05578523c6cf1a5e29043c1c7439a29492b3cde8f5a3dbd37868cf3077071bec

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 13:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_284c8567d21d74372780c5daed6e86aa_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Size 2.5MB
Sample260712-q8ssaaa16l
SHA256 05578523c6cf1a5e29043c1c7439a29492b3cde8f5a3dbd37868cf3077071bec
MD5 284c8567d21d74372780c5daed6e86aa
SHA1 38e859a6530c845f58850866fa17cbefe1307d7d
SHA512 43eef39bc7173a99e0afe0ec47c6ce336d2d099fdae566f9363adf1d9befea05116c95e6e25999660118270577cabca3c9d0bae4b7a3c43ca83d30675031e66f
SSDEEP 24576:1B9zm+OBbV5Z56jMK9jf5UNXFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+Rf3:RcZEUNXJkGYYpT0+TFiH7efP7tY
TLSH
T1ABC5BE01F3D695B6C4AF0538D47A921A6774BC040366CBFB67C4A9B62D33BC09E357A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3160	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\NLTMJ65N.HHZ\TXK380VV.PY1\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_284c8567d21d74372780c5daed6e86aa_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4\lock!12000000dfb4590e580c00002812000000000000000000003 = 30303030306335382c30316464313230363434613739313435	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0003_none_0b1fdd4ed2a7cba1\lock!10000000dfb4590e580c00002812000000000000000000003 = 30303030306335382c30316464313230363434613739313435	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0003_none_994db135f551829c\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0003_none_ce1c35e41bbcf593\lock!0c000000dfb4590e580c00002812000000000000000000001 = 30303030306335382c30316464313230363434613739313435	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_b09d76868228b17e	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_0000000000000000_57051d5779c6eb7e	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_000000000000000 = 54007200750065000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0003_none_ce1c35e41bbcf593	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0003_none_3c7eaff348bbb2bf\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0003_none_3806d8120c6d9f8f\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_ca4a6bd0cdfd517d\scre..vice_420d02d3849b7992_001a.0003_none_e95a705aa22 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0003_none_e95a705aa22d02fa\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_ca4a6bd0cdfd517d\scre..ient_420d02d3849b7992_001a.0003_none_994db135f55 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0003_none_994db135f551829c\Files	dfsvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\OnlineAppQuotaUsageEstimate = "4005619"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0003_none_ce1c35e41bbcf593	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0003_none_e95a705aa22d02fa\lock!0a000000dfb4590e580c00002812000000000000000000001 = 30303030306335382c30316464313230363434613739313435	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_000000000000000 = 68747470733a2f2f7777772e657a6269732e6e65743a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0003_f3bea23cab4de29f	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_f3bea23cab4de29f	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4\Files\ScreenConnect.WindowsBackstageShell.exe.con = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_ca4a6bd0cdfd517d\scre..core_420d02d3849b7992_001a.0003_none_3806d8120c6	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0003_none_994db135f551829c\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_000000000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0003_none_e95a705aa22d02fa	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0003_none_3c7eaff348bbb2bf\Files\ScreenConnect.Windows.dll_fc0d83aff7df0b5b = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_ca4a6bd0cdfd517d\scre..ient_420d02d3849b7992_001a.0003_none_994db135f55	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0003_none_994db135f551829c\Files\ScreenConnect.WindowsClient.exe_6492277df2d = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0003_ca4a6bd0cdfd517d\PreparedForExecution = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0003_ca4a6bd0cdfd517d\lock!11000000a6b3590e20130000900b00000000000000000000532b91 = 30303030313332302c30316464313230363364653035636235	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0003_none_3806d8120c6d9f8f	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0003_none_3806d8120c6d9f8f	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_f3bea23cab4de29f\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2e = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0003_none_ce1c35e41bbcf593\SizeOfStronglyNamedComponent = 2182060000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0003_none_ce1c35e41bbcf593\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0003_ca4a6bd0cdfd517d	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0003_none_0b1fdd4ed2a7cba1	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0003_none_ce1c35e41bbcf593\lock!1a000000dfb4590e580c00002812000000000000000000003 = 30303030306335382c30316464313230363434613739313435	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_000000000000000 = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4\implication!scre..tion_0000000000000000_001a.0003_f3be = 68747470733a2f2f7777772e657a6269732e6e65743a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_none_0b1fdd4ed2a7cba1\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e332e31312e393635302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_ca4a6bd0cdfd517d	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_ca4a6bd0cdfd517d\scre..dows_420d02d3849b7992_001a.0003_none_3c7eaff348b	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0003_none_ce1c35e41bbcf593\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_ca4a6bd0cdfd517d\scre..ient_420d02d3849b7992_001a.0003_none_ce1c35e41bb = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0003_none_994db135f551829c\lock!06000000dfb4590e580c00002812000000000000000000001 = 30303030306335382c30316464313230363434613739313435	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "P03QZEE9ZOWC9QKHQXN4A63D"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0003_ca4a6bd0cdfd517d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0003_ca4a6bd0cdfd517d\scre..core_420d02d3849b7992_001a.0003_none_3806d8120c6 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0003_none_3c7eaff348bbb2bf\DigestValue = 6e19865b53edefa758ed8947b8b97d9cc82349f9	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0003_none_ce1c35e41bbcf593	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0003_none_e95a705aa22d02fa	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0003_none_994db135f551829c\lock!14000000dfb4590e580c00002812000000000000000000003 = 30303030306335382c30316464313230363434613739313435	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4\Files\ScreenConnect.WindowsClient.exe.config_f7f1 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_b09d76868228b17e	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\NLTMJ65N.HHZ\TXK380VV.PY1\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\PYZKL1EM.MT8\43YC4AT7.EG8\scre..ient_420d02d3849b7992_001a.0003_none_994db135f551829c\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	708	2026-07-12_284c8567d21d74372780c5daed6e86aa_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Token: SeDebugPrivilege	4896	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 4896	708	2026-07-12_284c8567d21d74372780c5daed6e86aa_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe	87
PID 4896 wrote to memory of 3160	4896	dfsvc.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-12_284c8567d21d74372780c5daed6e86aa_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_284c8567d21d74372780c5daed6e86aa_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:708
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Users\Admin\AppData\Local\Apps\2.0\PYZKL1EM.MT8\43YC4AT7.EG8\scre..tion_0000000000000000_001a.0003_ca4a6bd0cdfd517d\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\PYZKL1EM.MT8\43YC4AT7.EG8\scre..tion_0000000000000000_001a.0003_ca4a6bd0cdfd517d\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:3160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\PYZKL1EM.MT8\43YC4AT7.EG8\manifests\scre...exe_0000000000000000_001a.0003_none_5d9a2f46d2eca8a4.cdf-ms
Size 14KB
SHA256 26729ab263b63c7e3fd9d861cee50262d176e5a8bf8eb25a24ed78f621482909
MD5 582817d25bf79020625466425d4af9ee
SHA1 927b0fd7d9c4afced9d0bb885aed325188f32ca0
SHA512 4490993df35ede5d3418b12bc042bd537d268ba558aae14f4061cf39c921badda300826988920d78e094c938ec891d488ac53a0cdecae45b18ec5822a8df25f4
SSDEEP 192:bwswHnApMGrMTVqoW2SvnGblIPhZgVZ9A/pX9FZH61nk5+N/UIGnVaGLs/T4:bCgpJrMVZW2SvjQ2ttVaGLs74
TLSH
T1BE62C611BB18F533E2625B339CB6E6C27B187EA91DA5114BB080377D983119A8F32796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0003_none_3806d8120c6d9f8f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\PYZKL1EM.MT8\43YC4AT7.EG8\manifests\scre..core_420d02d3849b7992_001a.0003_none_3806d8120c6d9f8f.cdf-ms
Size 3KB
SHA256 54f6eff949266e1a822b52811ebffd2b652205593f2231d43a08c7e15c0220bb
MD5 eae091b82a9f49632cf8a0dc28adf04d
SHA1 1978b9f41f163144cdac3043b7c023b76cc404e3
SHA512 611ae2dd249f5ba4cf112ea7b27487142c6ad2d9ff2fa4d31071482216d49c75c2016f3a9bb6d0fa17bba88809d978b53cb7ea2fdb326863c3ef79d082d35e5c
TLSH
T18C6120017248DA17E96D0732ACD2D6EE27747E87CE41510BB0C47F2F79325B65611296
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0003_none_3c7eaff348bbb2bf.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\PYZKL1EM.MT8\43YC4AT7.EG8\manifests\scre..dows_420d02d3849b7992_001a.0003_none_3c7eaff348bbb2bf.cdf-ms
Size 5KB
SHA256 d93b59ca86b3d2bdedd1d374457533cf6e93d4fae79903862c9ae5943eea74ca
MD5 d759e4aaa1fae02f36321c9324766eef
SHA1 e8bd2154d677bf8bf5371f40a40d329fa88acfd9
SHA512 a48fd9687d7de03833debef536e795fbe55db8ed4ac357cfb05ff72461172759b96ef66213c9babd0535d10a67948ec3ba40469d4db445b68781df4437bb8205
SSDEEP 96:P3iW+RzfaL0eV+Ww7dIkxN62Swlc/udtk4uwnr+8F:ORzo7JnkrXc217F
TLSH
T144B1351272A4DD17E5B90633AC96D3ED37367E82DE03430B70D8BB1F7A322D65226196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0003_none_994db135f551829c.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\PYZKL1EM.MT8\43YC4AT7.EG8\manifests\scre..ient_420d02d3849b7992_001a.0003_none_994db135f551829c.cdf-ms
Size 7KB
SHA256 5ae6260c699e43646f6e9bd6e1696eddc7d0748744678917d97af57648750af5
MD5 ae0bdf982425c77637b9643d65ef86a1
SHA1 60d9454d241d059a7ce3210750ada78313b76c1b
SHA512 9449d2c74e1401a84b29115b3bbb7463096161767315947055c3faddef1424c977031392337a12772c58d5adcb1dec9a646c07288b352d4c8aa35062f42eb91c
SSDEEP 96:YOO/ln4ka+eV+WwwB861O+nLNv+pGsE8eof7SolqfTbN6:JOn4XJV19B4tLe6
TLSH
T1A8F157027694ED16E5AD46339C9AC3ED36357DD6DE43530B70C4BF2FB6322E61222096
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0003_none_ce1c35e41bbcf593.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\PYZKL1EM.MT8\43YC4AT7.EG8\manifests\scre..ient_420d02d3849b7992_001a.0003_none_ce1c35e41bbcf593.cdf-ms
Size 2KB
SHA256 f8a00cb594cb1e50da1080c4df164f6df64124daa4aac992e4aa3a74f247e16d
MD5 64fed22382df3d76de3131ea6c26f299
SHA1 d5537e8eca1ce6e8a8404d55e6ac81570342fd9e
SHA512 d9156499556fc905b64a3d44ecaf4920b2d8224bf956b6dbe22a7002129ec90fcecd85445359dbe9b784b0145f7f527697a1cd98c4d32f3016e0ad11940b4bc7
TLSH
T1D35179057684EA67D67A0233EC96D2D932367E83DF07031BB1D0BB6F7A716C55612092
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0003_none_0b1fdd4ed2a7cba1.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\PYZKL1EM.MT8\43YC4AT7.EG8\manifests\scre..tion_0000000000000000_001a.0003_none_0b1fdd4ed2a7cba1.cdf-ms
Size 4KB
SHA256 95c095dc16b6b85294e5bc82124746c475e37dcb6e7d4cd3620375456e8c9504
MD5 28569f10fdafebdf4481e75b8c417d05
SHA1 5ea7d490bc6b1ef71f072d4b32cf2f10b67f07cc
SHA512 b0cda77d223ca6b5f31276215a1f1eacd584deb6b3621e2841b56bc36ef72c618921c94b87928c35ccadda54f7b870b16d3260d4300bdd0f2aff2b0da2658d4d
SSDEEP 96:jOU0GkEW0m5R/xUm2km/VC4t2gcY9MF/uKq:jRe19nY8uV
TLSH
T161914240BB44E923E51847329CD3D2D43235BDE64ED4435BB0D47F3FAE3618A9A22267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0003_none_e95a705aa22d02fa.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\PYZKL1EM.MT8\43YC4AT7.EG8\manifests\scre..vice_420d02d3849b7992_001a.0003_none_e95a705aa22d02fa.cdf-ms
Size 4KB
SHA256 caa4cc9cf316aa535adcf406923004e8b1804ffb6382ebf85eb0980ae8278889
MD5 6056368cc3e742fd3d47d1195e6151fd
SHA1 cb8fcc3a318ef78c2b8596087219697f55c660e7
SHA512 2c4a924207b07588378ca7fe50ae4d05b117a1e6387112d76753e81b11df971723d5ab6330eeba82f63c6886f652c9ad24c15576d28808f240a21c7884ad801d
SSDEEP 96:mQHZO+eV+Ww8B4woGYHXjrIwXfvJ9yCYxQV:sJDoXj5fHlV
TLSH
T136A1DD127340E927E5A90233ACA6C3ED3A797D82DE42510BB1C47F7F75721EA43261A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\PYZKL1EM.MT8\43YC4AT7.EG8\scre..tion_0000000000000000_001a.0003_ca4a6bd0cdfd517d\app.config
Size 777B
SHA256 6fed928e925ec6a90e81ce6c8243051e9e30fef2383f5b9dd9b476a86004a698
MD5 6c05c776af12dc2210d759303f2da7b4
SHA1 0ae6abddfba59f92242507f67caf045abed2e8b9
SHA512 8773c83a749c61e96838ee9be92faad2fda96dc3aea509c539da97c10db575bd04e6f2c6f4baa1d5dbf51ad2bec7a35e96fa46a7e65bbfd8c92ca692caa99210
TLSH
T14301F55C3086BE0D22A76F31E5230250A8B21D732225B4E96AA93077D8357E91BF23C7
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\PYZKL1EM.MT8\43YC4AT7.EG8\scre..tion_0000000000000000_001a.0003_ca4a6bd0cdfd517d\user.config
Size 520B
SHA256 81c2d663cd149b8314ee5c2c6dbcbd3b4c72d70caf9bedbf24897c9fa9e1cbd2
MD5 0d9dca9593492839a850448b0c3f1873
SHA1 ca6098558c6cc8316ee39a145514fa46e3f827f1
SHA512 bd0b9ba15258f5a76100a9b8e33c62ef6e556e33e2572cfe90713b1626c271ae2260a393b1274878f5ab036a8c24c91ea105f4aa5d26b9da83b2d653c2752487
TLSH
T1A2F0E9A131846E4703635E23CA124741EE72679B0555209874AF223A9F315CE03E31CE
MD5 SHA1 SHA512 TLSH

Submit Download

uygdybnp.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\PYZKL1EM.MT8\43YC4AT7.EG8\scre..tion_0000000000000000_001a.0003_ca4a6bd0cdfd517d\uygdybnp.newcfg
Size 659B
SHA256 34895e12cde517171c728e6fa1bafe1044c9a2e4d9b65dc66c46d403d9d6834a
MD5 540de01bcc505b045eaa2dbb5e686119
SHA1 bee49d68415ec6d69c0da09303a9d16e23ed951f
SHA512 2dad90ce59f0266c9e53fdf6ab00707862f96018181a0fda40a5eda66df195d5ae19ff8607832b69059a91fb3bc112e89b73ec50641bdd4a87686b013bde23d9
TLSH
T160012D6571C4AE4703736E32D6214345EE711657016120D874AE213B5F315CA07E32DA
MD5 SHA1 SHA512 TLSH

Submit Download

WCGJYPEB.5TX.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\E7HV1DE3.NZC\WCGJYPEB.5TX.application
Size 123KB
SHA256 3970e26a35a91f2a104e01c58708fd6782bdcdb8d978f8b6093a89aa7150c479
MD5 509baa877461a592d0d56e3c13853eb2
SHA1 b83ff16aa3c5f993510089c5a993edad30e1e9aa
SHA512 16a515c999d2f6c60ec82ebe821de527d6d9631ae49ca63f17dee27a82dfbfc1fe11296252a280a9a8fc18f206fd84206f8e0a86108247db5acb6af1e012b15b
SSDEEP 1536:KwXagXm5zK+zuLD4UABnjRnfduUW5Ab4KpSE5GP/uLTvooycu3jkXUxCH/h9iKQt:KwqgOfuuBn1nfdvg2XOcuzkJfh4X1
TLSH
T10FC3D53ACE30F4C047BDB021D1A52D673D811B93DB730BACD90A196B0E69796EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NLTMJ65N.HHZ\TXK380VV.PY1\ScreenConnect.Client.dll
Size 412KB
SHA256 dd73e93a5cb9af55ba0161d7166f277885d5ab64aafd1c99b406589448d7cbbf
MD5 6b58e99ddcaab8eddfdb1fe140329d9e
SHA1 adbabe9dc84f77d386f83bda92e0f2087a3453bc
SHA512 46a37b16f8b0e231900a111c4b40c377c0265cacbf7600e1e96e5ce873733f92a333e26a422a2ef659f2b8b45a98ce26b18194255d9abfc5384d0192e367da49
SSDEEP 6144:WS59LDc+cH1vpy2Y5sD8ETEavHy+vd7JPYIYyqQni65/PTL:tpc22xDHTEavSW7OQniOL
TLSH
T1B394CF8163E85D6EE9AF1F73F0A1A1344E72BC056182F2EE0D0475F51A7B7828B546E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NLTMJ65N.HHZ\TXK380VV.PY1\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 9756b394e791c8c4adc81f0145065067bc4b359a44cb65a878fc518107d5e313
MD5 aa30c5cea510f2e7e4a93b7ad43244d9
SHA1 913e99dbd5dffa92714639a960da85fb174335ec
SHA512 ab0b99071073359d161cc535b5a89e4597e5af203f8666ec93862d96868f2d594b253b4a9af2d2b99a0274305aec3d853955813a8461b32e748a31b401dca501
TLSH
T1E7117B0191C4FE361F7341D1BEE7E420676D5B37048E194BB0A9A89F8B29AD743470B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NLTMJ65N.HHZ\TXK380VV.PY1\ScreenConnect.ClientService.dll
Size 91KB
SHA256 da7e34b666c7f314507747d198fbe350dffbaa1cdd0f12b77f6b6cf4a0752a70
MD5 b74b170e0fc61885868f3ea11e0e71cd
SHA1 5e318a1a25a1f24a0dcc114239c3ec9efb081fbb
SHA512 3db2e999470629a40f0202d318222c8ce76864b2ddd411c35dfb5b527f1c3f4183c610e2ea320030790d72f3233a0ed4823780f3d85f7344b61d3923ab720c2b
SSDEEP 1536:dz0NAdGN6i9C4+Cm49qAqGWZa+QOV+eLD0GUazxDa91g0fI7v:dz2pz9Eyt0QOVFDtUazxDa91gyIr
TLSH
T1C1936E0293BC993AC9EF1E34B461F1A106B1B913D4E6EBD8AD9820DA2E553C11F543DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NLTMJ65N.HHZ\TXK380VV.PY1\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 3c1bbc973bf04d381254de977c233d0bf684c626cdf5ae6331011b5ef1d4f916
MD5 00fcab2ac7a8cff5547ab96c1b1c1ceb
SHA1 91fec1fcd9cdbffd461b6a2e6d72951d119379fe
SHA512 17bf9f8a81cd230c113ce8988c281a607413c795677b418de76376dc737faf7b243c9d9ee0718676929150d5062e0ac821d4551335e11443b00657703150b605
TLSH
T12831161191C4FA351F7302C1BEE7E0609BAD5732148E194BB099A99FCF29AD7434B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NLTMJ65N.HHZ\TXK380VV.PY1\ScreenConnect.ClientService.exe
Size 93KB
SHA256 0f07715d8f303e3986005939334adf6868a9d6a2e4043f75c672e4997fffcf16
MD5 78eead5b916f78738a8684a97ac4410e
SHA1 040d62cd0802927eb6ba358c92042b130bdd2ffb
SHA512 6c3f8943f2996c92363cc4795c1ebfebfdcfd7b2c3dece7aad7e57cea06552357741e30f34cc4d2b2f022893fafaa49453605e24fd200854d86e3e01c29bcac9
SSDEEP 1536:ug1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgkT0HM979ja:/hbNDxZGXfdHrX7rAc6myJkgkT0HwRa
TLSH
T1F9935B13B5C28871D573093158E0DAB09A3FF9615E61DEAB3788022E4F742C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NLTMJ65N.HHZ\TXK380VV.PY1\ScreenConnect.Core.dll
Size 577KB
SHA256 17e195a714e72ee8652dc30bd22c0a25daa912d2bd105ba16dfd4411d2910118
MD5 4503f6c7cd6d3674b8ed6863737e4193
SHA1 8d0c7997341a323e8a227a569613433cfa4fb7b2
SHA512 dae4d0a0eefdcd0df4f2067a301a5563717b22a0ad9492faaf78390469d4456c076319f575cd53e749443870424979c4f10e67d641853a5e687660994f289bde
SSDEEP 6144:6Jv2GNGf5J8vWxUpiWKHSznYN/sbj+ymBbVEBKOS0om8lrArArb2iS/ChwDTax4L:+2Qq/G4PSzm++ymBbV50QlrFrb2iEMm
TLSH
T1BAC46C597394C677C9DF177DE03091560670E80464ABE3BB3AD4E9EA2C63F8C9E442A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NLTMJ65N.HHZ\TXK380VV.PY1\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 84195d6f58f5aa7a6dd8fbbb1460de14902cd509abfc6922608b510f0c3be314
MD5 696316a43e1105564ef59bc40f07f627
SHA1 92cdf78155c1925c9d58578f69e83ead98e8b270
SHA512 dd4ee326ef2dc2bce69fd2768104194998bad9ee440b018f4bd36413996cd272effcd47e0416d35a98576a508183befc2d92d08e350be7a1e96db5e1cf650fb0
TLSH
T18B217C0181C8FA261F3302D2BEE7E42197AE5733148D194B70A9AC9FCB1DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NLTMJ65N.HHZ\TXK380VV.PY1\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 ae0c7c3521b905606367a8e8cb7f105b2eacb84ae86db4a5766b9b97caa4c196
MD5 ecdcf1ab52f84e0e15ab3c7347c61718
SHA1 6e19865b53edefa758ed8947b8b97d9cc82349f9
SHA512 d3dd7d4f08ea85836fc0971b619cb4eee33e9fa2e6a30fc72a8db410b378cb280d32a59bf0f0af158eeecb9d688dfd1fbf4fdbb4279bbf49c8418ee14fb32c04
SSDEEP 24576:G9jf5UNXFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPy:mUNXJkGYYpT0+TFiH7efPL
TLSH
T1EB85BD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NLTMJ65N.HHZ\TXK380VV.PY1\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 3e29cb9bb7b2ba80e5e1e2c2501defc32326e98eb0411917d19296e638cc2899
MD5 814208d979bf651c8d802ebbb9568604
SHA1 95e016f207de96c05fcc24e0b2a7ad57c3c85735
SHA512 12258dede4efb675f24004bae8ac4f0759d853db2ab144e6e5df02c6affcd9c08afc29193028e5528bf8bfb039725b324735e7b9b35344779e85114af5c838a7
TLSH
T15C41D01281C8FA250F3302C2BEEBE431979E5733158E194BB499A99BCF29AD74747077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NLTMJ65N.HHZ\TXK380VV.PY1\ScreenConnect.WindowsBackstageShell.exe
Size 71KB
SHA256 3cbde2a13ea662f8f3c7a79ab01c47943b548491aac2a649c5f9337eb24bb9a1
MD5 a88164f766e7a3a5653dffa846db7855
SHA1 a6ea26a589ceec21626a237950bdd4201d15a804
SHA512 134f3750d6417e14c145e89b803a254960f4f8b767febe5779155977b81559ee1ab3816745c92964eb8bd54e3f6788e669f00105a6e594a33351d8dfb2fb3a8c
SSDEEP 768:yTzlYsf/wCdOBti13kDeuRsUQHjSz+dvmDSmBsuMQX5E+TCMXESsl3q7sBYiDLkM:qRYKtd739PD9dvmDqfQX5E+TC7BusB7p
TLSH
T1C5637D5023ECD525E9FE1E34B1E1F6200AB3BA63C8E1D7D92DA821DA5E137C14F64396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NLTMJ65N.HHZ\TXK380VV.PY1\ScreenConnect.WindowsClient.exe
Size 675KB
SHA256 70e5d853c9f666153eaa43c15f2111b5dfdab48e4465a93ce948a913d7e2d564
MD5 c8f9f546232495591184e618a5b5a378
SHA1 0c6e965a101dfa8c974f1b77c88e63776607610e
SHA512 cefd6157539b433a5a05d2dc78320a78b418bdb94e030b8b13f34b8357e819c7823816659e741b326585a63718d508caa0d8447059831fefc42a44d54434081a
SSDEEP 12288:Z4RAIx8hUz6R9OtLlmXvKklQwshBLoEnXF:GNxlLupmh5HnXF
TLSH
T130E48D1133BC9BFBD4AF4B3AB067091457B4E8027185D78ED944A4EA1E827C49E463BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NLTMJ65N.HHZ\TXK380VV.PY1\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NLTMJ65N.HHZ\TXK380VV.PY1\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 801cb4737f452dd96a317ab34a8895effb0b19d83643d95b5e2c41e2fb49f3f6
MD5 1803bd303ad8d22a1099fd52b581a45d
SHA1 def2ade59d114059fe8c66f3fc7237b195efb81f
SHA512 4dcdf9e52b89492b2fe8ddca66458a82d7cb75be8be688f957a67a0f79ed518884d776ba1a082ba2fc12e25fe6238935505441d20b09e230343d2bf81059cf8d
TLSH
T1F051C41251C4FA350F7302C1BEEBE4709B9E5732158E194BB099A98FCF28A97474B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NLTMJ65N.HHZ\TXK380VV.PY1\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 7d55f486bb4f70873ae66500123b3f991128796d4df97f31ffebf22d5c52b98e
MD5 d5325009588decb43517df3e098d1f88
SHA1 43be9857a0755c248d0116ad30dae9c7c1065ae0
SHA512 74c44f48c198b639fead399dcf123ca70f6148c3d6ce8d5c590a67b9124602765e1636ca4802e0fe7cc31433ac3d5b4f1efa8553f23d0167477c7ad3b8f00ae0
SSDEEP 96:xWLwOhoyTuie2wvyJkqokSk3kekQqkXMykA4kOpQkOphykrAkOpD:oRRefqNbUfWXM7A9UFUh7rVUD
TLSH
T145F1CB9688C07C21573281C0FEE3D924BD157F33026E148EBD8D59AF9F625899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\NLTMJ65N.HHZ\TXK380VV.PY1\ScreenConnect.WindowsFileManager.exe
Size 91KB
SHA256 97decee82b05c7dc063731e99b8a98e72850260db636f36c9b2b893bce30b3f7
MD5 f8f5e67bcb066267ea83e530e54ac958
SHA1 cb002b475554e961aa74f21e6ea70fe39f3065d8
SHA512 c8d4926e438c1df83515dfc5d4560e6d5f7c73d101176d2cc0b081f54111ca576f13cdf320168717076d97ddec3504a9d1e618a6b840614caf0c32e7431c88ce
SSDEEP 1536:2UMOI1lP4oypI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVdiXj7HB4:1IHuukLC8jjB4
TLSH
T1D493E55235266231DEC6C033A492E9B19C337F6207FDC5BD28A1BA3639E03943E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/708-9-0x0000000005020000-0x00000000050B2000-memory.dmp

Download

memory/708-8-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/708-0-0x0000000074972000-0x0000000074973000-memory.dmp

Download

memory/708-14-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/708-13-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/708-12-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/708-11-0x0000000074972000-0x0000000074973000-memory.dmp

Download

memory/708-10-0x0000000005270000-0x0000000005420000-memory.dmp

Download

memory/708-1-0x0000000002940000-0x0000000002948000-memory.dmp

Download

memory/708-17-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/708-7-0x00000000054E0000-0x0000000005A9A000-memory.dmp

Download

memory/708-6-0x0000000004EF0000-0x0000000004F18000-memory.dmp

Download

memory/708-5-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/708-4-0x0000000004E60000-0x0000000004EF4000-memory.dmp

Download

memory/708-3-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/708-19-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/708-2-0x0000000002960000-0x000000000296C000-memory.dmp

Download

memory/3160-290-0x00000000004F0000-0x000000000059C000-memory.dmp

Download

memory/4896-15-0x000001D342100000-0x000001D342108000-memory.dmp

Download

memory/4896-70-0x000001D360FC0000-0x000001D36106C000-memory.dmp

Download

memory/4896-64-0x000001D360F80000-0x000001D360FEC000-memory.dmp

Download

memory/4896-58-0x000001D35EB70000-0x000001D35EB8A000-memory.dmp

Download

memory/4896-52-0x000001D361270000-0x000001D361420000-memory.dmp

Download

memory/4896-46-0x000001D360FB0000-0x000001D361044000-memory.dmp

Download

memory/4896-36-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp

Download

memory/4896-35-0x000001D35EEE0000-0x000001D35EF30000-memory.dmp

Download

memory/4896-26-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp

Download

memory/4896-25-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp

Download

memory/4896-24-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp

Download

memory/4896-23-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp

Download

memory/4896-22-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp

Download

memory/4896-21-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp

Download

memory/4896-20-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp

Download

memory/4896-18-0x00007FFD60BFF000-0x00007FFD60C00000-memory.dmp

Download

memory/4896-16-0x000001D35C7F0000-0x000001D35C978000-memory.dmp

Download

memory/4896-322-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads