vice_4b14c015c87c1ad8_0019.0009_none_f3aaa402d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 54007200750065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0009_fc6eafea63709ad9\appid = 68747470733a2f2f736f706f7274652e736f66746c616e642e636f6d2f42696e2f456c73696e6f72652e53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e392e31302e393534352c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e392e31302e393534352c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0009_none_42570bba40887172\Files\ScreenConnect.Core.dll_b96889d378047e27 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0009_2edb5b65a541b952	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0009_none_d86c698c4fd7c776	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_none_1cd80acbadc242ca\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e392e31302e393534352c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0009_none_6f525cc3ae071fcd\DigestValue = 119fdfe9e1616201866ae517a906330afc252d40	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_2edb5b65a541b952\scre...exe_0000000000000000_0019.0009_none_6f525cc3a = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_2edb5b65a541b952\scre...exe_0000000000000000_0019.0009_none_6f525cc3a	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0009_none_6f525cc3ae071fcd\Files\ScreenConnect.WindowsBackstageShell.exe.c = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0009_none_1cd80acbadc242ca\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e392e31302e393534352c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0009_none_6f525cc3ae071fcd	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_0019.0009_none_6f525cc3ae071fcd\Files\ScreenConnect.ClientService.exe_e781b1ee3 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0009_none_f3aaa402d647d4dd	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0009_none_46cee39b7cd684a2\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32352e392e31302e393534352c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "W6KMKZT9H4R9YVZ3P5H3T92L"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0009_none_1cd80acbadc242ca	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0009_none_a39de4de296c547f\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_0019.0009_fc6eafea63709ad9\scre..ient_4b14c015c87c1ad8_0019.0009_none_a39de4de2 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0009_none_f3aaa402d647d4dd\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0009_none_46cee39b7cd684a2\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0009_none_a39de4de296c547f\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_0019.0009_fc6eafea63709ad9\lock!11000000a290580e2408000068100000000000000000000011c3 = 30303030303832342c30316463656164343164303062613465	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 30000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0009_none_a39de4de296c547f\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32352e392e31302e393534352c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\B9VQJWR9.PAN\KJ0EBBKN.H6V\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\RQX9PG3O.65G\019LRM5A.38N\scre..ient_4b14c015c87c1ad8_0019.0009_none_a39de4de296c547f\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4256	2026-05-23_c8efe06250c95081ac649735476e35e9_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Token: SeDebugPrivilege	2084	dfsvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 2084	4256	2026-05-23_c8efe06250c95081ac649735476e35e9_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-05-23_c8efe06250c95081ac649735476e35e9_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_c8efe06250c95081ac649735476e35e9_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  PID:2084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_0019.0009_none_6f525cc3ae071fcd.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\RQX9PG3O.65G\019LRM5A.38N\manifests\scre...exe_0000000000000000_0019.0009_none_6f525cc3ae071fcd.cdf-ms
Size 14KB
SHA256 17f7d0419892ec8309579fc0c6a4add81bb5f92b50d9137b29e1297b0eca647c
MD5 5447a4de86cdceb057860f5f418316d1
SHA1 a7c222a428e97791db289fa186a7b2645b153162
SHA512 2e64bc6ec70a870f3876d9468606e6f964be5cf95a5658ce798885c4d80d96b3261665132736c3b662e4be0bc3053ccb8e9b0acf95e95104410011ef3e89fb49
SSDEEP 192:PW5wHXpFr1Vg8NOWAChnS6iDrgXVeXK7VIfr8o5x97c4TgfZKnKpQz+BkTjZa4:P1jr1xNXdnu8VeaO5XtWyoWjZa4
TLSH
T11962B321F784F033E2624B339CBAE6D177257DBA2EA511977084333D88715998F31796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0009_none_42570bba40887172.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\RQX9PG3O.65G\019LRM5A.38N\manifests\scre..core_4b14c015c87c1ad8_0019.0009_none_42570bba40887172.cdf-ms
Size 3KB
SHA256 f236971900e50fa33245745b7306ace5433e85492fd1688d5cf4fde427c70f82
MD5 cb14d1201b46200817c53c5d0ed2e744
SHA1 e7afda634b03a8a6e887d7fdc1774bed23cbebd8
SHA512 b9358483f539b0a470ce1ff84533f74983347823a712809532aae3732eddd0e34f9b8d4233dd8f72ede9dc799589b5271c84aba2704c79a283a0aa2a633d4dc9
TLSH
T19861DD027604DA17D9A90633ACD5D5EE27743E83DF81860FB4C47F2F76322B956212A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0009_none_46cee39b7cd684a2.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\RQX9PG3O.65G\019LRM5A.38N\manifests\scre..dows_4b14c015c87c1ad8_0019.0009_none_46cee39b7cd684a2.cdf-ms
Size 5KB
SHA256 d2244a51fcf84e3679f6b3a1eea76fca0809cb87385e8ba253deff96a81245f7
MD5 760ab20d0adb0826d9d062b34082f47b
SHA1 2fc7c7d8f2c7e218f7881c12c1b39fcbc5390a2e
SHA512 bea3ebb7be11bc40b1afc90bf7dea2983a04c7a494710d36e585b7573391a45db80b9a7313ea4b2b62cfa63280c40f758b64200430cd0a54a59f37db90e5bf64
SSDEEP 96:kPP+RxU9LVeV+Ww7IkROuZN+/nYGoB3SAZgZpngnsRTu:JRxUNqJsR5Zo/Lo4ACVQeu
TLSH
T1B2B10D117288C917D5B90A33ACE6C3ED2B647E42CE43460B74C87F6F76322EA4722295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0009_none_a39de4de296c547f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\RQX9PG3O.65G\019LRM5A.38N\manifests\scre..ient_4b14c015c87c1ad8_0019.0009_none_a39de4de296c547f.cdf-ms
Size 6KB
SHA256 04fee6776a820b674a212c8d4e5a0d5c37f0722c44e1882e2d20d5325ba02261
MD5 fcfc6eb5f4f179a0bad25ebbb0b6a04f
SHA1 841e8ea16e0514241e36e48651af0d9185a8bb7e
SHA512 9599c06b37592ceb5f7b32a47042059bc67a772ba518c2db2e832846c471bc39347f6c314814e2d013a4515a3c429a2768f0e2d7c2275310e424b1ac4cf62380
SSDEEP 96:PeQaoeV+Wwwq8WLzm23j5gd6N+LrozETsVR/Xka8M:RanJuLnCLo+sMaR
TLSH
T17ED145127280EE17D5A90633AC9AD2DD37767E96DE43431B70C4BB2F7A322E61722055
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0009_none_d86c698c4fd7c776.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\RQX9PG3O.65G\019LRM5A.38N\manifests\scre..ient_4b14c015c87c1ad8_0019.0009_none_d86c698c4fd7c776.cdf-ms
Size 2KB
SHA256 95f7f8a9368f045319efd774341af584c0efad95f56221b405947931b5bc674e
MD5 7752ad350a4484ec66be224bdfd19ef8
SHA1 b9d6548642f88b17d3cb19a568b8c59f7c3c373d
SHA512 bc246f39f2d7ac798427b2fcb736807c2e6165c14c3d3a6533377c34e3609977a6a47acb95fdb9aeb0187ced9cd1ec0a6c3c4f2dfc5dcab57f30765dcf691e2e
TLSH
T15951AC043688EA67C56A1633EC92CAD93335BE43DF560317B0D47B7F7A713E58A12192
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_0019.0009_none_1cd80acbadc242ca.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\RQX9PG3O.65G\019LRM5A.38N\manifests\scre..tion_0000000000000000_0019.0009_none_1cd80acbadc242ca.cdf-ms
Size 4KB
SHA256 9d2f245aefca0276c42ebb3bd430fcb5f617e86fe410c3c50d9db6549f446003
MD5 8bb5cfc9dcf6adf61e9d6bf1aaea751f
SHA1 e42a7c8c0441ab3d90c0331624012d11dc8ecc9f
SHA512 b60dde88dff5a565c6137e2e685167a46244b9e869e818ad940892d2821bbc78ec7fcf2b826c0072cc0c8169d2a878d3347468fdb403e96335013d27257d60bf
SSDEEP 48:nrP/mrIVAjIvrMmg0Ru9o0m5RD7zKU7gFUTUEVkEYXt4sQgbmZFms4Ch+UQRcb:jOUQGXEW0m5R/2Um2khQPfmvVUQRm
TLSH
T14B910E80B740E823E6145732ACE3D2D032357DA64FD7971B70987B2FAD367C596222A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0009_none_f3aaa402d647d4dd.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\RQX9PG3O.65G\019LRM5A.38N\manifests\scre..vice_4b14c015c87c1ad8_0019.0009_none_f3aaa402d647d4dd.cdf-ms
Size 4KB
SHA256 088e4d95ddce5b37f47d7b0f2945aaed6a4a66d845b5bf0742d0b6d9b304557a
MD5 5441a234145b3da934f4d3cb504baa50
SHA1 39514fa83bfa5ca3a715db75fc153ee54e54bc9a
SHA512 cef985609e7019c23cd1a82c834e5c793b4cef3ff77a14346062d201c5c2862714ccf420d39777333637a55e90a794c892dacb8c36124b981afa8b900a72aa54
SSDEEP 96:AbKeV+Ww8q45uMLN9rMJFMuZeWVGQITv7QNf:6JZuMpmtijvM
TLSH
T16F9142117280EA67E2A50A339C96D2CE7B367D92DF42470B70C07B3F71356E65F21196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\RQX9PG3O.65G\019LRM5A.38N\scre...exe_0000000000000000_0019.0009_none_6f525cc3ae071fcd\ScreenConnect.ClientService.exe
Size 93KB
SHA256 e7ac6dfb146c2e69fb33753492b692eaf980505781914fc7bea9fefe439a734d
MD5 01687c649432932854285d807f53b430
SHA1 1bcb958dd54f7790f1a976e42d099dfba0e0ac16
SHA512 201f0702731c6e37af60fcf960995b7ae88c8ce4415ff75d246d2b0116c0850858d3ed64bce337d226602d64fc81efc4ef3bc814de9010ff2f313e5156148530
SSDEEP 1536:tg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUfT0HME7U:+hbNDxZGXfdHrX7rAc6myJkgUfT0HVw
TLSH
T19B935B13B5C28872D573093158E0DAB09A3FF9215E61DEAB3788022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\RQX9PG3O.65G\019LRM5A.38N\scre..tion_0000000000000000_0019.0009_fc6eafea63709ad9\ScreenConnect.WindowsClient.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

88733LDO.XC8.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1KX1EJOV.54H\88733LDO.XC8.application
Size 170KB
SHA256 f7eec99f7213a2f0296cfd563059be3437d8ea1eca930d4ddc9875f41373b44b
MD5 b099eda5a462f2c4492a90c85f67288e
SHA1 64d7a8e780afbb42675d130a363e110dc2a0909b
SHA512 e0c7715503ff87e95aaad4140df09de0d8fce84070e0e88cb5542c2b9322bd7721b5578ac16b8308945c10f0ac544d9e099ab7b7deefbb4bfeab02164303a713
SSDEEP 1536:n/iBHhe2WCRSmQfn4/5EHSZ5GE/uLTvooycu5KQ/IuK7E3GSnKDZNq3nxLZMdC+v:n/YHhlWCRbW22XOcu5X9ZiXi5yzznf
TLSH
T11A04613A8E30F5C0477DB421D1692D6B3DC11B93DB731FACD90A18A60E69396EF1A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B9VQJWR9.PAN\KJ0EBBKN.H6V\ScreenConnect.Client.dll
Size 399KB
SHA256 e08674490da57536fae94818d80e9959f61142c6bd558e23f704b7a7b6804c64
MD5 46e9a540da86b9ffe3f74cc9de8da9c6
SHA1 cfbe1f1dbedfc8a91a2fdf7b118d83e80fcfe1f5
SHA512 02955bae1d9c7ecbd9d06fd89a70b81d731a9e0a1dcc553c04d445f17edf4e38fefc6390a10d73b7b710cde60f465dff88468df8984d6fce414e2f7706e49602
SSDEEP 6144:EMq4l+zvJNDZvD8ETEavHy+vd7JPYIYyqQni65/PGOD:L5+v5DHTEavSW7OQni3w
TLSH
T14C94BF86B3A44C6DFF6F0A77F45041299E73AC456552F26D4E04B8F90AB3BD28740BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B9VQJWR9.PAN\KJ0EBBKN.H6V\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 7301fb27f13c8f662374da4da3842ecdf5530d44ecb53528f8b1e8ddbbc2bc2d
MD5 0b5e6effceae83ec4651402649bedc29
SHA1 95d0f6192d6f22532f92b583df3639c9113c405b
SHA512 cdf27ab9b39362f36f242258769aefdd8bd898fe82bba5b4a2cb31bef2ab5cb04af427555d4a7758ced3a9749ed1c6fe016ba7771fb14adf3977cb328a784a5f
TLSH
T197117B0581C8FA261F3301D1BEE7E021576E1B37048E194BB0696DAF8B2DBE647971B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B9VQJWR9.PAN\KJ0EBBKN.H6V\ScreenConnect.ClientService.dll
Size 78KB
SHA256 aceb9a2c3ad257041c2467c69b026b938d8ffef38644baef935c02c0be2d01f7
MD5 d2e9496d772ef9d7bee5a4ca48066855
SHA1 4ca765faf2b114c2e78607335654c6302d9af962
SHA512 fa712286c5e1e51247b9923a4652ed8a2a1f7a7842b4111de7f6ebc77aa9942881e5b3fb68efd1ac76589c7616d75248bfbb5713329a736cc8de054de2493c65
SSDEEP 1536:O/7xQmiDHn5f2yoI4vn3R0as57k/QQV3lTdmkbPlC57K:K7xQmKH5eygf3R0H0QQVFdXC5m
TLSH
T11A734D41A3AC5E26C9DF4F787465B0450F709A02E4A3FBDD9D8EA4EA1B563C12E043DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B9VQJWR9.PAN\KJ0EBBKN.H6V\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 3aed96134a6a23aba5b06880e3912aa4d2dbeb7a90bf460975ed96464fd421ed
MD5 4109d1216988c013ea88c8ef7f0e3210
SHA1 1ac951007dc095985729a931d806751ed1fd4c5c
SHA512 6a9bc22a24c66b57ce2dbddec90b26f2f26d3b2440b234dab083b60958138732bfc8ad4d6bafa0ee691f4d24c7e6b7d744c7fd0e00629f0f1067e7e0c94dd44c
TLSH
T12431E70681C8FA251F3302C1BEE7E0619BAE1B33158E1947B059599B8F2DAA6479B173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B9VQJWR9.PAN\KJ0EBBKN.H6V\ScreenConnect.Core.dll
Size 553KB
SHA256 301744db4e2da7351d05d117b4ff3620f9dc21de5ce41260a647e07232485f25
MD5 d49f1e1437a60a7d23e22831a928e228
SHA1 c15bce21aced2653211efa417816ab66c2385651
SHA512 5ea376e4f87637418f42d50cc82e097e9c8355e82bb340cb03ed8ee0622211fd05b4c5bd6a20f83e55dfba835714c26298f840e03ed3babed4757a96cc35f16e
SSDEEP 12288:M+IY2aqteJvg7FwVzP/DVzeCXV8VNNve49HWpEAby6X/fsM:c0QoZ4aH/f1
TLSH
T154C46C5233E8873AC56F1B3AE420D6150B71EA00B05AE76B25DEE4E91E837855D0C7FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B9VQJWR9.PAN\KJ0EBBKN.H6V\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 3fa5b2e7463e32504cc6f0a5b40214a57747ddde1f61ec8e2fd0962e1fdb4e99
MD5 ec0e00361f15bdda5f508d9708d40b2f
SHA1 3a94903147b2bc12f1520439d909f3c8b81de848
SHA512 f7e94ea29dcd5be11285aef02ad33ddc44310ea8aaf24b0ddfe291c110f4c11d0bfc186cbd719f93a34148e1b8c7a0739516075d01bffd77ccc46c5b6a6eab49
TLSH
T15521370181C8FA261F3302D2BEE7E421979E5B33188E194B7469699FCB2DAD64747173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B9VQJWR9.PAN\KJ0EBBKN.H6V\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 59c51554b09e765d2dd0aea37be681c11f6d0ca4317441ee30b25b1ebcb81928
MD5 34dcb69872c7c5691237fd2f80ff4518
SHA1 7b340c4b04bd961850c3aa7b79ad7bc35b67e5a9
SHA512 383f4495b01e9a7e8f8fbac68c5c9daebbd0c7e07cda0cd0a157cdf0c3160336f1210a2569d180dc906a40cb995e192d7605723198fe82bf4b8e2e817085a3ae
SSDEEP 24576:Ltp8Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTZ:Bp8JkGYYpT0+TFiH7efPs
TLSH
T12B85AD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE356D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B9VQJWR9.PAN\KJ0EBBKN.H6V\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 8246751d2a09c7348036e710b7cdf10c038838230ba9a204ecd2f3336c716b3a
MD5 b2bcfac0132a3f9e4c0fe1d0dca2ae40
SHA1 379b1cfe09f0283b8d110749a15dcca6e6223754
SHA512 fb464dc86ebd2b18978b98f9019ef6cc6cc9ffd349d5602674ce36fee093cc2656bf374d59b826d80f3bbeb25f98e929498d107f0645ed7874aefe78dff312a7
TLSH
T1E941E11681C8EA250F3301C27EEBE431879E5733158E190B7499AA9BCF29AD74787167
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B9VQJWR9.PAN\KJ0EBBKN.H6V\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 6e60738752dd9e1ad6d017f948f3e9da6a55bd8c358dd57f8c17232a69a2bce2
MD5 ee921bee985b375a696a890c624e3a84
SHA1 abddbe2112e2a6fd57ce92f7dd081706b9a0d6c7
SHA512 9e348d2801d161a429c75bc60d85f1576e4c3a0589ca4b135f0ba47d129f3decb67bfbc2323b53e111cc9f3550d991ffcdcd08861011cb87e9c41298d10b998b
SSDEEP 1536:poSOs/MRZFe9aT2DvmDTyQX5E+TC7Lh2syGbnU87v:poTsCZFe9VmyQODjU87
TLSH
T182538E4163E84615C9FF2E7CB8F2A1141EB1AA439441EBAE0DCD65EA1E537815F303E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B9VQJWR9.PAN\KJ0EBBKN.H6V\ScreenConnect.WindowsClient.exe
Size 604KB
SHA256 667b219bc294be007d55fb4a94c62ec58582c36c051e15b202664ff23b4c627d
MD5 922a53a63b7c963b121c2705643cf8ee
SHA1 dd1a5c21efd06e9fb06cc08fe2a6081613db537d
SHA512 32862ea63f958655fbd1f1f6ea5f601bb33f2714838312247401528da5911d02ab9fe62eefcc83878f1ea18ecd1a7f9f3e634c159a98f03ff3efbd0f4bd8c645
SSDEEP 12288:yacSlKUy8wjSPIDQVrW/C1qE6+z+kYh+C:G/8wekCYyCjhb
TLSH
T128D46C2173BC8A3BC4BF077BA0A11E6857B0FC0291C5D79E5924A8E94EE73D649443E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B9VQJWR9.PAN\KJ0EBBKN.H6V\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B9VQJWR9.PAN\KJ0EBBKN.H6V\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 c7f619e579e257739ed2c5bfafaa9788f873184fd9d65a1765c7b0ec5068af90
MD5 e6eed96299c8a1254b4f8c23d500b878
SHA1 2cde7630b64bdc06ab6a38d5ba41570e7c74aa84
SHA512 12cca86b6132cfe7cb62292e99b6b7e1a75eae28808cba8a7227aeacaba531e2d540bfea9d34202b09641bc86d86ae66f36e27e0e116d7028313762ed2bcd759
TLSH
T13C51B40641C8FA210F3301C1BEEBE471979E5B32158E194770999A9FCF2DAA7478B177
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B9VQJWR9.PAN\KJ0EBBKN.H6V\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 dfc05c833eb1aa74e8179b11b109606639783f55c722ad7bfa81ef87830480cf
MD5 af1ee26dd1184d588024de7e9beda213
SHA1 119fdfe9e1616201866ae517a906330afc252d40
SHA512 7d1d34dee8fd971d36a79cadae96a5728f169cfa2c7aabe6683ad6182ab7a0aa65a338e12c7b60288abf89fd0a1795379a9de24057c51025d211adaa65b513bb
SSDEEP 96:xWLwOhoyTl/e2wvypYkck5akjkkfpkTqke9kF4kOpQkOprkjAkOpD:oRxegdJ5zjhfC3eeF9UFUAjVUD
TLSH
T1F8F1AB9684C07D21573381C0FEE39924BE157F3302AE148ABC4D1AAF9F765499B972B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\B9VQJWR9.PAN\KJ0EBBKN.H6V\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 e0c20e61219b2204d91eb524aeeeed5d3d92993418b8e684ad1d03af761af376
MD5 329c8ba250f3048533388333d001b228
SHA1 44a0298e89f6bef8913f1f249fe0dc6870de96a7
SHA512 55c1c817dba58c7582896cf9fc38005612b4f508914a282ca5227719c0fd34e7a867eada4193da6c2347d8024761a94cd19d6519344e85e721414a0e553f6219
SSDEEP 1536:Gtyzl44wzbdI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Mxd7px:FRkukLdoxd9x
TLSH
T11483E68235762231DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03443A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2084-49-0x0000025767090000-0x000002576711E000-memory.dmp

Download

memory/2084-321-0x0000025747010000-0x0000025747020000-memory.dmp

Download

memory/2084-55-0x0000025766EC0000-0x0000025766ED8000-memory.dmp

Download

memory/2084-58-0x0000025747010000-0x0000025747020000-memory.dmp

Download

memory/2084-62-0x0000025767360000-0x000002576750E000-memory.dmp

Download

memory/2084-341-0x0000025747010000-0x0000025747020000-memory.dmp

Download

memory/2084-12-0x0000025762910000-0x0000025762A98000-memory.dmp

Download

memory/2084-27-0x0000025747010000-0x0000025747020000-memory.dmp

Download

memory/2084-43-0x00000257670A0000-0x000002576713C000-memory.dmp

Download

memory/2084-11-0x0000025746BE0000-0x0000025746BE8000-memory.dmp

Download

memory/2084-15-0x0000025747010000-0x0000025747020000-memory.dmp

Download

memory/2084-37-0x0000025767070000-0x00000257670D8000-memory.dmp

Download

memory/2084-17-0x0000025747010000-0x0000025747020000-memory.dmp

Download

memory/2084-26-0x0000025766E70000-0x0000025766EC0000-memory.dmp

Download

memory/4256-9-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Download

memory/4256-7-0x0000000005340000-0x00000000058E6000-memory.dmp

Download

memory/4256-8-0x0000000004E90000-0x0000000004F22000-memory.dmp

Download

memory/4256-13-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Download

memory/4256-10-0x0000000007B80000-0x0000000007D2E000-memory.dmp

Download

memory/4256-6-0x0000000004D70000-0x0000000004D94000-memory.dmp

Download

memory/4256-5-0x0000000004CD0000-0x0000000004D5E000-memory.dmp

Download

memory/4256-4-0x0000000000DA0000-0x0000000000DA8000-memory.dmp

Download

memory/4256-3-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Download

memory/4256-2-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Download

memory/4256-1-0x0000000000D70000-0x0000000000D78000-memory.dmp

Download

memory/4256-0-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Download

memory/4256-14-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads