df125df7f96da99102317200da1753cbb25b48dcc29090ca24d065d1edae9a9d

Analysis

max time kernel
149s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_335e480f5c1543fe94c01fcde1f25a76_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 3.7MB
Sample260818-mde16agf29
SHA256 df125df7f96da99102317200da1753cbb25b48dcc29090ca24d065d1edae9a9d
MD5 335e480f5c1543fe94c01fcde1f25a76
SHA1 4c58717b0da13b4b61e1b294883e5c92e35d7e78
SHA512 729ad5730d077274b085512abf6db5d110f02e954e4f05fa94279935683471e25b743a397ca133754bfe7b08b361eb69957e512a882e992015b0e01feffc3dea
SSDEEP 49152:eoo4LnLbL8LbI2R6ZN/Q/UyooOJkGYYZTk+T1iH7efPyttmAxMZ8YDOIK:1vLLbL8LbI2R6PVyNDM6efPynmFZ8YU
TLSH
T10A06C04ABBC7A677D46E067588656310E3B0F8454763C7AF6AD0BB3D1C323D06E2538A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
8	2788	dfsvc.exe
8	2788	dfsvc.exe
8	2788	dfsvc.exe
8	2788	dfsvc.exe
8	2788	dfsvc.exe
8	2788	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
4588	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\3GB4LL0A.JLK\BEJ84YBX.7TD\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_335e480f5c1543fe94c01fcde1f25a76_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0005_cce05a5fec2567bd\implication!scre..tion_0000000000000000_001a.0005_ca2c097 = 68747470733a2f2f7777772e657a6269732e6e65743a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393730342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0005_none_0ad1c6f3ba4ee908\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393730342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0005_none_0ad1c6f3ba4ee908\SizeOfStronglyNamedComponent = 90ff010000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 68747470733a2f2f7777772e657a6269732e6e65743a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393730342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e352e332e393730342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 0000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0005_none_5d4c18ebba93c60b\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0005_none_37b8c1b6f414bcf6\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0005_none_cdce1f89036412fa\DigestValue = 00f54a74dd1b5ccb36c6133b7726b404ecf896a7	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0005_cce05a5fec2567bd\scre..ient_420d02d3849b7992_001a.0005_none_cdce1f890 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0005_none_3c3099983062d026\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32362e352e332e393730342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0005_none_5d4c18ebba93c60b\Files\ScreenConnect.ClientService.exe_e781b1ee3 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0005_none_5d4c18ebba93c60b\Files\ScreenConnect.WindowsBackstageShell.exe.c = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0005_none_98ff9adadcf8a003\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32362e352e332e393730342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0005_none_37b8c1b6f414bcf6\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0005_cce05a5fec2567bd\scre..dows_420d02d3849b7992_001a.0005_none_3c3099983 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_0000000000000000_57051d5779c6eb7e\LastRunVersion = 68747470733a2f2f7777772e657a6269732e6e65743a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393730342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e352e332e393730342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 680074007400700073003a002f002f007700770077002e0065007a006200690073002e006e00650074003a0038003000340030002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006d0061006e00690066006500730074000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0005_none_37b8c1b6f414bcf6\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32362e352e332e393730342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0005_none_5d4c18ebba93c60b\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_b09d76868228b17e	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0005_cce05a5fec2567bd\lock!1d0000000ea8590eec1100003c0d0000000000000000000090d4 = 30303030313165632c30316464326566623933663636336165	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_0000000000000000_57051d5779c6eb7e	ScreenConnect.WindowsClient.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 680074007400700073003a002f002f007700770077002e0065007a006200690073002e006e00650074003a0038003000340030002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e003f0065003d0053007500700070006f0072007400260079003d0047007500650073007400260068003d007700770077002e0065007a006200690073002e006e0065007400260070003d0034003400330038003000260073003d00380064003100370038003800630032002d0062006500330031002d0034003400310061002d0038003800350032002d0065003600360031006100340030003200390066006100620026006b003d0042006700490041004100410043006b004100410042005300550030004500780041004100670041004100410045004100410051004200390047005a005900490058004f004e00520068004900500041005500360073006c006a0030004d0075006b0062006700420074004d004e00380039006f0052005a003000470049006a006b006700330034005400550074006e00780033004e006d0030006e006e007900540065006d003200630079004b006a00450063004300320033006c006900650077006a00750037004d0047003300360059007a006c004a007a005400250032006200500079004f007400450051003500350043006e0034004e0033006d00670079007300700035005500570056004b00420034004b006a00560076004b004b005800740054005900720071006a0051005a00520047006200350076006a0037004f0036007a0039002500320066005200620071005700450033007300660050006c00450067002500320062006500420055007700610035004200700064004a004b0057004a00370033006e003800410036006e0057005a00510065006b005a003700750034004e0078006e007300510073002500320062005600590045006c0051003700780032004b0078006b006c00360076006b006c004d0064006d0068003300520034004f004a006a0035007400760076007800250032006600350057007000580053004e0071007400300072006c00750056005a004f00380035006400540031003700730059004100660030006b007a00760076003200620075003100580025003200660039006c0061006300300033004900450050006800250032006600350043006c004f0076006b00520077007800330025003200620057004e00610064006d0039003600640051006f00740068006e00720047006800760053004c00710025003200620050004f00330077006c0074002500320062004e0065006a007900370051004a003800730072003700630054004e002500320062004700750069005a004800790074004d004d0047004400450036004100740062006a004c0068004e00310071003200260072003d00260069003d0032003400380030000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0005_none_98ff9adadcf8a003\implication!scre..tion_0000000000000000_001a.0005_ca = 68747470733a2f2f7777772e657a6269732e6e65743a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393730342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0005_none_0ad1c6f3ba4ee908\implication!scre..tion_0000000000000000_001a.0005_ca = 68747470733a2f2f7777772e657a6269732e6e65743a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393730342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0005_cce05a5fec2567bd\scre..vice_420d02d3849b7992_001a.0005_none_e90c59ff8 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0005_none_3c3099983062d026\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0005_none_cdce1f89036412fa\lock!0c000000eea7590eec1100003c0d0000000000000000000 = 30303030313165632c30316464326566623933663636336165	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0005_none_5d4c18ebba93c60b	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0005_none_5d4c18ebba93c60b\lock!010000009da5590ee40a00003c0c0000000000000000000 = 30303030306165342c30316464326566623861373662626439	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0005_none_e90c59ff89d42061	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0005_none_cdce1f89036412fa\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32362e352e332e393730342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0005_none_37b8c1b6f414bcf6\lock!0a000000a6a6590ee40a00003c0c0000000000000000000 = 30303030306165342c30316464326566623861373662626439	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0005_cce05a5fec2567bd\scre...exe_0000000000000000_001a.0005_none_5d4c18ebb = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_b09d76868228b17e	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0005_none_5d4c18ebba93c60b	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 460061006c00730065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0005_ca2c0978cad51ef8\appid = 68747470733a2f2f7777772e657a6269732e6e65743a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393730342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0005_none_cdce1f89036412fa\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32362e352e332e393730342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0005_none_0ad1c6f3ba4ee908	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0005_none_5d4c18ebba93c60b\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e352e332e393730342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0005_none_0ad1c6f3ba4ee908\lock!04000000a6a6590ee40a00003c0c0000000000000000000 = 30303030306165342c30316464326566623861373662626439	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0005_none_cdce1f89036412fa\implication!scre..tion_0000000000000000_001a.0005_ca = 68747470733a2f2f7777772e657a6269732e6e65743a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393730342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0005_none_5d4c18ebba93c60b\implication!scre..tion_0000000000000000_001a.0005_ca = 68747470733a2f2f7777772e657a6269732e6e65743a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393730342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0005_none_5d4c18ebba93c60b\Files\ScreenConnect.WindowsFileManager.exe.conf = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0005_none_98ff9adadcf8a003\DigestValue = 1ff7d0e56a0ae6863ae7eeccca08f5b1be67ea20	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0005_cce05a5fec2567bd\lock!11000000a6a6590ee40a00003c0c00000000000000000000acfb = 30303030306165342c30316464326566623861373662626439	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0005_none_e90c59ff89d42061	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0005_none_cdce1f89036412fa\lock!1a000000eea7590eec1100003c0d0000000000000000000 = 30303030313165632c30316464326566623933663636336165	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_0000000000000 = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d002200680074007400700073003a002f002f007700770077002e0065007a006200690073002e006e00650074003a0038003000340030002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320036002e0035002e0033002e0039003700300034002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320036002e0035002e0033002e0039003700300034002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e00530065007400200063006c006100730073003d002200530079007300740065006d002e00530065006300750072006900740079002e005000650072006d0069007300730069006f006e0053006500740022000d000a00760065007200730069006f006e003d002200310022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d00220028006800740074007000730029003a002f002f007700770077005c002e0065007a006200690073005c002e006e00650074003a0038003000340030002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300030003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0005_none_e90c59ff89d42061\implication!scre..tion_0000000000000000_001a.0005_ca = 68747470733a2f2f7777772e657a6269732e6e65743a383034302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e352e332e393730342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0005_none_5d4c18ebba93c60b\DigestValue = be56c0efea2f32aa45ad1c7a5c595371c1bc9eaa	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0005_none_98ff9adadcf8a003\Files\ScreenConnect.WindowsClient.exe_6492277df = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0005_none_37b8c1b6f414bcf6	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0005_cce05a5fec2567bd\SubstructureCreated = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ScreenConnect.WindowsClient.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\3GB4LL0A.JLK\BEJ84YBX.7TD\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\B2N1ZP4G.YYR\RO0L5CLP.P4C\scre..ient_420d02d3849b7992_001a.0005_none_98ff9adadcf8a003\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	472	2026-08-18_335e480f5c1543fe94c01fcde1f25a76_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	2788	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 2788	472	2026-08-18_335e480f5c1543fe94c01fcde1f25a76_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	89
PID 2788 wrote to memory of 4588	2788	dfsvc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-18_335e480f5c1543fe94c01fcde1f25a76_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_335e480f5c1543fe94c01fcde1f25a76_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:472
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Users\Admin\AppData\Local\Apps\2.0\B2N1ZP4G.YYR\RO0L5CLP.P4C\scre..tion_0000000000000000_001a.0005_cce05a5fec2567bd\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\B2N1ZP4G.YYR\RO0L5CLP.P4C\scre..tion_0000000000000000_001a.0005_cce05a5fec2567bd\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:4588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0005_none_5d4c18ebba93c60b.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B2N1ZP4G.YYR\RO0L5CLP.P4C\manifests\scre...exe_0000000000000000_001a.0005_none_5d4c18ebba93c60b.cdf-ms
Size 14KB
SHA256 71ad064b65a8f0e75cb62151c6e4a68ac0ed47a49b1db615b5a21ba28b05029e
MD5 307115a092202ddef138c9db63a2ffc6
SHA1 2f0881a2f5ba7eae038482ad0738000da00d890e
SHA512 3f94b5d4aaf05731e141f903fb0c23e4f409aa9ca25c5142f8e66141871d57ee9a59491424b74e5a5f6a8e50260525b1a196e330a5c3d00a563ce80e390b0479
SSDEEP 192:ZSDwHfSWkWRD92xNFz7DbhtgbKAjDNhPE8R6VgS50SV2+dF4:Z/jzx92xNFz7Db8/QMYd4
TLSH
T17262E611BB58F033F2615B37DC76D3D07B287EAA5DA6218BB481333D98721968F32295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0005_none_37b8c1b6f414bcf6.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B2N1ZP4G.YYR\RO0L5CLP.P4C\manifests\scre..core_420d02d3849b7992_001a.0005_none_37b8c1b6f414bcf6.cdf-ms
Size 3KB
SHA256 599848f49dce22b6807d66faeaae4ab00258ffaa6a4acc2d62bff7aff65cdc2f
MD5 f2f5c0284faacefd8cefea4d6e1f5800
SHA1 e83245269e922b161864a6a6f0c440943609b2d0
SHA512 eedd79792b8198510a4326ab6d85d6b82a295a091677857b4d04ebea60fadd20899f892a80453fc44a093ae78979943e14e35bfd6dd0af607bbb9c047b8d488f
TLSH
T1C4614F027344DA13EAB90332ACF2C2DE6FB87E83CE81810FB4C07B5F79364A955112A4
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0005_none_3c3099983062d026.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B2N1ZP4G.YYR\RO0L5CLP.P4C\manifests\scre..dows_420d02d3849b7992_001a.0005_none_3c3099983062d026.cdf-ms
Size 5KB
SHA256 3a4a80485dc2b574dd817b28a347d0552a73f955e33453fdec55b8d409b78ea4
MD5 78e22165d2ceab6a608f008bd821a993
SHA1 eb5af6175f194ebb4cf33e4ca48347f5d3a432d9
SHA512 fcae9d1bcac9aaaecdd3e91cdcf1e13c4139f512f6b9cba7a0a16fdca2ec0825db7b98acff12ac12986f8e6c2d147b114f20f03b81a4b28bc92be0518c9d0469
SSDEEP 96:MsA+RxlUheV+Ww7OeIuOQlVXXezcpvidgiqPx:3RxltJvuNB6LE
TLSH
T185B132117290DD1BD5B90633ACA6C3ED2B36BE92DE43430B70D4BB1F7A326D64222095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0005_none_98ff9adadcf8a003.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B2N1ZP4G.YYR\RO0L5CLP.P4C\manifests\scre..ient_420d02d3849b7992_001a.0005_none_98ff9adadcf8a003.cdf-ms
Size 7KB
SHA256 4b8733d2dc9dbdffaa85ab92a908c7aac8c500d86c080c5170be5958f37e7cf8
MD5 5f359ec6ec9b5e1667d97ae1c4460def
SHA1 35ded5f3920b6c85f6877554f40d8c25d55b1f54
SHA512 246309b7a00e1921c5c6597c361605fb1881959049e8780e3b20e142561969256861844f6e9a12dfdd8e7ef79f06a9373fe2284578a06eb547773502dc87efa3
SSDEEP 96:nOO4Kneld4ZFeV+WwwOc86ILlUJ9obpxmufFy/w5nLyAIw4CVV:O6ne4ZaJzIL8g//GW
TLSH
T178F11042B291FA13D5BD0633AC96D7DC27247DC2EE83072B75C4BBAF76326D61212096
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0005_none_cdce1f89036412fa.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B2N1ZP4G.YYR\RO0L5CLP.P4C\manifests\scre..ient_420d02d3849b7992_001a.0005_none_cdce1f89036412fa.cdf-ms
Size 2KB
SHA256 c6103050ad4802574455a8dba8521388a349c9e58771072c7622077ce2fc50a7
MD5 f36a70aa4d435cad4c17704bd63759d2
SHA1 ba809bc8639b2ff79b5a80fc4d1c140bfb9b7d89
SHA512 e924aea65a22cd0112f4e87de5ab5ec88b9bc01356b56ba07d11af5e322e229c3e1429dc3e1b58a5ed5e843fc9d6f8af4c2689a634d5b2d063ea86dc468d4045
TLSH
T17E5177057688FAA7D67E0232BC96D2D972357DC2EF430327B1D0BBBF29716C59612092
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0005_none_0ad1c6f3ba4ee908.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B2N1ZP4G.YYR\RO0L5CLP.P4C\manifests\scre..tion_0000000000000000_001a.0005_none_0ad1c6f3ba4ee908.cdf-ms
Size 4KB
SHA256 cd205be3cb99c61e8fc8a5c45adaef624e1354090a2a4f426a50a42094992a89
MD5 0ba647dab4eb594ee847467fc9b136e6
SHA1 c7e0a33e31490146cb12a9279fc8d2d598746760
SHA512 7674427d06cee0728719236d21cb7ebc833801eed81bf7db153bd17d1d0a616f55f74e5925ce754a0e0deba2dfbde073ea714d5b76f87629defa115cee2201bc
SSDEEP 96:oOU7G7kEW0m5R/5UmIk2jYVj4EEGgZxt7+aogf:oo7eV9t2poa
TLSH
T12A916581B740F933D7045732ACD3E2D032357DAA4EE9739B70887B3FAE351859622266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0005_none_e90c59ff89d42061.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B2N1ZP4G.YYR\RO0L5CLP.P4C\manifests\scre..vice_420d02d3849b7992_001a.0005_none_e90c59ff89d42061.cdf-ms
Size 4KB
SHA256 2ffe600eeaeededf4b4d54e1648abce59e1e36a8e1408b19e602440f111e0dd9
MD5 911fb2d61f2af663db6fa134d2655b7f
SHA1 016ab40dd9c33d7ac1e14fbc17234cbd5d29182d
SHA512 aba26919991d23d577da002a1686e618acf2f0de515c6238cd430db209bbcdc7f6cb743e2f9d4cd77eaee1822303d8067ece28e3ed2f9bc57bd79d0715fd173f
SSDEEP 96:2QVnOkeV+Ww8Oc4cBiqhH563mIKfh07DKuCiV:2JlBiqhH563FKfhQXV
TLSH
T132A143117341D563E6A61233AC62C3CD3B387D82EE42510FB1C47F2F79726DA53261A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\B2N1ZP4G.YYR\RO0L5CLP.P4C\scre..tion_0000000000000000_001a.0005_cce05a5fec2567bd\app.config
Size 777B
SHA256 6fed928e925ec6a90e81ce6c8243051e9e30fef2383f5b9dd9b476a86004a698
MD5 6c05c776af12dc2210d759303f2da7b4
SHA1 0ae6abddfba59f92242507f67caf045abed2e8b9
SHA512 8773c83a749c61e96838ee9be92faad2fda96dc3aea509c539da97c10db575bd04e6f2c6f4baa1d5dbf51ad2bec7a35e96fa46a7e65bbfd8c92ca692caa99210
TLSH
T14301F55C3086BE0D22A76F31E5230250A8B21D732225B4E96AA93077D8357E91BF23C7
MD5 SHA1 SHA512 TLSH

Submit Download

qy4od33l.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\B2N1ZP4G.YYR\RO0L5CLP.P4C\scre..tion_0000000000000000_001a.0005_cce05a5fec2567bd\qy4od33l.newcfg
Size 659B
SHA256 34895e12cde517171c728e6fa1bafe1044c9a2e4d9b65dc66c46d403d9d6834a
MD5 540de01bcc505b045eaa2dbb5e686119
SHA1 bee49d68415ec6d69c0da09303a9d16e23ed951f
SHA512 2dad90ce59f0266c9e53fdf6ab00707862f96018181a0fda40a5eda66df195d5ae19ff8607832b69059a91fb3bc112e89b73ec50641bdd4a87686b013bde23d9
TLSH
T160012D6571C4AE4703736E32D6214345EE711657016120D874AE213B5F315CA07E32DA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\B2N1ZP4G.YYR\RO0L5CLP.P4C\scre..tion_0000000000000000_001a.0005_cce05a5fec2567bd\user.config
Size 520B
SHA256 81c2d663cd149b8314ee5c2c6dbcbd3b4c72d70caf9bedbf24897c9fa9e1cbd2
MD5 0d9dca9593492839a850448b0c3f1873
SHA1 ca6098558c6cc8316ee39a145514fa46e3f827f1
SHA512 bd0b9ba15258f5a76100a9b8e33c62ef6e556e33e2572cfe90713b1626c271ae2260a393b1274878f5ab036a8c24c91ea105f4aa5d26b9da83b2d653c2752487
TLSH
T1A2F0E9A131846E4703635E23CA124741EE72679B0555209874AF223A9F315CE03E31CE
MD5 SHA1 SHA512 TLSH

Submit Download

15NMOVDT.LJ9.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0A7KQYB5.QWJ\15NMOVDT.LJ9.application
Size 123KB
SHA256 174fbf9ce7779a5c246121d45ee143b3179b5e37d66efbcf80fd7bd1150a4325
MD5 241173593f755f15fbd106ee6509e4f4
SHA1 fede1d37fb1b311ab1455826abdb4bbde66fa46e
SHA512 aa7c8f9fadeb84606b1b2eb2594eba169e47048adfb33007cb7f40374f32982ebccb79c409f27809273e614f2aa644af0c3b91f403916f514bb847e0e53ed3ef
SSDEEP 1536:fwXagXm5zK+zuLD4UABnjRnfduUW5Ab4KpSE5GP/uLTvooycu3jkXUxCH/h9iKQt:fwqgOfuuBn1nfdvg2XOcuzkJfh4X1
TLSH
T1ABC3E53ACE30F4C047BDB021D1A52D673D811B93DB730BACD90A196B0E69796EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3GB4LL0A.JLK\BEJ84YBX.7TD\ScreenConnect.Client.dll
Size 628KB
SHA256 b2a13c7ad0637c3be7c4164d7665239076c423ab09ec2793e3879c7516fff864
MD5 7e8f5d2de8fb6d334f4cb080fec45f76
SHA1 00f54a74dd1b5ccb36c6133b7726b404ecf896a7
SHA512 8270c7dfedc9cecea53fc8029a9a0d2b1f530971ab0b0bae4011a1db3f986c45a80e02d7e30f3a1fe8c2f5fc4175d7cd11e346177ca5cd8648d1213079b7a65b
SSDEEP 12288:qV7rUHB9pGjRm34baT2zHTEavSW7OQniurRZ5:q5Ah9gjU34hzEn8qudv
TLSH
T12FD4C089EB94AD39ED6E0B73F15137209AB0ACC64967D70F1E68367C9C35B843A4D2C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3GB4LL0A.JLK\BEJ84YBX.7TD\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 d54a230dcb17db14412f83267691f5e8eadb2c1ee8308229478c2305e73c7b8d
MD5 95f933aefb4099a6c932b1c8bb51d214
SHA1 464d191f40aa372f7805cc583779946399708af2
SHA512 83516e9f8744291a03bec7fdd4962017c8c8688606f04988e2561d2adcec31ef83e510168c03b1cd8bbd584913bba4b4aa3542a909a0a8c484877f6152dfde55
TLSH
T19E117B0191C4FA3A1F3341D1BEE7E460676D6B33048E194BB069689F8B39AD743470B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3GB4LL0A.JLK\BEJ84YBX.7TD\ScreenConnect.ClientService.dll
Size 189KB
SHA256 e15b308721df8328d87bade1ba4cf46fed75ba556001968d5ed2c90b3a339754
MD5 22ddb76c563f2ddc533b492f0409d07b
SHA1 0bcc80845edbfb3cfb2b48b973ef4c0ecdb3a4c8
SHA512 b22c0fef6270c67a0993c4df371a08e913f40722701e2a22be0f23a1fe51d791fbcc169ee3527d77f521e9a828e7fe27bde38236e11f971582eed59b7773b5c7
SSDEEP 3072:7ctwzjdJQxOe0GuUZNolP05xA6nAXAzaSVuGzxboCQoVLElWWPATln2:YCzZJQge0GuCNxxAyuyFNclWW4TM
TLSH
T13F14AF49BB5EE926C59F4A36A461B32002F1A053D9EBD74FAC9462DE1E173D43F043CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3GB4LL0A.JLK\BEJ84YBX.7TD\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 34b8feebd8b698d82e7a39f55d68ca5217559af71d8a6a53ff0a8615a342578d
MD5 84614399086e27f3438b7fb48f729a0b
SHA1 8b67ac552a31509d8697a2b4f843617baa263b85
SHA512 5db369ecd9ed552ad2cd010a93594da3521f2b4dd8e3c3dc4fd17436b5bea0fe5368524d490ee469272faffdb03ed34f00447ca39097f21c5a218035cb201d7b
TLSH
T1A431F60591C4FA351F3302C1BDE7E4709B9D5B22158E290BB059A99FCF29A97434B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3GB4LL0A.JLK\BEJ84YBX.7TD\ScreenConnect.ClientService.exe
Size 93KB
SHA256 46140f64e0ec35aafbb6f2286ffc02e746a8556d90362afdbf21d5dcc5ed525b
MD5 2886a782f159efc195d7ef85b54216b3
SHA1 84700f844f45960a2123c3913e69db5cd8759c46
SHA512 c1488bfc0b331b68c62f5332d76c33b9d4a3c03a6cfc98f1bddf2491268b08296c2e248423a858a0c77e66e48434b1333d6c78c928112a227c1e4290ef81d67f
SSDEEP 1536:kg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg8U0HMp7iMP:9hbNDxZGXfdHrX7rAc6myJkg8U0Hsj
TLSH
T1EE935B13B5C29872D473093158E0DAB09A3FF9615E61DEAB3788022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3GB4LL0A.JLK\BEJ84YBX.7TD\ScreenConnect.Core.dll
Size 1.3MB
SHA256 906f7c098a9b46f99273aafb62e025ee2037cdfea7aeb2c69ba250c64dc1ff8d
MD5 43cc6ac35aa0757a132507a9d4600323
SHA1 e407c9418b5613e97627fd7f79decb35dea10601
SHA512 7925e11c0aec1328868cea538946ee199e85ee75e9973bed7a76104e347e9afd04caf3e785a8f46ea7b4635fbbe6e4cae9293235c38db045a613ec7a22768615
SSDEEP 24576:s638IckRdAlbo4PP7no9W0ipxbL8Ldd/I2R6vZhVzR/Q/UXN:noo4LnLbL8LbI2R6ZN/Q/Ud
TLSH
T176558E4E7FCAE627D9AD16B744A01200A7B4D0D29B63E70B7960BB3D0C493E87D592CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3GB4LL0A.JLK\BEJ84YBX.7TD\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 60e3e986e516ec506e0d90da876d9ae06265f769b366ac60f4807c906f9de851
MD5 79fd38f1258b21da920f3b2e7d517417
SHA1 9ccdb4f4256e30dfd3e39ecbd341d44386caeb8e
SHA512 175a3d078d0a1cedd5707d80b1064bc9d66e9725b686712055b39434b001735ef14c149c24a19eefa148fb27bad02e57a15a51b8c2a114bd14662b38079da99f
TLSH
T181216A0181C8FA261F3302D2BDE7E42197AE5B33148D194B7069689FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3GB4LL0A.JLK\BEJ84YBX.7TD\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 6ff4abd95d513f731560768176ebfdff4e3488e2ba8d67884782228d5e8e6b55
MD5 0cbde04094e3d7ca2ec831b9224f8ea6
SHA1 f1420c97723535b6b39e6ab55abbecd343b4e9a6
SHA512 32b4cccb628dd04d241857d0ee1bc165ae5f8bc0f59e3f4ad77d67764d825f80e392b8f3cd4c12a2a46e736415f5a86de06c72a25ba4775565fe7f482c1316a8
SSDEEP 24576:0ItfI1JZOFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfK5:0ooOJkGYYZTk+T1iH7efPytV
TLSH
T1A995AD45F6C369FAD42B047888AE632AB7743C040355CBFB97D4AA392D337C09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3GB4LL0A.JLK\BEJ84YBX.7TD\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 eda812586f017cef555ec634fe64e334b198085a70913d5c59989034d05cd6e3
MD5 6a3d40013372675f855c274029537b7e
SHA1 1c1765b82e0824e4b11c9bf926c0d57bceee4074
SHA512 da02c1dd9945f8b8256fdf0f97acb45ffe8b41d09f3165c02c49a1e4073b594a3714365cf5813a8a179cce10601cd624dc2833683955bdcbef7393c5016fe273
TLSH
T13241F11181C8FA250F3302C2BEEBE431979E5723158E190B7099AD8BCF29AD74747037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3GB4LL0A.JLK\BEJ84YBX.7TD\ScreenConnect.WindowsBackstageShell.exe
Size 136KB
SHA256 6d6a1d834e285986fd0e3519cd06b5ea0060c2495871280812248451b4b54b29
MD5 03ccd3cba5ca3d8cdbf379af6c9c581f
SHA1 5f15237ebe890096e6ada2fa379ddd2fd9c80a76
SHA512 7f380ea2ecd30c825a26ded499578b1c48688dc963d528236442bfcc766d992635117b5291302fd54cbcd8554e8aa2e10d1fba2f6cd4dd6c1a7129e90717e9f3
SSDEEP 3072:nj03cxYB3pJIhP6DTBjYVLACbynHmqKpsWWsajn5Y:jkRpJ863eVkC+nGqysWWsw5Y
TLSH
T135D39D447B98D526DAAF0E7A64D1F32006F0F493C9D3C74B6C98327D2F18B922E592C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3GB4LL0A.JLK\BEJ84YBX.7TD\ScreenConnect.WindowsClient.exe
Size 1.5MB
SHA256 a29d983b1f94c6f797181fed194a98905487fdc02139ce002bdc49921e5fde75
MD5 d3a4aab9a64e151fc8329de02274ecac
SHA1 1ff7d0e56a0ae6863ae7eeccca08f5b1be67ea20
SHA512 da41fe713b9d3633e3f5399f3a8b0a881d808beee6d6d0b71133cf03e4a4a85fc86f9701079c67aa23e86640f445aebb9f68c9bcab9bd25c6ef571aabaeeab58
SSDEEP 24576:JzGOGtl93a7iTfwt2VIw9zbwACxoZHm5pfrTxoc2w136ifzCErYa1tp/RFE:FGOCesfJrYl52w13D+dKTg
TLSH
T198759DC97EE8EE66C95E0B7B8065220477F085918F63DB4768A07B7E1C893987D085CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3GB4LL0A.JLK\BEJ84YBX.7TD\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3GB4LL0A.JLK\BEJ84YBX.7TD\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 7cc5b81710e16a48baf5a217ec487d81c8a7317cac634c6f3f60a451f8e169e9
MD5 78b021b694b0c4a9b1b8d09e7b0f6968
SHA1 b87536062b33dce66682cb88853bd80c04473da8
SHA512 9f878037c7b8a6bc883430b6cfdbbcb490a08aea08034856f28ab6634e3d60d8b22d8083b2d81804388a338abff7684b38cef918914954e6adef6d333a5328dd
TLSH
T13651C61551C4FA350F3302C1BEEBE4709B9E5B22158E190B7099A99FCF2DA97474B037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3GB4LL0A.JLK\BEJ84YBX.7TD\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 f5516efddcbe335f483d2357862bcc1b6a1ddb8b0ad3c9ea940d2aabb25006a0
MD5 523e26d23800a6a2e909aa0cea5ecd0f
SHA1 be56c0efea2f32aa45ad1c7a5c595371c1bc9eaa
SHA512 80c217ab4490d1f04a57aec47dc852aa120937d888b5fdc6966809331ac281cd2e1c7acdbe21ce2f3d0d1b9734ee56459c94a72422731ce204c6e607c80f2f4c
SSDEEP 96:xWLwOhoyTzze2wvyqkKdkvkZk8bkUqkFDyk64kOpQkOpVk9PAkOpD:oRfegK+cSbiFD769UFUmZVUD
TLSH
T16BF1BC5684C07D21573381C4FEE39A14FD157F63026E148A7C4D19AF9FB25899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3GB4LL0A.JLK\BEJ84YBX.7TD\ScreenConnect.WindowsFileManager.exe
Size 117KB
SHA256 28024419460a83f9b00ba1af26a5acdeacc78b30ba67ddd7e51611ef78dd20b6
MD5 fcdc970fd96c82f59ef00193623478c7
SHA1 0dfa967cbb46600bf333949bbbf53563ea77b540
SHA512 ac92fcefcea69b2a2f766c956ac22fa5925f62f0fba2b947d13b70988788c00b5e34dd5b6c0a214387b7c1acca66db6f130dc7c74ed3bb06cde9bf2900fc9f98
SSDEEP 1536:/uabSp4xC7e7VQs03QSh+FzQpfUI5BLP+VVVVVVVVVVVVVVVVVVVVVVVVVSgNf7+:/O4EsO+zvuBLNQfa
TLSH
T1CBC3294135266231DEC5C533A052E9B099773F6607FEC6BD28A1BA3A39F03943E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/472-9-0x00000000745B0000-0x0000000074D6C000-memory.dmp

Download

memory/472-12-0x00000000745B0000-0x0000000074D6C000-memory.dmp

Download

memory/472-1-0x00000000034F0000-0x00000000034F8000-memory.dmp

Download

memory/472-2-0x0000000003510000-0x0000000003520000-memory.dmp

Download

memory/472-3-0x00000000745B0000-0x0000000074D6C000-memory.dmp

Download

memory/472-4-0x0000000005BC0000-0x0000000005D10000-memory.dmp

Download

memory/472-5-0x0000000005F90000-0x0000000005FFC000-memory.dmp

Download

memory/472-0-0x00000000745C2000-0x00000000745C3000-memory.dmp

Download

memory/472-6-0x0000000006840000-0x0000000006DFA000-memory.dmp

Download

memory/472-7-0x0000000006360000-0x00000000063F2000-memory.dmp

Download

memory/472-15-0x00000000745B0000-0x0000000074D6C000-memory.dmp

Download

memory/472-8-0x00000000745B0000-0x0000000074D6C000-memory.dmp

Download

memory/472-10-0x00000000065D0000-0x00000000067B4000-memory.dmp

Download

memory/472-11-0x00000000745C2000-0x00000000745C3000-memory.dmp

Download

memory/472-18-0x00000000745B0000-0x0000000074D6C000-memory.dmp

Download

memory/2788-65-0x000002051FAC0000-0x000002051FB62000-memory.dmp

Download

memory/2788-22-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2788-16-0x00007FFFAF95F000-0x00007FFFAF960000-memory.dmp

Download

memory/2788-35-0x000002051F880000-0x000002051F8D0000-memory.dmp

Download

memory/2788-14-0x000002051B340000-0x000002051B4C8000-memory.dmp

Download

memory/2788-20-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2788-17-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2788-24-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2788-26-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2788-23-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2788-71-0x000002051FDF0000-0x000002051FFD4000-memory.dmp

Download

memory/2788-25-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2788-19-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2788-13-0x0000020500C70000-0x0000020500C78000-memory.dmp

Download

memory/2788-59-0x000002051FCB0000-0x000002051FE00000-memory.dmp

Download

memory/2788-53-0x000002051FD30000-0x000002051FEBE000-memory.dmp

Download

memory/2788-21-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2788-324-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2788-47-0x000002051F910000-0x000002051F944000-memory.dmp

Download

memory/2788-37-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2788-36-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2788-323-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/4588-291-0x0000000000E00000-0x0000000000F8E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads