5f8aee08ee4ac1434fba3fd95479b3379bdbf8c3f73d9947836671ab199a82e9

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 15:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_018ef9184533adeae81801683f61e19f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 2.5MB
Sample260731-sh83pacd74
SHA256 5f8aee08ee4ac1434fba3fd95479b3379bdbf8c3f73d9947836671ab199a82e9
MD5 018ef9184533adeae81801683f61e19f
SHA1 394f434713bec7316a5868ae7c2b7441cc1d4046
SHA512 8bf0906536a0eb10ae14c33cf7159ebffc4a3b91b969250051475070597af4b7388752b12bd6870d14d15141cf7f40f6f00a46a445b4dc5b26f659a143937ea0
SSDEEP 24576:YvId9BbVER68MYBjf5QN9Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT0K:jC3QN9JkGYYpT0+TFiH7efP8oL
TLSH
T122C5BD01F3D695B6C4AF0538D47A925A6A70BC0403A6CBFB67C4B9762D337C08E357A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 7 IoCs

flow	pid	Process
16	992	dfsvc.exe
16	992	dfsvc.exe
16	992	dfsvc.exe
16	992	dfsvc.exe
16	992	dfsvc.exe
16	992	dfsvc.exe
16	992	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
5488	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\A4DRNK6W.82Q\MELPRNEG.09G\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_018ef9184533adeae81801683f61e19f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0005_none_e90c56cf89d4262e\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f\SizeOfStronglyNamedComponent = 02ed040000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f\DigestValue = fe35504e971c015044096558305ee471d96e8784	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0005_93cad2c57ddee941	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0005_none_37b8be86f414c2c3\SizeOfStronglyNamedComponent = 7320090000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0005_none_cdce1c59036418c7\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0005_none_7eb8c5776d0b1316\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0005_93cad2c57ddee941\scre..ient_420d02d3849b7992_001a.0005_none_cdce1c590 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0005_93cad2c57ddee941\SubstructureCreated = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0005_none_37b8be86f414c2c3\lock!0e00000048f65a0e70150000100a0000000000000000000 = 30303030313537302c30316464323066656333373533343234	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad328 = 460061006c00730065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f\Files\ScreenConnect.WindowsFileManager.exe.conf = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0005_none_3c3096683062d5f3\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0005_none_37b8be86f414c2c3\lock!100000001ff55a0ee00300007c0c0000000000000000000 = 30303030303365302c30316464323066656138623462366666	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f\lock!0400000048f65a0e70150000100a0000000000000000000 = 30303030313537302c30316464323066656333373533343234	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_27fa83f1ad328	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0005_none_e90c56cf89d4262e\implication!scre..tion_27fa83f1ad328157_001a.0005_b3 = 68747470733a2f2f6f70656e64656e74616c2e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0005_none_3c3096683062d5f3\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0\lock!1a00000048f65a0e70150000100a0000000000000000000 = 30303030313537302c30316464323066656333373533343234	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0005_none_e90c56cf89d4262e\lock!1400000048f65a0e70150000100a0000000000000000000 = 30303030313537302c30316464323066656333373533343234	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0005_b39fbaf2d7edd564\appid = 68747470733a2f2f6f70656e64656e74616c2e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0\implication!scre..tion_27fa83f1ad328157_001a.0005_b3 = 68747470733a2f2f6f70656e64656e74616c2e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0005_none_37b8be86f414c2c3\Files\ScreenConnect.Core.dll_b96889d378047e27 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0005_none_3c3096683062d5f3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0005_none_37b8be86f414c2c3\lock!1c00000048f65a0e70150000100a0000000000000000000 = 30303030313537302c30316464323066656333373533343234	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad328 = 68747470733a2f2f6f70656e64656e74616c2e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0\DigestValue = 050ccf94dd3a4e8455e35609dff01011d83a55d5	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0005_none_37b8be86f414c2c3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0005_none_e90c56cf89d4262e\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0005_none_e90c56cf89d4262e\Files\ScreenConnect.ClientService.dll_e781b1c63 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0005_none_e90c56cf89d4262e	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_27fa83f1ad328 = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d002200680074007400700073003a002f002f006f00700065006e00640065006e00740061006c002e00730063007200650065006e0063006f006e006e006500630074002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320036002e0035002e0033002e0039003600390031002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003700660061003800330066003100610064003300320038003100350037002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320036002e0035002e0033002e0039003600390031002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003700660061003800330066003100610064003300320038003100350037002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e00530065007400200063006c006100730073003d002200530079007300740065006d002e00530065006300750072006900740079002e005000650072006d0069007300730069006f006e0053006500740022000d000a00760065007200730069006f006e003d002200310022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d00220028006800740074007000730029003a002f002f006f00700065006e00640065006e00740061006c005c002e00730063007200650065006e0063006f006e006e006500630074005c002e0063006f006d002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300030003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0005_b39fbaf2d7edd564\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec7 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f\Files\ScreenConnect.WindowsFileManager.exe_0e21 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0005_none_3c3096683062d5f3\DigestValue = 198c3abd767595efc0b44e11b0bdfafdf8e3dba6	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0005_93cad2c57ddee941\scre..vice_420d02d3849b7992_001a.0005_none_e90c56cf8 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad328 = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0\lock!0e0000001ff55a0ee00300007c0c0000000000000000000 = 30303030303365302c30316464323066656138623462366666	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_15b4d2db68e50e78	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_27fa83f1ad328 = 68747470733a2f2f6f70656e64656e74616c2e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad328 = 54007200750065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0005_93cad2c57ddee941\appid = 68747470733a2f2f6f70656e64656e74616c2e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e352e332e393639312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0005_none_cdce1c59036418c7\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0005_none_37b8be86f414c2c3\DigestValue = a7507898469487eb7c7fed613194cf97273a5fc6	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\A4DRNK6W.82Q\MELPRNEG.09G\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\NOA9QLC8.JO3\G00B2P1D.0P3\scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	2026-07-31_018ef9184533adeae81801683f61e19f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	992	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 992	2100	2026-07-31_018ef9184533adeae81801683f61e19f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	89
PID 992 wrote to memory of 5488	992	dfsvc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-31_018ef9184533adeae81801683f61e19f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_018ef9184533adeae81801683f61e19f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Users\Admin\AppData\Local\Apps\2.0\NOA9QLC8.JO3\G00B2P1D.0P3\scre..tion_27fa83f1ad328157_001a.0005_93cad2c57ddee941\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\NOA9QLC8.JO3\G00B2P1D.0P3\scre..tion_27fa83f1ad328157_001a.0005_93cad2c57ddee941\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:5488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\NOA9QLC8.JO3\G00B2P1D.0P3\manifests\scre...exe_27fa83f1ad328157_001a.0005_none_afa54eec71f6858f.cdf-ms
Size 32KB
SHA256 0bb6fa438591f4c883bcc9dc8e09a3d28a53c5c582a3fb6cf680c75b2baa1139
MD5 548ddac5a0d55ead242131ba31be75d1
SHA1 bfc07d2d58b48c2446491f7d3b9ca7578353159a
SHA512 002fd4aa3798f3ee7db21b5600244850a397c2975ba45c6859d8e99b11bcd29ae23410e3aaa913518f016f1d5b44528ffc00b6d757955479539e41c1babd37a6
SSDEEP 768:bIAiazAPL10HfgP2am6Yc2bS4VRfsmMJfcID8X/:9TWi1PLfvqD/8X/
TLSH
T17AE23AE2BA82E73BD2626B32FC76D7D471947D950DA420BB3441372C4439E593F32AA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0005_none_37b8be86f414c2c3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\NOA9QLC8.JO3\G00B2P1D.0P3\manifests\scre..core_420d02d3849b7992_001a.0005_none_37b8be86f414c2c3.cdf-ms
Size 3KB
SHA256 a59c4b33cb83de37f8c33b80c206609b334088c46c3460fb4e94430dbb937106
MD5 022b145f69ebaeb460f2f7d4a6f44c38
SHA1 c32a21e0ce2ad357857c83dd344d38855798864f
SHA512 a45e454ea998c5c4510dc6f151bcf84aa8c786e97e2d43ee35d048cff87d171f57e2ca1f234b665dd5c3800585be899ac3ca4ad5ffed4d732d1cc3fec0ed47ba
TLSH
T1A6614E027744CA53DA790332ACF2C2DEAFB87D83CE82810FB4C07B5F79324A956112A4
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0005_none_3c3096683062d5f3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\NOA9QLC8.JO3\G00B2P1D.0P3\manifests\scre..dows_420d02d3849b7992_001a.0005_none_3c3096683062d5f3.cdf-ms
Size 5KB
SHA256 f589025e992ed482b81ab28e5e31599985bb1605287431161293ed9adceacc84
MD5 0e116daf3afe693a1d25ce0e27e4f63a
SHA1 cc754cf18d0805e9c666a3c1130bb2869f1896bf
SHA512 b63df357a00647475b1471cc8ec69a8392b52b70cb6dae81dc95fd8e0aa5925700faa14dde896327be58f1e2469d3a4c86f21c01bd429c1bfe3ac20e906141ce
SSDEEP 96:+LA+RxlrheV+Ww7OHIKT22cAXeDU2ok4tbIOs66gnPsP:eRxlaJ0KnD+9oqOv6
TLSH
T1A2B1EB11B284DA17D5790633ACA6D3ED2B347D93DE83430B70C4BF6F7A326D65226191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\NOA9QLC8.JO3\G00B2P1D.0P3\manifests\scre..ient_420d02d3849b7992_001a.0005_none_98ff97aadcf8a5d0.cdf-ms
Size 7KB
SHA256 2a354d00c974cdc3f1add64465530607328ae46ab16c46f79842c799b29e8075
MD5 749cbb5ae176e6daf94796302a8d08d3
SHA1 39e24263b559d75673e13e9d9b4db016c2dfad94
SHA512 e19cc994eb6cdefe71becd42bc5aab5a9fdb895a2071515a8da076464ed97b375788c1f7a9a81d4a91709afd7d880c071d8434d60f5019457af1c38e1b18c661
SSDEEP 96:BpOONr8nebEf4kFeV+WwwOf867Or2WAvgoG6v+WaOoMKC96q8THwgE:BowQnebkaJ87laZN7C
TLSH
T1DDF13402B2A0ED56D1AD4A339CD6C3ED36367E96DE43070B71C4BF2FBA726D61212095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0005_none_cdce1c59036418c7.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\NOA9QLC8.JO3\G00B2P1D.0P3\manifests\scre..ient_420d02d3849b7992_001a.0005_none_cdce1c59036418c7.cdf-ms
Size 2KB
SHA256 7d921948f401854a0535d9c8b2e2c3fb81d7db50af77a7c60f7168d5c5eb462f
MD5 e97a58440e9695288139b4b86a0823f4
SHA1 8d10b569f6b59053a9a1586912f33bb6bef887a1
SHA512 84de66022c5f78fb11096ea94089ab42671b0e61aaff4a5d25ee8977f950c08db9259d8d2d5a46bf3c7a9fed651bebf38c092e66e6a55b9879fb1e6f7e8e9c08
TLSH
T1275140417348E3A7E6764232BCA2E6DE37387D83EE461217B0C07B3F2D7158546131A2
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_27fa83f1ad328157_001a.0005_none_7eb8c5776d0b1316.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\NOA9QLC8.JO3\G00B2P1D.0P3\manifests\scre..tion_27fa83f1ad328157_001a.0005_none_7eb8c5776d0b1316.cdf-ms
Size 22KB
SHA256 1620b03e5ee2e5105780e821b181a5b4fc15bfffe37188255c463e3342c89cb5
MD5 88892b1d5a2d93be246de4d77f16ca0a
SHA1 11fb2e6e3c2f9595839335232796d28138801bfe
SHA512 b4b90fac64889b3dd83ad610affbbc10b1e703626728d5c036725fef575b626fc8a188021211b9384046adbe859d2feb4fae9d009feadc2302d54bb89b241e47
SSDEEP 384:JRUm9OXaowdQEezGf1EeznljP2psgM7Y6GQhiEtcAQI7wTkaOs1sL3+tpbv:3NQa39fRPL10VQhiEtHJ7wTkf6sL3oxv
TLSH
T1F6A25B853B51E917C2135632DDC2CBE83639BED78EC2875B38013B5E9A74F49AA319C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0005_none_e90c56cf89d4262e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\NOA9QLC8.JO3\G00B2P1D.0P3\manifests\scre..vice_420d02d3849b7992_001a.0005_none_e90c56cf89d4262e.cdf-ms
Size 4KB
SHA256 ef7532775ec3b7f1cda35ced9831f55cfdcd89acbef2c16554f595d7b5c56c5a
MD5 87f82f347146861ae0d5cada41595160
SHA1 591dc577c53d6a5ddfe2d26956f822b5b9a6f729
SHA512 aefadd5594e93be26fe8fee04fc1ea84b26f7e20f210fe13ff5ca06096d7cdba6247a17883107e0819261c0932c06b53cbb1355741bef856cd062c766472bf02
SSDEEP 96:VXQcnOTeV+Ww8Of4wUOM2WAvFTT0v2DPuWiV:5JeUKbJ+V
TLSH
T104A156017280ED6BD6A90633EC92C2DD3A767D82EE43530B71C4BF2F76726D65326096
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\NOA9QLC8.JO3\G00B2P1D.0P3\scre..tion_27fa83f1ad328157_001a.0005_93cad2c57ddee941\app.config
Size 846B
SHA256 d54aaf8a566c3605a5b18a0c1c6d0a198c1005569c4753cef75db4294c91c12d
MD5 7436af58a7c277023b6364a219ba58ed
SHA1 39cd5bec6f646b126ec46a292cc0bdeebb0e8e9b
SHA512 5726d1a580a82653c3a6f403d5da64cd9b50bdb3c66af7136cf75cb2f70d51ca93a46622c0249763e2939e781d37c8f38227ba6018087c8eaff7e7e4a567606a
TLSH
T14B01655DB0C0AF5A12A36633E6314281ED708A63116660E474DE21275F70ADA07B36DA
MD5 SHA1 SHA512 TLSH

Submit Download

davg3xep.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\NOA9QLC8.JO3\G00B2P1D.0P3\scre..tion_27fa83f1ad328157_001a.0005_93cad2c57ddee941\davg3xep.newcfg
Size 683B
SHA256 2e672471eeb06b1c072c710fb2f40643b9a0949b764755d94ec89872a44d4113
MD5 65284b03781c186223d8eb4f90a23243
SHA1 fa698050b234348022d9dfc87a10388d59db63ec
SHA512 cc427acec7181d3ebf94a687a084492ab58bf08261e70b89400d86e095038e93b4f619b4338cd8ca1104f54145d8c19c5f87c49237dca30c7fca7b3c9d199d85
TLSH
T120012D6571C4AD5702775E33D5218345FE71165B056560D874AE213BAF305CB03E32DF
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\NOA9QLC8.JO3\G00B2P1D.0P3\scre..tion_27fa83f1ad328157_001a.0005_93cad2c57ddee941\user.config
Size 520B
SHA256 92265b47cc8304da37adf542ec1296b849f2d10efe0348796f66fd48f2d7c66b
MD5 3269a91ef3ee355a133907318b5c2542
SHA1 9a8a7c0e26a9e928ff75112a2f2449ddd9ad64b6
SHA512 428097b0f38dc4e5b54d80b5e720b73037a06a969eaf8929b23b34bd2eeaf5845dbe69a72d48420c45bc68afd7a9e6f6c28bed0545b148c922ed9a539fcce9c3
TLSH
T1E6F0E9A131846D4B03635E33C5118741FE725A9B0555249874AF213B9F315CE03A31CE
MD5 SHA1 SHA512 TLSH

Submit Download

XVW3ZZBN.QB2.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\61NX5101.HBD\XVW3ZZBN.QB2.application
Size 132KB
SHA256 4de60cccf71cb3f7e8d51aae6a6adcb227be0ec1577381e6e416075542990263
MD5 6d61d701a1d198a1409c2e4aece2405b
SHA1 904df2e2e03196ce1ed53001190c61ed557498e4
SHA512 c0fd84b38fa84bd5043999d3ee1a57a890fcd1b973540191eae123e9be3a294eb5ab2055674cbe21fd84caf32ad460373c10b9d9dd2ba43397ea8502e4ad523d
SSDEEP 3072:dzyQXWs9/V7fuuBn1nfdvg2XOcu7UT8mQ9VkDwX1:J1FVLuuBn1nRWwTE9VkDe
TLSH
T17FD3E73ACE30F4C0477DB021D1A52D673D811B93DB731BACD91A186B0E68796EF5A68C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A4DRNK6W.82Q\MELPRNEG.09G\ScreenConnect.Client.dll
Size 412KB
SHA256 8e5531c2b302f9c95ed32ac7481d3535b6d51147257d317686c07ea1a9cb8362
MD5 a86960060335629b7a4b061360c18ea1
SHA1 b7ae51d426631f73c70f6ff3d82a39cf592fb047
SHA512 57663335082fb7fa90d8039ffa8f65964379b75741cdc58b61d16119951f4b1567bca200e2a9eaec023e6cc243b136426705396559cbac918582633f2bf87249
SSDEEP 6144:uS59LDc+cn1vp42Y5sD8ETEavHy+vd7JPYIYyqQni65/PTG:1pcM2xDHTEavSW7OQniOG
TLSH
T18894CF8163E85D6EE9AF1F73F0A1A1344E76BC056182F2EE0D0475F41A7B7828B546E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A4DRNK6W.82Q\MELPRNEG.09G\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 f4f96f09fadd8c91ba8e5cdfedea6e330d5efb0514804f2d811feeb4aac9b757
MD5 b8d02f114f47cb2d6b944e2bbeb88181
SHA1 6f721ca6225b51bf275519e8a0607fcec3effb8e
SHA512 480eee982952f8d99a7e0c9fb4d10ea2a4def1e3ddf68a6b4f862032a197e29044c4764502b69808ab763f17517387dda43c2c64b5b3627db4a4c0b5b78249e5
TLSH
T15D117B0191C4FA3A1F3341D1BEE7E46067AD5B73158E194BB069689F8B29AD7434B0B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A4DRNK6W.82Q\MELPRNEG.09G\ScreenConnect.ClientService.dll
Size 92KB
SHA256 ed32fe0d924959020cbef0534a7ba612e94263ccc74837475f3b5a6a726acad0
MD5 29e07dd26e1a322bc49505d0239c78ed
SHA1 bc45a3738ed666f2b6b94f22bc7fe22ffedd01e5
SHA512 3639a2889f6187144364ca73d3c13eec2bfa31964bbbe148d26352ea52f6fb7e1010d92a83e362092ab3a47f206a5849972b84b72389367e7aceb96d84d98464
SSDEEP 1536:Yz0NVwxLGDPpGiIVzLU49GWZaiQOV+eD/0nUazxDa91g0Bp7A:Yz2Lj8FFPA0QOVx/IUazxDa91gEpc
TLSH
T123935C4293BCA92ACDDF1E34B461F1610AB1B913D8E6EBD46DC860DA1F523D21F4439B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A4DRNK6W.82Q\MELPRNEG.09G\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 0584d36dea99da050f42b3b5ea17d6983632c2b1a8e5ca201b3c00a47998737d
MD5 0ea927442992cdeb93b6182a0159b146
SHA1 4c0d7667559eb4494df34e55da9ff2f66cda8c99
SHA512 2b8e6deb4dd222663842e95d4e36a2326412a4578f633c70de9b2e583aa4726aa6306896a336c730bef58f986de6764a9677f3a76a35a4e0ddc4a921c7b531c9
TLSH
T10F31080191C4FA751F3302C1BDE7E4609B9D5763158E290BB059A99FCF29AD7434B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A4DRNK6W.82Q\MELPRNEG.09G\ScreenConnect.ClientService.exe
Size 93KB
SHA256 16b4c273a25526e7262716ebe9d46480962347191a034595f18be740d9ce1e17
MD5 e1f2d75dd49355496a2e147cef862ede
SHA1 c7deaed84f074f4618c41132c89017a1d66191c1
SHA512 beed34147f64f740fadff9dbd7537183f4f9effa33a28e7adc7b12240e2e66ae46149f39c17adc0564a4487fbfca75f22d88556e4b3969779459018f80a5045b
SSDEEP 1536:dg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgcU0HME75:uhbNDxZGXfdHrX7rAc6myJkgcU0HxV
TLSH
T102935B13B5C28872D473093158E0DAB09A3FF9615E61DEAB3798022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A4DRNK6W.82Q\MELPRNEG.09G\ScreenConnect.Core.dll
Size 579KB
SHA256 f64cb7ab5f105c22348a22e02dd506ff45456884639fee0f322862112860af24
MD5 f2577cb81a640ef1219dac5e98e72a30
SHA1 a7507898469487eb7c7fed613194cf97273a5fc6
SHA512 424ce0322428eee6ab0ac3ebbe5cebdcd48247a4e0f805ae77ea6fb115e12e20f0ac80749a65f4bf5de57622111e65933f8bbe1929d052fa91b57970b8eae901
SSDEEP 6144:X3IGbCeeMkZBRqj1xcvWlEfu37PtJp71A/J7ysZVFeEjIfR9BwnNXJyS/chwDTaT:npbCeMmxnFrtyFQEq+NXJyLAO
TLSH
T122C47D1273D8B767C5BE1B7BE0B061144270E40A7CBBE79B1994F4A9ACA73854E413B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A4DRNK6W.82Q\MELPRNEG.09G\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 fb74391d810e4056258197589dd397313c3de41d245d738b5a9f1b68d1f6f9ec
MD5 e82556b925f08d8bb7dce616c437c65b
SHA1 307dde221b1ec99e4d2a5e009c4899edcd8a5fe0
SHA512 646144bdc29ace38bff7d860ab976e1cffec909cf6b4441c8f748a6025cc5726a78cc105008f8c0d882b3cb8df3e76e33e30a6e02e16a11451e9a852301dd641
TLSH
T1F9217C0181C8FA261F3302D2BDE7E42197AE5733158D194B74696C9FCB2DAD24747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A4DRNK6W.82Q\MELPRNEG.09G\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 c50d6e8d93ed197dd0cfb647743b42a2a6a9289f6db04092f56cefd6d569663e
MD5 9ec7c251b0b81419c7b5549eb50721b6
SHA1 198c3abd767595efc0b44e11b0bdfafdf8e3dba6
SHA512 c53596ea4ad4012ba48b81fdf6c36d0be5f5e2c056cfd64da4c158882976d65a0a243397f377c7daa8f1026789f4f72d3da0669aa51c49de62f5318382ed63d7
SSDEEP 24576:yBjf54NHFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPn:K4NHJkGYYpT0+TFiH7efPO
TLSH
T13A85BD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A4DRNK6W.82Q\MELPRNEG.09G\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 901598794f456530c9d7479a8dfee10633fe8e6e1a9b8d270ad4026f10632c0e
MD5 97f675907d9dc70dc4f308d65f642308
SHA1 4c869875ade3db7ac7012c011537cf8332d4fc2b
SHA512 9fab9127a078125ff125f39739a510befa8c74d32655ef2e07c9d512e5cff0a1c15fc3da7e4a1cf225b92d29458efcb3278cf23591ac9cbc33e1bff8db8e2d40
TLSH
T14241F11181C8FA250F3302C2BEEBE431979E5723158E190BB499AD8BCF29AD7474B037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A4DRNK6W.82Q\MELPRNEG.09G\ScreenConnect.WindowsBackstageShell.exe
Size 71KB
SHA256 3d8b4ccdd893b97aa4e30d92c3a57cd54632529fdb730af29f3fba8435f2e12d
MD5 b34a0403a58513a09fe43d5752edb975
SHA1 9fc4d0eee77ff12f96a04f329764aa74d20db5fc
SHA512 d685bba60b1b77008219b27413df198863e4c254306846f996a3e0e8c68a4a58ae4e30c443b64ee70a6886c9b7026ca7cadcef8e69b5a43459967d6e86e67e29
SSDEEP 768:FzlYsf/wCdOBti13kDeuRsUQHjSz2dvmDSmBsuMQX5E+TCMXESslbq7kaYiDLk52:FRYKtd739PDVdvmDqfQX5E+TC7huka7R
TLSH
T1F2637D5063DCD535E9FF2E34B0E1F6600AB3BA6388E1D7D52DA821DA2E127C14F64396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A4DRNK6W.82Q\MELPRNEG.09G\ScreenConnect.WindowsClient.exe
Size 678KB
SHA256 2ad8f126461607aad3fa31a41f1f39bc74f471fd84191b43e205610db2c4cf09
MD5 7f626afbf536e6b90f7724a0d5cc8613
SHA1 050ccf94dd3a4e8455e35609dff01011d83a55d5
SHA512 77bb24905ccff34d96c508baaadc7f76e5e53aa43444aaec65c350017e0d1425b410f334610a70acfe280580fa2a2d0641e42d9fd50bc02095c1418e5eda5d5d
SSDEEP 6144:YLzDkss+w0qZxJoIqxXby4Ag9THzLH1SPl3HdmBtwxRFc822/R4IHZ2CZlAs1fzl:KnksifZxJoHW043Oc92TpN4
TLSH
T106E47E2137AC9B7BC4AF0B39B0721914D7B4E8436385DF9EE944B0EA1D877898D0539B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A4DRNK6W.82Q\MELPRNEG.09G\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A4DRNK6W.82Q\MELPRNEG.09G\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 1f35f1ccba28750025d5dce8710a78188a6938e59593aae725ad7157fbc2667a
MD5 6edb13c5d06e16808f8feedee7b68c1b
SHA1 0e9f66850387a669b63d566be9d1ee424967689a
SHA512 4077e92e5ca5368c1ff0ee269fb8c919feb94ad679b67f25c038f453c241dcbc165bb13fe783d97fc5b964321b582c5850174c4cd483569dc506b52fb7e4ff9b
TLSH
T1F851E61151C4FA750F3302C1BEEBE4709B9E5762158E190BB499A98FCF2CA97474B037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A4DRNK6W.82Q\MELPRNEG.09G\ScreenConnect.WindowsClient.exe.manifest
Size 25KB
SHA256 a44d4efeb6c96b1061c8f352a81c8a4790d84c77295df390bb34045b52833403
MD5 9401969a1239b9cebcf6aa61c39ef58c
SHA1 fe35504e971c015044096558305ee471d96e8784
SHA512 24b484fcf40d1a1730406ca9884ef89c1a7993394f3c3453a305cecc59e12f100fe28e3e9a876b2e776f00a2b633be6649ad4eed2543903cf40384eb5546664a
SSDEEP 384:LeVAFg+UEoMa6IfaAhLEezk/F3EezuEeznljP2psHM7YCfi17P2aa16YcnVC1bS+:L+azgPLs0CfgP2am6Yc2bS4VRfx
TLSH
T133C24A9A8CC17C2103329194FEE38A28FD043F6345E9109E7D4D15AFDF64A5A63972EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A4DRNK6W.82Q\MELPRNEG.09G\ScreenConnect.WindowsFileManager.exe
Size 91KB
SHA256 a8bad1d3b18bd9ec3836b852815c87a73b339caef3d43cd616d33e0d1806f03f
MD5 4ba1ab0423aa4685eefc3a8f9facca38
SHA1 69bf0a0baedff7dedacc808b94401c8f4933b30e
SHA512 67e78fea095c7bb395bd97d8cabd3c6d40b599d577ebcdebbbeb0b4e7feb440680a986af5694f63986eaba32ad855b3ba3bdbd90dfe85abeefdb2e0d16a0245f
SSDEEP 1536:fUMOI2lP49yvI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVdiWv7zzUX:0IQRukLCZvjO
TLSH
T19593D552356A6231DEC5C033A492E9B19C377F6207FDC5BD28A1BA3639E03943E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/992-16-0x000001AB09C30000-0x000001AB09C38000-memory.dmp

Download

memory/992-19-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp

Download

memory/992-28-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp

Download

memory/992-29-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp

Download

memory/992-30-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp

Download

memory/992-33-0x000001AB28910000-0x000001AB28960000-memory.dmp

Download

memory/992-40-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp

Download

memory/992-62-0x000001AB28F10000-0x000001AB28F7C000-memory.dmp

Download

memory/992-26-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp

Download

memory/992-68-0x000001AB29000000-0x000001AB290AE000-memory.dmp

Download

memory/992-25-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp

Download

memory/992-74-0x000001AB28F40000-0x000001AB28FD4000-memory.dmp

Download

memory/992-17-0x00007FFB0B42F000-0x00007FFB0B430000-memory.dmp

Download

memory/992-80-0x000001AB29200000-0x000001AB293B0000-memory.dmp

Download

memory/992-23-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp

Download

memory/992-22-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp

Download

memory/992-86-0x000001AB24750000-0x000001AB2476A000-memory.dmp

Download

memory/992-21-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp

Download

memory/992-20-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp

Download

memory/992-27-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp

Download

memory/992-18-0x000001AB24450000-0x000001AB245D8000-memory.dmp

Download

memory/2100-9-0x0000000074E40000-0x00000000755FC000-memory.dmp

Download

memory/2100-7-0x0000000005720000-0x00000000057B2000-memory.dmp

Download

memory/2100-15-0x0000000074E40000-0x00000000755FC000-memory.dmp

Download

memory/2100-14-0x0000000074E40000-0x00000000755FC000-memory.dmp

Download

memory/2100-13-0x0000000074E40000-0x00000000755FC000-memory.dmp

Download

memory/2100-12-0x0000000074E40000-0x00000000755FC000-memory.dmp

Download

memory/2100-11-0x0000000074E52000-0x0000000074E53000-memory.dmp

Download

memory/2100-10-0x00000000058D0000-0x0000000005A80000-memory.dmp

Download

memory/2100-24-0x0000000074E40000-0x00000000755FC000-memory.dmp

Download

memory/2100-0-0x0000000074E52000-0x0000000074E53000-memory.dmp

Download

memory/2100-8-0x0000000074E40000-0x00000000755FC000-memory.dmp

Download

memory/2100-6-0x0000000005C40000-0x00000000061FA000-memory.dmp

Download

memory/2100-5-0x00000000055E0000-0x0000000005608000-memory.dmp

Download

memory/2100-4-0x0000000074E40000-0x00000000755FC000-memory.dmp

Download

memory/2100-1-0x0000000002F10000-0x0000000002F18000-memory.dmp

Download

memory/2100-3-0x0000000005530000-0x00000000055C4000-memory.dmp

Download

memory/2100-2-0x00000000054C0000-0x00000000054CC000-memory.dmp

Download

memory/5488-310-0x0000000000B70000-0x0000000000C1E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads