894f4c3130ce7d2a03928defabbce054a307f7b25f9771fc9336cd35417b41ce

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 21:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-08_08cd046b549bdac782d5f680339a751f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 3.7MB
Sample261009-1js2vst1es
SHA256 894f4c3130ce7d2a03928defabbce054a307f7b25f9771fc9336cd35417b41ce
MD5 08cd046b549bdac782d5f680339a751f
SHA1 8c69a16bb86fed5450fedff4907b3b64710c00b9
SHA512 5932284d26467fdfe77f3965b662b5f789a58efe5198b1bfbf561b201ac6df7eef0486ac3cd6f1b546a5d2684c1202fc3b86fd48cc327a85a02c724ffba791dc
SSDEEP 49152:q37WzvyUv6M/QLxuekbtJkGYYZTk+T1iH7efPoV8D7vd:a7SpSuSM6efPoG5
TLSH
T16606C04AFBC6A677C47E053584666314A3B0B4464B63CBAF6AE07B3D1D323D06E253C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 5 IoCs

flow	pid	Process
8	5080	dfsvc.exe
8	5080	dfsvc.exe
8	5080	dfsvc.exe
8	5080	dfsvc.exe
8	5080	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
2380	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\E72V080O.ER8\B4914RM1.QH7\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-08_08cd046b549bdac782d5f680339a751f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-08_08cd046b549bdac782d5f680339a751f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-08_08cd046b549bdac782d5f680339a751f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\lock!12000000a8c5590e4c090000f80700000000000000000000c = 30303030303934632c30316464353833366635386333306238	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_000000000000000 = 32003000320036002f00310030002f00300039002000320031003a00340031003a00330035000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_000000000000000 = 680074007400700073003a002f002f00730063002e006f00740073002e00670072002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320036002e0036002e0035002e0039003700340032002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320036002e0036002e0035002e0039003700340032002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e00330032000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\lock!0a00000069c5590e4c090000f807000000000000000000002 = 30303030303934632c30316464353833366635386333306238	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_702952a95297b6bf	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_702952a95297b6bf\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c310 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4\lock!1c000000a8c5590e4c090000f80700000000000000000000c = 30303030303934632c30316464353833366635386333306238	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_000000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_000000000000000 = 54007200750065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\DigestValue = 1f03c9fb4538a42a50cc555b849fbb7950b8b17d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d\Files\ScreenConnect.Client.dll_fc1d7bd48553fcab = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\lock!0c00000060c4590ed81300000416000000000000000000001 = 30303030313364382c30316464353833366565326562366633	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\implication!scre..tion_0000000000000000_001a.0006_cb9d = 68747470733a2f2f73632e6f74732e67722f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\Files\ScreenConnect.ClientService.exe_e781b1ee36f = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_d61721614ec12d40	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b\SizeOfStronglyNamedComponent = 02d7020000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d\SizeOfStronglyNamedComponent = 1f000a0000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_702952a95297b6bf\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d040	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\Files\ScreenConnect.Windows.dll_fc0d83aff7df0b5b = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d\lock!14000000a8c5590e4c090000f80700000000000000000000c = 30303030303934632c30316464353833366635386333306238	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_702952a95297b6bf\appid = 68747470733a2f2f73632e6f74732e67722f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d\implication!scre..tion_0000000000000000_001a.0006_cb9d = 68747470733a2f2f73632e6f74732e67722f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669\lock!0e00000060c4590ed81300000416000000000000000000001 = 30303030313364382c30316464353833366565326562366633	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_702952a95297b6bf\lock!1100000060c4590ed81300000416000000000000000000008cda75 = 30303030313364382c30316464353833366565326562366633	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\lock!16000000a8c5590e4c090000f80700000000000000000000c = 30303030303934632c30316464353833366635386333306238	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\lock!0100000075c3590ed81300000416000000000000000000001 = 30303030313364382c30316464353833366565326562366633	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\Files\ScreenConnect.WindowsClient.exe.config_f7f1 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_702952a95297b6bf\scre...exe_0000000000000000_001a.0006_none_5d04069fbb3 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_702952a95297b6bf\SubstructureCreated = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_702952a95297b6bf	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999\DigestValue = 5927d19820a40ddd05b8cbd80e1b3dab49d6cd49	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b\lock!0200000069c5590e4c090000f807000000000000000000002 = 30303030303934632c30316464353833366635386333306238	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_000000000000000 = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_cb9d3442e907ce07\appid = 68747470733a2f2f73632e6f74732e67722f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e\DigestValue = 814099c577c446e8a8121c2d30809d3f4aa73b15	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_cb9d3442e907ce07	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669\lock!0c00000069c5590e4c090000f807000000000000000000002 = 30303030303934632c30316464353833366635386333306238	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_d61721614ec12d40\LastRunVersion = 68747470733a2f2f73632e6f74732e67722f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0006_702952a95297b6bf\implication!scre..tion_0000000000000000_001a.0006_cb9d3442e = 68747470733a2f2f73632e6f74732e67722f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e352e393734322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0006_702952a95297b6bf\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c310	dfsvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\OnlineAppQuotaUsageEstimate = "6420055"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_0000000000000000_001a.0006_702952a95297b6bf	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999	ScreenConnect.WindowsClient.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\E72V080O.ER8\B4914RM1.QH7\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1624	2026-10-08_08cd046b549bdac782d5f680339a751f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	5080	dfsvc.exe
Token: SeDebugPrivilege	2380	ScreenConnect.WindowsClient.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2380	ScreenConnect.WindowsClient.exe
2380	ScreenConnect.WindowsClient.exe
2380	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 5080	1624	2026-10-08_08cd046b549bdac782d5f680339a751f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	90
PID 5080 wrote to memory of 2380	5080	dfsvc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-10-08_08cd046b549bdac782d5f680339a751f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-08_08cd046b549bdac782d5f680339a751f_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\scre..tion_0000000000000000_001a.0006_702952a95297b6bf\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\scre..tion_0000000000000000_001a.0006_702952a95297b6bf\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\manifests\scre...exe_0000000000000000_001a.0006_none_5d04069fbb36ef7e.cdf-ms
Size 14KB
SHA256 9f4d3d07bbb55683bfdf3ff0b546dac6c35ac869a29b76d8a13eb88f3665d27f
MD5 cb7bea294587418bd5a6b1018827d5c7
SHA1 9abb7c386666f4177c3cbdc2c509540d8c0eb466
SHA512 9278dcc6bc8f1ef16e4ef90029009a72200892c581624e9a52622606521bb437918515ff19fd9f7e5a9b976ccbc481a87719dacef9e0ae87bf96e169651c4412
SSDEEP 192:t33wHfSODOqf6Zy1SwGsw3WTMGAlDKBpLmPOXPA4R8EJVC/D27G94kjB5j4:tQXtSZ5b3oMGAgAi1jmVR/j4
TLSH
T1DF625E25BBC0E5F7D1514E739FB7C694E310BE6E1EA510873040373EA97D0894F66298
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\manifests\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669.cdf-ms
Size 3KB
SHA256 6f8c21bce9d07fd92e9e0820fe49d4222f9a0f16de1bc22a80a85a166a15af1d
MD5 b5098b958410c6610e1bcba70a85e3b0
SHA1 aa52cad8e75f4dde6d93df272f48b806e367bb13
SHA512 5b92091a126243e33f1fb7b74e16ba21698b3be285a47323303cc0f21457817668f5aedf952e4025cd26600f0e5917de6092454634380061ca26ee6fc8d48429
TLSH
T115617742B684EE13D9A90273ACD6D2ED37747E83DF42520B75C4BF2F7A312E55212191
MD5 SHA1 SHA512 TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\manifests\scre..core_420d02d3849b7992_001a.0006_none_3770af6af4b7e669.manifest
Size 1KB
SHA256 5bef6c316992b20a446529d90cf9eacd76882ae8c8ccbb5a48e082255a714589
MD5 f0d61fa6e938195134f7a6b8bcde1d0b
SHA1 9e9385362ebc6e63990b8b09742b12de51364550
SHA512 7d73511dc473509a01e816530d13425b2beb0e5f02caaa7310e8293fda5f7f88b4b76393d2251e10245e1a61bc4dd7ccc592835c905ef95b89e2055e18cd8eb6
TLSH
T189216A0181C8FA261F3302D2BDE7E42197AE5B33148D194B7069689FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\manifests\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999.cdf-ms
Size 5KB
SHA256 d48c8a11f776e791a9ec82c7bc90d6dbf1f94978b383f2dea467d7f9299a804c
MD5 aa91d0fa9c55e70d9a6007cc0817a01d
SHA1 3f04ccdee6d3e52d274ad361e6e141779452cf80
SHA512 997eb2b00565e90064e737dd7cfdc36aa306c4c93703e2a19c1b14ae953b20088c57f3581cfa76b4131ea414e433d200c90872d92e7af8c691f440ae50bf5ffd
SSDEEP 96:MBW+RzgtheV+Ww7OLFIuOQlVXXezcpviCwimdR:MRzgkJfauNB6Me
TLSH
T142B142117290DD1BD5B90633ACA6C3ED2B36BE92DE43030B70D4BB1FBA326D65222195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\manifests\scre..dows_420d02d3849b7992_001a.0006_none_3be8874c3105f999.manifest
Size 1KB
SHA256 69469980fdc8b3c31191ec79ab23efe0803f49bc3d27d73637ffed5beda29765
MD5 963bb2ae3f64f0fb46e388b361350539
SHA1 e6b47be9925bed2bb0f07a6b0e92e86fe7acd4e1
SHA512 da84be8c06310d47aa63b393076b1e124165782cf2488c9d668fd67d0e0289c3d50c4517d576c9d74ca53b8748193c7a0a121add3c679c6896bf89a6562f71b5
TLSH
T16041F11181C8FA250F3302D2BEEBE431979E5733158E194B7099AD8BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\manifests\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976.cdf-ms
Size 7KB
SHA256 5c495f0f95010eed59044bb94b9c2e3419d2d136baf2a909c05fa8c0690540a9
MD5 186ecf15304df27c0eedf3a394d48894
SHA1 750f93afbf24482bc8e8dc97cba6d5e2ea30d425
SHA512 dd3b5721403c743640a3d0ddb54dcfa325e2e03468ac15a067941df5c1299ed71e600ffee086fc7793932a523a7ce819a2a15018f7db857c52338dd03787af8a
SSDEEP 96:7OONY6gnxfq4qFeV+WwwOL586RgcQB/EhiUfwJsiP2nfGiksVGvYy:qvnJDqaJ4lRauADNz
TLSH
T116F17702B295EE67D5B90A339C97C3ED3A257D82DE43470B70D4BB3F7A322D62212195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\manifests\scre..ient_420d02d3849b7992_001a.0006_none_98b7888edd9bc976.manifest
Size 2KB
SHA256 996eb91b8f7546a582d532ad83a708588f609c816015ebd84c567c86ee558691
MD5 f1e58ca6c858d80aa38c823d6d018bbc
SHA1 5af4bc04d78609ec78207a909cb8bf703f6b82e9
SHA512 f9bcb306e12a165ed5d4b05f56b79e77934a04bbb6ef1e8fc795be2eca263623dee418703445bcdf4b54d08bd62c4f9b71d3ba5e1d256765908ce16d62d1eb19
TLSH
T12651071551C4FA310F7302D1BDEBE070979E4B32158E194B7099998FCF2DA97478B027
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\manifests\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d.cdf-ms
Size 2KB
SHA256 99c2a3ec2300b37fba05c483a834b80ded5d7bcf08134d6b0c2bb480f70f233b
MD5 b0cb9b32a0fc7578da22f29924722478
SHA1 a51612940f461cecaf7ba409be2e33690317ade7
SHA512 45ef4d24f440bac3783499eaa6641d080fabe7b855ae510d4ad82b1635bf11270cdea4713e76d4e71330767279412e764ce1d2da2926af682f8b125937deb17f
TLSH
T1E95178057784EA67EA7A0233EC92D3D933357E82EF07031BB190BB7F6A716C55612092
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\manifests\scre..ient_420d02d3849b7992_001a.0006_none_cd860d3d04073c6d.manifest
Size 1KB
SHA256 8929cfa8bbea4aa718881c3a63e629417df02a709acc8528bf7b8ba18c3ca06c
MD5 019356a9dbbfd64a3b4053b525c82b1b
SHA1 94c617d66698691ac8c48b91b16edf6c4f2a2500
SHA512 4bca960c60f45896defda926e0de61a7c944a0271f5d7587ed26be93f4ba0cbac970aeaf6e8102ba2cdff5a12c20445221de03a4d307f28d963a5c2ef51cde65
TLSH
T16B117B0191C8FA361F3341D1BEE7E420676D5B33058E194BB06A689F8B29AD743470B3
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\manifests\scre..tion_0000000000000000_001a.0006_none_0a89b4a7baf2127b.cdf-ms
Size 4KB
SHA256 ad24e0b058616843aff257760b91ba8dc8d6133423c9c21a0e17a9221769ccfc
MD5 8bfbe26da4b8d71d91c50be7fa442d42
SHA1 ae26eb83ace2c547f92734a51b290d21548793c9
SHA512 ab242dfcfdff1e37cb25ec072288b478bd37a8dd954c8dce197d92853b2f64cd894efc6021a6185262b251ad46015d3886bfbcd8b4ea7d7b47ea0e14c3330050
SSDEEP 48:nP/mrIIAqzIvrzBgERu9o0m5RD7J2U7gFUTUETkXhf4MVvg3eZ22mG4lUvI+IQqr:POUWGBEW0m5R/cUmIkXlVvbU2mpqIQqr
TLSH
T12C914081BB40E823EA1497329CD3D2D033357DA64FD6971770987B2FAE367C59322266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\manifests\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4.cdf-ms
Size 4KB
SHA256 e28811a2b798151c368b932f5aff326a94cb39f265cfe036a0389a1ac285d4ee
MD5 107be5d4ef4b4e9d848a309355cd43f2
SHA1 b19089485731be37d89f4ff84ad1c66586867aac
SHA512 20423878653197e4fe789ffe3d99daccfc0d1f65cddbe6692bfec45137f6d26f752100ba6c8770c97b0a763a82fed644cd03081dcd41ff0fc5631e2212d0448a
SSDEEP 96:eQItRqeV+Ww8OL54cKEle4SEf7I2skyFc6C:ulJoTKJWZV
TLSH
T1B2A18A017294E967D6A50633DC92C2DD3A357E82EF02570B71C4BF2F3A316DE6325195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\manifests\scre..vice_420d02d3849b7992_001a.0006_none_e8c447b38a7749d4.manifest
Size 1KB
SHA256 c39d1fc54f7937e8b62fc70bdaf42e165b1fe4a19c54f84e8cf9d922b2de6c48
MD5 a10c6c6900ef5832dfcf74c2b49f8d10
SHA1 df5de264304a3f83b9fbac0279743397dcb0ed72
SHA512 c70b3cb7f21a70a8d59b016e286a6670e23f3c9db9e3757ac687f679c15fa380b9a6ffa025035552f164c03925dbe2681a8fee006276ef99f750fce37b0648fe
TLSH
T1DE31261591C8FA350F7302D1BDE7E0305B9D5B32158E194BB05AA99FCF29A97434B073
MD5 SHA1 SHA512 TLSH

Submit Download

1kvi2o2f.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\scre..tion_0000000000000000_001a.0006_702952a95297b6bf\1kvi2o2f.newcfg
Size 850B
SHA256 d590205634a1407f65a783d0b9012aae6da07bceafdc090a955f81e83f89fe55
MD5 829f94706c9b332ee1d924d6a40ec092
SHA1 8eaa6e9bb557710b58ba7524392ac116dc5f23ac
SHA512 1c0c4e6337b25e3b8af8febdd71d45ad37d373c93d1c39f29aa66a833ceed65ca6d906cab0db59cc074992db58b6317393368ec1a87b78bfc1411537bcd4feec
TLSH
T15B01455871C0AF8A02732A36D26143C2ED720A97016560D874EE223B9F704DF0BB36EA
MD5 SHA1 SHA512 TLSH

Submit Download

3gw2frw5.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\scre..tion_0000000000000000_001a.0006_702952a95297b6bf\3gw2frw5.newcfg
Size 850B
SHA256 0d53e5a63af790c96de0d93740293fb855879e9f0d2ae9d150f66ad6589daeb6
MD5 c0720cabc087801098fd755798b0a0ec
SHA1 6d7e89d79de9a31dd51869897fbf30ba847c9bbd
SHA512 3e37574c5e477765d64bdd28b5cdaa7d2d8151cddf515e5ce846420cc9fa1092d131db04916bf9145cb78dd21edaedd342cc70cf686f7261b7c41b9ee3cb1647
TLSH
T1C301455871C0AF4A02732A36D2614382EE720A97016560D874EE223B9F705DF0BB36EA
MD5 SHA1 SHA512 TLSH

Submit Download

3yvmlgkq.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\scre..tion_0000000000000000_001a.0006_702952a95297b6bf\3yvmlgkq.newcfg
Size 850B
SHA256 3f3a69682888ea205c4530a8d325f877e796aa817503673e389591e455147bc7
MD5 d205efc8e37b0d098b48c0797ef0aca0
SHA1 c42370c4306385d635896dea3ad8decc6f324603
SHA512 d17010125304df90adf23b68c80550bcd3b9b7f040628926c3936ced33c376f8b961678e3f37cc47f8e0f6881029e42c68bd4b6948fb05f1c333f6a9d3f606bf
TLSH
T13801455871C0AF4A02732A37D2614382ED721A97016560D874EE223B9F704DB0BB36EA
MD5 SHA1 SHA512 TLSH

Submit Download

adqx531i.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\scre..tion_0000000000000000_001a.0006_702952a95297b6bf\adqx531i.newcfg
Size 850B
SHA256 c0594c888185e888a9f90fa2fdd50d61a7562c06e9765ceaeaffa94457b1349b
MD5 0da04e0645c6d1328ebf15a4cc0fcce8
SHA1 8d81a561bc9c451a381352eb6a81498b0147200c
SHA512 f17105e64579ce93887a9ccc541df9320da185f9a8472c2762e0adc4f9659e8f5d4792c38b2f643d2c1e501f90ddf955ef13c26ecc0d549e85d242d93115f0f1
TLSH
T19601495C71C0AF4602732A36D1614381ED720A97116560D474AE623B9F704DB07B36EA
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\scre..tion_0000000000000000_001a.0006_702952a95297b6bf\app.config
Size 480B
SHA256 539ced4709308b42a10eda29ad622d4f3d79f71a3037770ebf88165353e1935d
MD5 da54a4bd90c5ab9fc03c368d8ee76f85
SHA1 019815d9a748b8737658c17af56229b545a5fccd
SHA512 229363450e18ab748c80c716af7808622481323ff3a95186a91b1b884834f795c54318170eff8c3283fe28eeaa87f80c5c0121913b84119b488bac58ae84d314
TLSH
T18EF027AA70C07F5603636E23E9220281ED308B57006620A470AF21375B716CA03F36DE
MD5 SHA1 SHA512 TLSH

Submit Download

mjbvctcy.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\scre..tion_0000000000000000_001a.0006_702952a95297b6bf\mjbvctcy.newcfg
Size 850B
SHA256 e1a07f796dfeb9c3414f74fdfa4cb31736355c7a765082b53fb7c3ac47ef92fb
MD5 3cb8581112cb01248ab029be7d4ea486
SHA1 3c98f2705e3194303a3fb385844088295d84cd49
SHA512 e6c82019a3fbd88692fe1c0d20bae45dff3534992520fbfa3299f1e74de6ded2c860de5a46b261168a0243a1d8e302060305e5030145ca97ff36d7c6af0a7d7b
TLSH
T15601455871C0AF4A02732A36D2614382ED720A97016560D874EE223B9F708DF0BB36EA
MD5 SHA1 SHA512 TLSH

Submit Download

ox3iwhr2.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\scre..tion_0000000000000000_001a.0006_702952a95297b6bf\ox3iwhr2.newcfg
Size 850B
SHA256 952eaafd871f2a7337448ac08dbfcb2c59db26e46f2c6cd454b67c8a6e1f8cec
MD5 dda5d994fb4016fc19bd9194b69f4568
SHA1 0a6d829e60b8be8faec24490a6da5a468733ddeb
SHA512 27cd9d03bda0df7d653168e53f30652c80b5634615991ab5bb1a5054f659d4bdd13c9b37812a5cedeab1b788c316c339b226a01e2ccac96482ff913664faf762
TLSH
T1E301495871C0AF4602732A36D1614381ED710A97016560D474AE223B9F704DB07B36EA
MD5 SHA1 SHA512 TLSH

Submit Download

pm3ssmca.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\scre..tion_0000000000000000_001a.0006_702952a95297b6bf\pm3ssmca.newcfg
Size 659B
SHA256 9b412589170bd3fcfd8bbcf0310ec72af9a0260e41811c063bffb176e9cc997d
MD5 41d059f8ecdbccb5e0917423021c56fa
SHA1 3e71cc8637e713c97aaa52cd9b6fd2f57e259131
SHA512 a8668e299847f03be1db3bf6d1ef70dc25b88e69e370a10a2233e47b0c5260feb59642a7d2f2989c67f9ab7fc74b40c65b66fc01cfaf81893af21578b125da1b
TLSH
T15101286871C0AE4B02732A33C6218381EE721A9B056520D874AE223B9F705CF07A32DE
MD5 SHA1 SHA512 TLSH

Submit Download

tcdmdjo4.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\scre..tion_0000000000000000_001a.0006_702952a95297b6bf\tcdmdjo4.newcfg
Size 850B
SHA256 14ae79ec62f2390cf83e5948a2e9708a8787d6bd9bf14adae87137a7a13456b2
MD5 5837146dbbdd85d3a43484a2edb89feb
SHA1 504f1ba5e357e51bd6a3ab83b895d023d76b6d2f
SHA512 5178306739008722e229f779645d920305e8a8de9b9b2d03d32b63dbfc761fd3a8378541912a02918f0e802ff1e00d6e160a993707b9938a9377e9a24e99a6ff
TLSH
T11F01455871C0AF4A02732A36D2614382EE720A97016560D874AE323B9F704DB0BB36EA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\scre..tion_0000000000000000_001a.0006_702952a95297b6bf\user.config
Size 520B
SHA256 30e5abfde73f7777ccf1b19f10e7be0ef8d8afce2ba9d0d567df6acf968b36a4
MD5 56052fd04375079300b63bc2da709e23
SHA1 d55b6f9a5b7e710c79ace7687e40637c7ec52a27
SHA512 73847dfaca0de6d079b2b8b3bcf68bcf34fcd8a4ced6f96533995fa2e1f61df9cb7237b64770d1ed9f0a1c23e49d0fbc9a9c7749a02b2b6a91768378d6ea91b8
TLSH
T116F0E2A131C06E4B07A36E23C6128741EE726A9B0565209874AF627A9F315CE03A32DE
MD5 SHA1 SHA512 TLSH

Submit Download

xhqmxwjx.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\scre..tion_0000000000000000_001a.0006_702952a95297b6bf\xhqmxwjx.newcfg
Size 850B
SHA256 b2f03e6f3af82cb1b4c6f8f0c42c09c20ea5501e1a7f86d859e026981ff4e634
MD5 c4659cce32217b73a3d7ee128a7611e8
SHA1 161fd2269f107f49f19a1245ea0fcf0f08f029f8
SHA512 041240c2926d6bbecfc4ec5df4d920ecb1787a2baf1ddd0951b37f3bb033a5ac27b784494837471bf00e70c3a6fb617555c384cd61f824d227454c90b905edbb
TLSH
T1D301455C71C0AF4A02732A36D2614382EE720A97016560D874AE223B9F704DB0BB36EA
MD5 SHA1 SHA512 TLSH

Submit Download

y0jxymdq.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\XNG48YY7.926\PW6ZMC02.RCO\scre..tion_0000000000000000_001a.0006_702952a95297b6bf\y0jxymdq.newcfg
Size 850B
SHA256 688816562cd8103263cdedc57c31532ac8e6a0c64c2a886f74e0d589fc02a329
MD5 ab1a476185358ed059e59ec5b741ed6d
SHA1 0e579c96ee1d00149dd7c06ece28a4592d48aebd
SHA512 5c1a05b6dde7e3c34947eee87eaa9d4b56251c5c3c42c8764b182f0c6d91cf8a6632060912e94ef90571fdfe133298d312ab58e06c698e9e9d14d5b2b7afc042
TLSH
T19E01495C71C0AF4602732A36D1614381ED710A97016560D474AE223B9F704DB07B36EA
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\E72V080O.ER8\B4914RM1.QH7\ScreenConnect.Client.dll
Size 636KB
SHA256 d36e154e3b5b677642c3fe051a549a5f46ede0110a10d0e74845e393373abddd
MD5 05798efabae3c98e61270ce204bb2ee9
SHA1 e8a1d752916eaa86f3d58a11b14e6d07de2c66f8
SHA512 922995f79a1a2f8323a0c79273d17ee9e51b053c7f780a4c1e3739c6d9be76169289016bfbaf38f7f378e40710aeab33c16ff0e310c82da24e759eea2d9c1d26
SSDEEP 12288:W4/aH/qxxC/zHTEavSW7OQniuyu8RHreg:v/c/q/izEn8qul8RR
TLSH
T115D4D08DEB94B92AD9AF0773F1613619AAF06CD6885BD30F1D28767C4D713843A5C2C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\E72V080O.ER8\B4914RM1.QH7\ScreenConnect.ClientService.dll
Size 188KB
SHA256 9a05b9925da7b29c6f24f806ae4cf2500d18d31a905b8e926622760e46e9c0f1
MD5 4df2863f5d14d2504ee3e1cb41f2e920
SHA1 4b3c74bb2c2b8e030612cc6b7952b5b63387b0b2
SHA512 7924fb651ead53a562e770140eb14f2f5e5aa4d38e6d01c92eb6f6a4801ccd635702084598c03f02f43bfa7da8fa97f7a1e11ecd11db42c7cf7d7151f8a1af8d
SSDEEP 3072:1as9p5nhzF7C9a+S6fg5ClMJEbPR1tV8NiMd+DHQvVHeDkVHE:vp5t+S6IUMEb51ui5HTwW
TLSH
T1D614AF48BB5AD936C59F0A3BA451B22006F1A443D9E3C78FACD872DE1E163D52F543CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\E72V080O.ER8\B4914RM1.QH7\ScreenConnect.ClientService.exe
Size 93KB
SHA256 943089436b7648644937dd53b4d1a6a0ad12a10585eda3241cbe524f7f544914
MD5 2575df30c19035276786163b4ad0ca1a
SHA1 3cc685d1fe1e726cb3fd585577f1afdb76dfc17b
SHA512 92b0624f7f4f7460427ddac84311ac240b94bfc9e58ed42ea6f99f3f409fe1a35018e22d2b38099b9187f88cc2fbf12b985ee51c98da9e44020d48936e6b7a6e
SSDEEP 1536:gg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoU0HMB7U:JhbNDxZGXfdHrX7rAc6myJkgoU0HkQ
TLSH
T1AC935B13B5C28871D473193158E0DAB09A7FF9215E21DEAB3788022E4F742C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\E72V080O.ER8\B4914RM1.QH7\ScreenConnect.Core.dll
Size 1.3MB
SHA256 041163eb04d9a392f2a7747da3b03ff83369876c43fbc8980ae5a1ccd4cbaad2
MD5 83baf842579d941db433905ff568eae4
SHA1 79034406fb413d6bbbf7d77fb7c0b2c37202fc3a
SHA512 a9da91485e46ca530407597ce15714087db6551e808fcff982c92c99abbc5dd5ebbe659915600927fbec94d63ae9415003a76dc9f14ac8c1cb3bd1509b6946ed
SSDEEP 24576:eRitn37WwOMxzCU/KbsQ/bjyUvPC1EV/QLuug:337WzvyUv6M/QLxg
TLSH
T1D6558D4FBB99AA27C9BD093340505204A3F0E0D75B67DB1B39F0AB3D5D593A86E482CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\E72V080O.ER8\B4914RM1.QH7\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 2992232db7e7272f7fbf971168ef8910bfabbe7a353e86311c6a18f9903e4a24
MD5 c5142af6023345e1df2883326f7d0b63
SHA1 5927d19820a40ddd05b8cbd80e1b3dab49d6cd49
SHA512 b0b59d3aa4064b565b22e54c820c11a7d8444a43aabf928a7e2964b7859c29bae217d98f4650794074d290233ddb317a634b012206c080132cbbdcd29bbb6596
SSDEEP 24576:/2f2beLbtFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfK0:uekbtJkGYYZTk+T1iH7efPoVU
TLSH
T17095AD45E6C365FAD46F043888BE632AA7743C040355CBFB97D4AA3A2D337C09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\E72V080O.ER8\B4914RM1.QH7\ScreenConnect.WindowsBackstageShell.exe
Size 136KB
SHA256 ee0f315664f3361ca8e8f202f910baea2895481506f3bb2659d17c8967db64b3
MD5 835a313bfd4abc9fa4aef1d281357f82
SHA1 d10fcd9047b094d048049dda07790c9e4feae3ac
SHA512 7c3b1211e47cc72aff5d62403765f07c4130afb72e3cca6b3ac8fcf3a35d3c536ded091c0e6293f60f596b15fbd92d35917515778df61a8f69cf1d8bb8899cb0
SSDEEP 3072:6+O/cywOnOQaioWtA6gZHVDLCKcJxfRzQN:0/wOza/WtAPZJCNjf4
TLSH
T122D3AE807798D925D9AF0E3BA4A1B32006F1F097CAE3C7476C98267E6F25BC16F542C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\E72V080O.ER8\B4914RM1.QH7\ScreenConnect.WindowsClient.exe
Size 1.6MB
SHA256 b88b3e3b57f2d0274e16fbb67cd6b77d5c8b32eedde39c47ebc9fa4ef160500e
MD5 2f493a04ccb0545b79875f15a9e6d2f9
SHA1 1f03c9fb4538a42a50cc555b849fbb7950b8b17d
SHA512 f61893acf63849833dda2f2bc806d7779730457f55be4313d146d5035b5f7b88ad7cb8b61d869c13b793573288190da5653c24f0707234ca40d85dcd08697685
SSDEEP 24576:Fp5otlId86KGiOy2cxo7ZepaqaL3d9GtnP9+/qr40DThuNoqqmF:FpO+8u+AkDaou
TLSH
T1F1759D8D7F95EF67C92E077794A12201A7F084948F63EB076890B73E1C893947E489DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\E72V080O.ER8\B4914RM1.QH7\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 56e63aa2b20df91140067ee5198f44308d4396a78970412c2f65e04686ea9311
MD5 190b3b98c72f43f5121c5e09a6d2efcb
SHA1 814099c577c446e8a8121c2d30809d3f4aa73b15
SHA512 288bd0e90cce82929af745dd7b8016776acb5bb9bb40acc2dfcac68fd6ea9bb45a5815b160f2a519579cb91a9d4d7f9c2b84e7608970333ace7863bc4a58a998
SSDEEP 96:xWLwOhoyTqUe2wvyfkskjNkL7akzk6qkiDykSJ4kOpQkOp/knAkOpD:oRpeT5jOL7zY8iD7o9UFUMnVUD
TLSH
T1A0F1BC9684C0BD21573281C0FEE39914BD157F2302AE148EBD4D19AF9FB25899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\E72V080O.ER8\B4914RM1.QH7\ScreenConnect.WindowsFileManager.exe
Size 120KB
SHA256 3e89c58b3a1c6ced8208602665cf0f85601c686c6d1d5bf95c3760648f02984c
MD5 603013abfe4f61722bdd0a7c95a7b52c
SHA1 9517c4c974bf64dea1130631c8b4db1dcf33f122
SHA512 b5ecba418ea266dd049e0d56d32a730424d2e87378d097dc7cde0334f63671b98327dddb2031d9987e58fd5fb4375b092fdfd3003400caa816b7bd7872aa3445
SSDEEP 1536:OsgYi2XAsTWmce3hMxHE/HMpLwEc3RI5BLP+VVVVVVVVVVVVVVVVVVVVVVVVVSgX:Osgswsoe32xHEPMpLuuBLNhx+
TLSH
T1BCC33A5135266135EE89C433A052E97199337F6607FEC6BE2CA1BA3A38F13543E89D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\E72V080O.ER8\B4914RM1.QH7\ScreenConnect.WindowsFileManager.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

MHRP7AVG.Y3Q.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\OEM0JXCZ.MAH\MHRP7AVG.Y3Q.application
Size 177KB
SHA256 41ace760bb287839729fdcb7f1e9478ac3f80bdc147e86e99afdcade7472a61f
MD5 919f2c7d74d20245b6d7161c7bf4216f
SHA1 0f167f5a8a3e6c7e2723afa34d5baf9efae7c921
SHA512 85125724f8d98ddddebd97f0358b8e81c360c9303bfb3e9a004ecf6de3a67da557d4bb591c5529e48092b6e659e616a5d9c758b9a92340d7decda29dbba0211c
SSDEEP 3072:6R5tyFWLLdfxgAwuuBn1nfdvg2XOcuenKuLr2JXXF/07w:6LvjwuuBn1nRWenMJd0U
TLSH
T1FD04B63D8F34F5C0477D7421D0A52C573D825B939B330BACDA0A296B0D69792EF1AA6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1624-8-0x0000000006020000-0x00000000060B2000-memory.dmp

Download

memory/1624-3-0x0000000074C90000-0x000000007544C000-memory.dmp

Download

memory/1624-6-0x0000000005C40000-0x0000000005CAA000-memory.dmp

Download

memory/1624-7-0x00000000064F0000-0x0000000006AAA000-memory.dmp

Download

memory/1624-17-0x0000000074C90000-0x000000007544C000-memory.dmp

Download

memory/1624-0-0x0000000074CA2000-0x0000000074CA3000-memory.dmp

Download

memory/1624-5-0x0000000074C90000-0x000000007544C000-memory.dmp

Download

memory/1624-4-0x00000000057B0000-0x0000000005900000-memory.dmp

Download

memory/1624-2-0x0000000001660000-0x0000000001670000-memory.dmp

Download

memory/1624-9-0x0000000074C90000-0x000000007544C000-memory.dmp

Download

memory/1624-1-0x0000000001640000-0x0000000001648000-memory.dmp

Download

memory/1624-10-0x0000000006260000-0x0000000006446000-memory.dmp

Download

memory/1624-11-0x0000000074CA2000-0x0000000074CA3000-memory.dmp

Download

memory/1624-12-0x0000000074C90000-0x000000007544C000-memory.dmp

Download

memory/1624-15-0x0000000074C90000-0x000000007544C000-memory.dmp

Download

memory/2380-289-0x0000000000F20000-0x00000000010B4000-memory.dmp

Download

memory/5080-32-0x00007FFB72670000-0x00007FFB73014000-memory.dmp

Download

memory/5080-16-0x00007FFB727FF000-0x00007FFB72800000-memory.dmp

Download

memory/5080-13-0x0000024181130000-0x0000024181138000-memory.dmp

Download

memory/5080-14-0x000002419B8A0000-0x000002419BA28000-memory.dmp

Download

memory/5080-18-0x00007FFB72670000-0x00007FFB73014000-memory.dmp

Download

memory/5080-19-0x00007FFB72670000-0x00007FFB73014000-memory.dmp

Download

memory/5080-20-0x00007FFB72670000-0x00007FFB73014000-memory.dmp

Download

memory/5080-21-0x00007FFB72670000-0x00007FFB73014000-memory.dmp

Download

memory/5080-22-0x00007FFB72670000-0x00007FFB73014000-memory.dmp

Download

memory/5080-31-0x000002419BF00000-0x000002419BF50000-memory.dmp

Download

memory/5080-341-0x00007FFB72670000-0x00007FFB73014000-memory.dmp

Download

memory/5080-42-0x000002419B870000-0x000002419B89D000-memory.dmp

Download

memory/5080-69-0x00000241A0770000-0x00000241A08C0000-memory.dmp

Download

memory/5080-33-0x00007FFB72670000-0x00007FFB73014000-memory.dmp

Download

memory/5080-63-0x00000241A04D0000-0x00000241A0502000-memory.dmp

Download

memory/5080-57-0x00000241A08B0000-0x00000241A0A96000-memory.dmp

Download

memory/5080-34-0x00007FFB72670000-0x00007FFB73014000-memory.dmp

Download

memory/5080-51-0x00000241A0580000-0x00000241A0622000-memory.dmp

Download

memory/5080-45-0x00000241A0810000-0x00000241A09A4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads