51add5c5a23472a1b6f86a346c1b4876e202d86388855f6812f57600215e7bf3

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_bc9eb84078ac35573835054b256cb9f2_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 3.7MB
Sample261023-2g8j7set3z
SHA256 51add5c5a23472a1b6f86a346c1b4876e202d86388855f6812f57600215e7bf3
MD5 bc9eb84078ac35573835054b256cb9f2
SHA1 9d950dffe8271ec8ef37075f762731f321ee2912
SHA512 19b0414d894f46bc35f6fcd480622fbd0a97c1c0bab8569fe97e60f668dcf9d79f4a28da3537820f8eae98e4f19cdd758f6f969cee93217b8755e134e17abac4
SSDEEP 49152:GIxpW9j5bhUp2sEH4HPnUWsUJkGYYZTk+T1iH7efPDpsEfURyb:GTj5tU6HJ/RM6efPDiEf3
TLSH
T16D06C045FBC7AA67D83E053588796300ABB4B44047A7C7AF6AE47B3D6D223C01E253D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
11	2744	dfsvc.exe
11	2744	dfsvc.exe
11	2744	dfsvc.exe
11	2744	dfsvc.exe
11	2744	dfsvc.exe
11	2744	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
1332	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\0J9AM9OK.H4E\X50Y3W2Y.D3T\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_bc9eb84078ac35573835054b256cb9f2_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_bc9eb84078ac35573835054b256cb9f2_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_bc9eb84078ac35573835054b256cb9f2_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_27fa83f1ad328157_001a.0006_none_af3936fe72eabcf7\implication!scre..tion_27fa83f1ad328157_001a.0006_7a8 = 68747470733a2f2f7a6572656761636f6e7472616374696e672e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0006_none_af3936fe72eabcf7\Files\ScreenConnect.WindowsBackstageShell.exe_89 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0006_none_374ca698f508fa2b\lock!0e0000003597590e34050000340900000000000000000000 = 30303030303533342c30316464363333656262356366306566	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_0f2ae09cd417891a\LastRunVersion = 68747470733a2f2f7a6572656761636f6e7472616374696e672e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0006_none_af3936fe72eabcf7\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0006_7a8de616b6a1f29e\scre...exe_27fa83f1ad328157_001a.0006_none_af3936fe72 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0006_none_374ca698f508fa2b\lock!1c0000003597590e34050000340900000000000000000000 = 30303030303533342c30316464363333656262356366306566	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_27fa83f1ad328157_71148871d0798b53	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0006_none_7e4cad896dff4a7e\implication!scre..tion_27fa83f1ad328157_001a.0006_7a8 = 68747470733a2f2f7a6572656761636f6e7472616374696e672e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\OnlineAppQuotaUsageEstimate = "6368858"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_27fa83f1ad328157_71148871d0798b53	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0006_none_af3936fe72eabcf7\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18ac85d96\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3\scre...exe_27fa83f1ad328157_001a.0006_none_af3936fe72	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0006_none_af3936fe72eabcf7\Files\ScreenConnect.ClientService.exe_e781b1ee36 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3\PreparedForExecution = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0006_none_7e4cad896dff4a7e\lock!020000003597590e34050000340900000000000000000000 = 30303030303533342c30316464363333656262356366306566	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18ac85d96\lock!140000003597590e34050000340900000000000000000000 = 30303030303533342c30316464363333656262356366306566	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad3281 = 680074007400700073003a002f002f007a006500720065006700610063006f006e007400720061006300740069006e0067002e00730063007200650065006e0063006f006e006e006500630074002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006d0061006e00690066006500730074000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0458502f\implication!scre..tion_27fa83f1ad328157_001a.0006_7a8 = 68747470733a2f2f7a6572656761636f6e7472616374696e672e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_98937fbcddecdd38\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3\scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18a = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18ac85d96	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18ac85d96\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0006_none_3bc47e7a31570d5b\implication!scre..tion_27fa83f1ad328157_001a.0006_7a8 = 68747470733a2f2f7a6572656761636f6e7472616374696e672e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0006_none_374ca698f508fa2b\implication!scre..tion_27fa83f1ad328157_001a.0006_7a8 = 68747470733a2f2f7a6572656761636f6e7472616374696e672e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3\scre..core_420d02d3849b7992_001a.0006_none_374ca698f5	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_98937fbcddecdd38\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0458502f\DigestValue = d27de72fe7d69335597dd9f00df008c15dc3b03d	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_27fa83f1ad328157_001a.0006_none_af3936fe72eabcf7\DigestValue = 9ded8c10da99b137f272bade72e14fa78db6f52a	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18ac85d96\SizeOfStronglyNamedComponent = 4bdc020000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0458502f	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_27fa83f1ad328157_001a.0006_7a8de616b6a1f29e	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3\scre..core_420d02d3849b7992_001a.0006_none_374ca698f5 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3\identity = 68747470733a2f2f7a6572656761636f6e7472616374696e672e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18ac85d96\lock!060000003597590e34050000340900000000000000000000 = 30303030303533342c30316464363333656262356366306566	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad3281 = 32003000320036002f00310030002f00320033002000320032003a00330034003a00350036000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad3281 = 680074007400700073003a002f002f007a006500720065006700610063006f006e007400720061006300740069006e0067002e00730063007200650065006e0063006f006e006e006500630074002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320036002e0036002e0036002e0039003700340037002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003700660061003800330066003100610064003300320038003100350037002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320036002e0036002e0036002e0039003700340037002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003700660061003800330066003100610064003300320038003100350037002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e00330032000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0006_none_374ca698f508fa2b\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3\scre..ient_420d02d3849b7992_001a.0006_none_98937fbcdd = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0006_none_3bc47e7a31570d5b\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18ac85d96	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_27fa83f1ad328157_b8eec52c7628edb7	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_27fa83f1ad328157_b8eec52c7628edb7\LastRunVersion = 68747470733a2f2f7a6572656761636f6e7472616374696e672e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e362e362e393734372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_27fa83f1ad3281 = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323766613833663161643332383135372c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0006_none_374ca698f508fa2b\SizeOfStronglyNamedComponent = 736a150000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_98937fbcddecdd38\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3\scre..ient_420d02d3849b7992_001a.0006_none_98937fbcdd	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0458502f\SizeOfStronglyNamedComponent = 1fae090000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0006_none_3bc47e7a31570d5b\DigestMethod = 01	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\0J9AM9OK.H4E\X50Y3W2Y.D3T\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\scre..ient_420d02d3849b7992_001a.0006_none_98937fbcddecdd38\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3504	2026-10-22_bc9eb84078ac35573835054b256cb9f2_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	2744	dfsvc.exe
Token: SeDebugPrivilege	1332	ScreenConnect.WindowsClient.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1332	ScreenConnect.WindowsClient.exe
1332	ScreenConnect.WindowsClient.exe
1332	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 2744	3504	2026-10-22_bc9eb84078ac35573835054b256cb9f2_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	89
PID 2744 wrote to memory of 1332	2744	dfsvc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-10-22_bc9eb84078ac35573835054b256cb9f2_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_bc9eb84078ac35573835054b256cb9f2_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_27fa83f1ad328157_001a.0006_none_af3936fe72eabcf7.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\manifests\scre...exe_27fa83f1ad328157_001a.0006_none_af3936fe72eabcf7.cdf-ms
Size 32KB
SHA256 24901ac896e2f2494f7bc291640acae4895ead6130ae26e8c4578e7caf73e114
MD5 20d27fc5081dcc0569c01b7939334b9e
SHA1 e0fde79a7ee4b07cda6cb760dad14b9964d36aa1
SHA512 8cd5108266dc3fd089decacf2c037e26c316687f6e8959688201a55fb4a1e00ab4dd0b3d5f5f38156e6e964b74045730bc28b000e46eb50d1dce5b7adfbaf7d7
SSDEEP 384:QRqdGNmVFQPGyapEez/EeznljP2psgM7Yc6Ip1PguC1bS4VkTkM5jMV9tZyQn:QQdGNbfarPL10cjPmbS4VRt9tZyQn
TLSH
T1B0E2E505BB92E923D2521733ECD6C7E57235BDD24E96035B34413B2EAC707DA1A33689
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0006_none_374ca698f508fa2b.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\manifests\scre..core_420d02d3849b7992_001a.0006_none_374ca698f508fa2b.cdf-ms
Size 3KB
SHA256 3c42341ebad193e5c2c5debc3a73ec251bbd9c05913b3b6013cff235cefa8789
MD5 9e3601071863a80b0cd62cc4527872f0
SHA1 7383719b70ff967d48be933ca3b667a34850efc5
SHA512 3752e649f54a6a11e3840dc77096659c81ed1ec7b7cbdefbe11f84184a25222d6786c590dc3864e29211148376b5ee63ad48f3183c63454fbc88ac845a68ef3d
TLSH
T106617402B284DE17D9A90633ACD6D2EE37757E83DF82430B74C4BB2F7A322E55612191
MD5 SHA1 SHA512 TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0006_none_374ca698f508fa2b.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\manifests\scre..core_420d02d3849b7992_001a.0006_none_374ca698f508fa2b.manifest
Size 1KB
SHA256 4d9eb3c7da5331ada700e4ccbbb695b70b1e5fc7690a70a51d100e1bba113914
MD5 613c9f2812c951da1f1ab3fc968b9dcb
SHA1 9fdd9fcdd8e26c6f6fbfd1fe29921e62953e69cc
SHA512 4d88c52e613cd04779a768e9c4d59b753940ed3d916171d233a271a36357b918279aa2ec0a153320a695eb79967afb1fe1ba73ca4505786d07402e066a719cc9
TLSH
T15C21370181C8FA261F3302D2BEE7E42197AE5B3318CD194B74A9699FCB2DAD64747173
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0006_none_3bc47e7a31570d5b.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\manifests\scre..dows_420d02d3849b7992_001a.0006_none_3bc47e7a31570d5b.cdf-ms
Size 5KB
SHA256 5bc36a622b7007b15537de19ef537051115b7004cde3bcbfd5cd5b7485a30de5
MD5 ec2df7081255bc2fee1e661c45ee3457
SHA1 53df4cdc9f69bdde30337b43f862c54e38e30668
SHA512 d23a0d90015440416f94ad2fd8c253efa6e3c4829f5aa8d15312fd476f89349ee60b2201141bfed6798ad540bed4561708e9d6a094813a09a947033ea04c01dd
SSDEEP 96:EPA+RxlrNheV+Ww7OLNXIy+X0YJ4h61l2gMgiqPu:gRxlrEJfN4ymlKBr
TLSH
T118B15111B694DE17D5690233ACA6C2ED2B36BE82DE42470B71C4FF1F7A326E60222095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0006_none_3bc47e7a31570d5b.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\manifests\scre..dows_420d02d3849b7992_001a.0006_none_3bc47e7a31570d5b.manifest
Size 1KB
SHA256 e23a52248507cfef209906c06b522a9d6ca9e6762750efd03dc6fda37dd3ddbb
MD5 2d52aba918ebe58e297b40e17694ebbd
SHA1 2d4bfafa63ac1bca6b46c24b4aedf8abaebd6391
SHA512 3179a5e0e951dfb7e17b1258445cefb70000ca15bb439b3398d2b37c98f147c7039e67fa16633add8af32b21c87e11169024eadbc9ca9c9d897c60f6327fedd9
TLSH
T10341D11181C8FA250F3302C2BEEBE431979E5723198E194B7499AD9BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_98937fbcddecdd38.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\manifests\scre..ient_420d02d3849b7992_001a.0006_none_98937fbcddecdd38.cdf-ms
Size 7KB
SHA256 0d219230f30c8ac0e74aced483d2988eafa2a1c25b18b11d716acdc0d7002eff
MD5 636b5093240318ea1129656204fdac70
SHA1 cd9e193289a603adf615ea735d5ec6a1617d9d6c
SHA512 60073e6d6edb900fcea9dbd538c415a70eed93fc9e91fac1a829210e7b4a2bb1627058e21c9d7ac01d8ac6851df7e7ecdc8b32654cf9dc98d9dbff28a512e147
SSDEEP 96:QOOpMnebEP4sVFeV+WwwOLNv863Or2WZvgnR6v+ma2+hRSm6quq41:BdnezsVaJ4NP3ln9mL5
TLSH
T12BF13102B290ED16D5A90A33ACD6C3ED36367E92DE43070B70C4BF2FBA726D61212095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_98937fbcddecdd38.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\manifests\scre..ient_420d02d3849b7992_001a.0006_none_98937fbcddecdd38.manifest
Size 2KB
SHA256 84b6196856da07fd13c045108ec8dd08ae23f3127511d079001126936c98bba9
MD5 274ebe7a7b02554f10c69d232fe856cd
SHA1 a3c3aa4dbe597b38d240a5894401041a968dfb43
SHA512 8c62b7ceadedbe871cbe129667ec2e6ceb2c1db5c846f4351511aace5650a50448055f84144d7367017446eaaf0d720605cda6c6c4ce4324e41f2fa322a306d2
TLSH
T17C51061151C4FA310F3302C2BEEBE0709B9E4B22158E194B7099A99FCF2DA97478B067
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0458502f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\manifests\scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0458502f.cdf-ms
Size 2KB
SHA256 ed5a1a65bd3ab72ddbc75fd6eae7fb4753dbb01feaf14fc36d47d223f859c9b0
MD5 89d33ec5f9fb4c9648824c2df50d273e
SHA1 1eeb5930fc9c69e85651283c19ada4d3ea56ecc1
SHA512 f2c455dae4fb6dc27b3db5ccb48951f47449b3c9c04348fef02d7c7bf72f886329ff41b313896715bb701d18308064a5771a917de1366708a5f34fe21b0f0da8
TLSH
T1C151A9153684EA67D67A0233EC96D2DD33757E82EF47030BB190BB6F7A726C54A12092
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0458502f.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\manifests\scre..ient_420d02d3849b7992_001a.0006_none_cd62046b0458502f.manifest
Size 1KB
SHA256 0ad1e1eab6457792bb0aec39da5aca0e494233551fb97f524ce207207ff33c72
MD5 f2fb2467ad54050085fc9e21dee62187
SHA1 32ace3dce0084864c048acec3373c9d555839aec
SHA512 d614a35a3c42145ea9109dff2026a3b7bfb9f81463a5a02c97c259798096444203ec610504cfc12467f15d2628b971f5a49ef968dd46aa2c890c0769791efea9
TLSH
T1FF117B0191C4FA361F3341D2BEE7E420676D5B3308CE194BB069686F8B29AD743471B3
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_27fa83f1ad328157_001a.0006_none_7e4cad896dff4a7e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\manifests\scre..tion_27fa83f1ad328157_001a.0006_none_7e4cad896dff4a7e.cdf-ms
Size 22KB
SHA256 36f16c33f6898fbad3e6359806a0e596ae6976976086c9cd857e88555a024471
MD5 c3c0f327a68342f1aa1737aa93c4412c
SHA1 d773a7eae239510b71b463f1f86afda25d9590d7
SHA512 2632eaf164b31f6ca89c7f935f2914361d65dffa716aacdfd5cceda8a6111f931f09f9579ecb0fdff7359aaba7ede389460fb0a782bb14a08197ef5eb17a82b9
SSDEEP 384:KeCP917aJgZ0tPEezIjjKEeznljP2psgM7Y6Y7ME3EthP67wTkaOs1sL3uMbX:1C1daJgPwPL10jx3Et167wTkf6sL3ZX
TLSH
T1BBA25A853B51E916C112A232DDC7CBE53536BEC74ED2976F38413B1E9E38B886A219C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18ac85d96.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\manifests\scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18ac85d96.cdf-ms
Size 4KB
SHA256 6e100b7cf6c2d993e48a7d69356b0ea932f0070879f6ca27e84daebf0cf33a5a
MD5 d6c6bf72b817e745892dfab4b68e0f20
SHA1 e344ec5631f8c0abaceba1c059c4324402f91819
SHA512 ee712d95318a2f961e8ee71d5276ecc828bd6b1d3b094e1c838481138364d10d2743ba155fd40457eac80fc7ea1283901b44a18e86598b36d039e069f4d2b631
SSDEEP 96:tQ4nO/1eV+Ww8OLNv4c1sil6DXz7DKu4uiV:EKJoNh1ss6P6NV
TLSH
T11AA17B117380EE6BE5A90633AC96C2DD2A797D82DE43430B71C47F2F76726E64336096
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18ac85d96.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\manifests\scre..vice_420d02d3849b7992_001a.0006_none_e8a03ee18ac85d96.manifest
Size 1KB
SHA256 0c8790e55c350ef3f39207cf925eeb4fca34472faf118ee1aa8da7be64475098
MD5 6e7cec7ced217b947f28d8b114a1c06b
SHA1 82add771cd844cef34a9895d7daa5254deff45b3
SHA512 b2cd4f569158bc723f638debb944dca7387922a3993e45d66a05c7c72c626ca391a9ddee242ef082e68ead7831e0ca3ada58ef1d87a1589d66431845d88186b0
TLSH
T17E31F61195C4FA351F3302C2BEE7E4705B9D5B2215CE194BB059695FCF29A97434B073
MD5 SHA1 SHA512 TLSH

Submit Download

5okpnd00.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3\5okpnd00.newcfg
Size 683B
SHA256 bfc99ba6c74f8428dbfaff056f836ef70a24cdd5444e4fa03d6b5878c8dbe0a0
MD5 36f7a86d7f29e2d83f3a5e5efea38f92
SHA1 39e7d423f6c2917c57ab80af5eea1d4b5302e8bf
SHA512 241c6b9ba8c0bfb25509e68a23fd313b8ef1beaef0b8eb5cee6c0962ed716e11b8b6cf7463dd375e10c791ca70fc80429c67285b0cfbfa2db0b26b6241c48d66
TLSH
T1E601446572C0AE9A02A36A33D9224341FE711A5B026220D874AE223B5F305CB03E32CA
MD5 SHA1 SHA512 TLSH

Submit Download

csw5tvxm.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3\csw5tvxm.newcfg
Size 884B
SHA256 f579b04bbfd2ba6f0f61a877c99b7d6aa069e47bd967177cee6a16482ab3f77a
MD5 1f17e3b4b20813a4a9c9597e19c26a2b
SHA1 84479d6a8a1fd0f93045bc8b7304ee5bb4feb76b
SHA512 44e36fa107b2e40eea69a5797c33e7594c391748ff28354cebd58f5493703c81065cf392f5a68edd76c7977982f2fe9940f6f6f840f739596bef8652e1fed52e
TLSH
T1F811896872C09D9A02B76A32E5214385FE711A5B116560D834EE613B4F309DB03E36EB
MD5 SHA1 SHA512 TLSH

Submit Download

o0ac00p1.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3\o0ac00p1.newcfg
Size 884B
SHA256 9a093585a1ba241203bd1b5c2be0d8135b2ae5ee37ba92898765693f6d2355ac
MD5 b2f1814da86aa2490dd8f3984a361560
SHA1 9a50361afd06139c7f1304aeb66dc42ab7b56046
SHA512 14667acb35f776bccc0002faa19f2470387658ed42c8a2432fb87e2af7d069830250a2780a392d119aaf636ebb453f4ebe9225db37901bd05b67a9ce6e52cbdc
TLSH
T1CA11BD6872C09D9A03B76A33E5224385FE711A5B127960D834EE613B4F309DB03E36DB
MD5 SHA1 SHA512 TLSH

Submit Download

oxzulm0m.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3\oxzulm0m.newcfg
Size 884B
SHA256 fab77409e321c209a868bc94b37f708feac067b38d64d0ede5cdf5ea6ac29426
MD5 2c21323464cd2ac4ad3cd35d048e0d0b
SHA1 62a0f3442046fc3a444543faf9484658f9e34fc1
SHA512 23e717f7ac18586073e82a78847e6587930146dc38beeba0073028e131851923004cb08ee7886cbfed7f3f6d6e811a9eb8d4335b6a6ac7b305fcdc787d9b960c
TLSH
T15911896872C09D9A02B76A32E5214385FE721A5B116520D834EE61374F309DB03E36DB
MD5 SHA1 SHA512 TLSH

Submit Download

qivvugf0.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3\qivvugf0.newcfg
Size 884B
SHA256 72cbfc9fe8bca780d0be89af56b95f451c0aceb32b2548b594aca86155d56299
MD5 65c66f64c55a9e90f2dbc03ed189374e
SHA1 847bd6a261f10185b58f3905026aac1b09a77571
SHA512 2a3317ae381faf9919bbb1eb52467284eadf4d48f5aa9f26862a4a08074cec72576a09b5c24f5e07145038a4fe75afddb84389b6acb78ce5d7fbb401aa9f066d
TLSH
T15E11BD6872C09D9A03B76A33E5214385FE711A5B117520D834EE21375F309DB03E36DB
MD5 SHA1 SHA512 TLSH

Submit Download

rwxnjmju.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3\rwxnjmju.newcfg
Size 884B
SHA256 3684008a84412c3f7830b51648f7781478326d471746a11e22cf1722643ca249
MD5 040dea26aefe8c6e66f34a5300dbc100
SHA1 5d21d53975134a34771a8626386245127403b439
SHA512 64af598f71e041e63392765508dab788d5602ffb1512b1845a1d2770987204cd92eecef68f53c9aaa970f9d63902610c617644c1bec37899d4fcf1b2e86688b2
TLSH
T11E11BD6872C09D9A03B76A33E5225385FE711A5B117520D834EE21374F309DB03E36DB
MD5 SHA1 SHA512 TLSH

Submit Download

sjbm4uva.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3\sjbm4uva.newcfg
Size 884B
SHA256 f0999dffd45260b7e4b4372819894f1955cf6173541a01f447d92a4109cadecc
MD5 9ab67eab45c0f7543d0288c7489f47f8
SHA1 e5621ac1f93bc84aa1da93e0b4159a8deb5f6080
SHA512 dcd2c61be6f685788179dad74b8dd6f8536bc049d182c4e018eb52ab8cd6594071d37d7594e7d7fb41ad34daf4e0a082a71a4702bd4eb3066ccee3d6b2b560ee
TLSH
T17C11BD6872C09D9A03B76A33E5214385FE711A5B127960D834EE613B4F309DB03E36DB
MD5 SHA1 SHA512 TLSH

Submit Download

tzwcahkn.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3\tzwcahkn.newcfg
Size 884B
SHA256 eb2e5e333b50e959f26657699301d866e155fedbae1dc361497cecb6317854a7
MD5 ed4298e7085ff5021972335d35dbff56
SHA1 2dc4fa98f955028d134fe45123a71cc1ff822948
SHA512 f948fc47b4c11f961915bc2aaaa47b40e53b19e1f05e1db0eee2263b68acd290e8128c68b2d301e1c265291e023de151220fc9446945f6f99a030bf472a448dc
TLSH
T16311BD6872C09D9A03B76A33E5214385FE711A5B117560D834EE21374F309DB03E36DB
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3\user.config
Size 520B
SHA256 91f186fdd785e76caf740d0b21fb3f3761c30146c16487ea61ea1e7c5d7ef60f
MD5 a621b70239b0a7821228624746c61e56
SHA1 a4525c654211cb223372ee9b681cf15e4aa6dd81
SHA512 eb9c5eff3cb0e038a4265f70c4ba930eec5b695bb435a195c8836731375a9ced7214401608da528e44119be5623c9587bad96ab9a9c45b9121d317cb901291fd
TLSH
T1A3F0E9A131806D5B07636E33C5124741FE725B9B0552209874AF623B5F315CE03A31CE
MD5 SHA1 SHA512 TLSH

Submit Download

uw1fr25r.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3\uw1fr25r.newcfg
Size 884B
SHA256 39a9d61fa887ebd8b80dab903607d1e2fd613e1fedd4a28773a38e6a49d2ea60
MD5 2e9b82546c57fddeeacb6bf0babb0dac
SHA1 e3883348a31aa83d6327578cf89657c3b6b94e7d
SHA512 ca5ffda5ad5fc86d9966fd8f2391bcabc7c220f6fee48630f5bb47a6f71fd134e8b47465f131616fa6f69606a2027c5e68ae803f9a9aff6edcd4b3c26f7e5577
TLSH
T1C9118968B2C09D9A02B72A33E5214385FE711A5B11A660D834EE21374F309DB03E36DB
MD5 SHA1 SHA512 TLSH

Submit Download

vhsxbfne.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4Q3R3JMP.YY0\E9LZBMAB.5P3\scre..tion_27fa83f1ad328157_001a.0006_08aaaca56c1209e3\vhsxbfne.newcfg
Size 884B
SHA256 5badc2182608e1be5ff426d7270993fdc8ecab386a520f32861b6a254f627084
MD5 5c56e14e14f0e8f2d82bb8d31d823e1c
SHA1 87b3970ff2c11788533f36ee7107f2b48c5b3ca5
SHA512 b98c1adb6640935253f95e6ed1b8683702a0180956e2563fe6c239f16ee8371e0bea351f1d16d2378049099455f5d9b217facac1bf0b000f27d3b5e311acac23
TLSH
T15D11BD68B2C09D9A03B76A33E5214385FE711A5B117920D834EE21375F309DB03E36DB
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0J9AM9OK.H4E\X50Y3W2Y.D3T\ScreenConnect.Client.dll
Size 615KB
SHA256 787a02b1938e8c1ce52448b8779d2c9c47029664f97185177c2584e8f980abc4
MD5 149a7707446fdcf50836db69b917d602
SHA1 d27de72fe7d69335597dd9f00df008c15dc3b03d
SHA512 b768682ca47a070028a0abec11b401830ee97ec978fe6cb69544930d91f109fb615c05dbadc5e1bb0789ca2363d77189f84a08f186d8374b94d18d995962dfb8
SSDEEP 12288:UkkXZravRRa5nmDPzHTEavSW7OQniuHJ2eh:0XrQDbzEn8quHZh
TLSH
T136D4D14DB7919A1DED1E0B33E6902350EBB16CCA9883E32F2C68767D1E723C5658D1D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0J9AM9OK.H4E\X50Y3W2Y.D3T\ScreenConnect.ClientService.dll
Size 176KB
SHA256 579fa008b8c96612163fd8a89a978140a652b3739867772df0711fca148705aa
MD5 7eeb9a886eea2fc5550942f0dc0aacb8
SHA1 a9449ca9a4982be5ab5010f181328d13d00c0215
SHA512 0406959756206affcde7e44b689e6ff0278330d7ae90433c32a17f05f778625e37b0908e56e25b47ba0a08cb338918affea298c9a53cfb765811a658076006d7
SSDEEP 3072:QRqGKbTNcBswQmqPYGi0raTb7pD/leN6Qa2ICpy4QOVD6W0XtZR8H:QRNKbBgtcY6raTb7FNQawf6W0u
TLSH
T1C404AE497B99D526D49E0E32B851B3204FF1B0A2C9E6C78F6D9832EB1E167C16F442CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0J9AM9OK.H4E\X50Y3W2Y.D3T\ScreenConnect.ClientService.exe
Size 93KB
SHA256 d887f20ec383d7ce3a5727856bf7fa68ceb972108b6d0a5dd9924707e820dc24
MD5 794a92f5abba00c91b2b0c6e55bd1ec4
SHA1 dc253d76c2349971fdf1f5fc8ef5af25a621c5ff
SHA512 55223912e1dfe85af33a1d1d28fa0dcc93495324d4834b0416b836f7241c18296a9f55791d9794d909cdd845bfc863f10b89b55a095cb26698f234f62398e656
SSDEEP 1536:Jg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoU0HMC7N0:qhbNDxZGXfdHrX7rAc6myJkgoU0Hjx0
TLSH
T1DD935B13B5C28872D573093158A0DAB09A7FF9615E61DEEB3788022E4F341C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0J9AM9OK.H4E\X50Y3W2Y.D3T\ScreenConnect.Core.dll
Size 1.3MB
SHA256 5b2d14e237485c0164d865d8a94f8a8bed28ab0db52c6a7ef99f7ebb9648d324
MD5 ec05dfb0dceee252de12c22b68ebbfa5
SHA1 720000e4bd6fb9dd64c55da607c2a5cebb052c7d
SHA512 236cfecc032c3bf8aaa9804b817f901b0d79decc516e6df5b749dd65c2e8945bbd346957f16f68b642932d68ec4f3daea55e2b3ce2f9581604788a8b6f8a1fc0
SSDEEP 24576:kpIxpRkVYVdqvM2Dj5AmhstUJQf72OmswiC6EHspN6TSZsyPX3UO:EIxpW9j5bhUp2sEH4HPnUO
TLSH
T126558E4ABFC6AB17CD7D0633586163005BB0D0909AA7D75F39B8A73D5D863C82E881ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0J9AM9OK.H4E\X50Y3W2Y.D3T\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 88dd22f6f0ca70d10c64ca919b0d8b6d73e84c1d567d4b8d15b6e9a9b60d6d8f
MD5 5a583d792741dc86740248508bca1f48
SHA1 85ff8c972fad01e29044f014e680a30658e83acc
SHA512 a4ff0c9bb808ac1dd8f26f77bc60fcc01e8a1bd474628f3dd6563f048fb159fdf0e6e61c6a4a46de9573cf1f4134cc1b723c265950cf39b67202ae59bc86e86a
SSDEEP 24576:v5wRfUFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKPTsz:vsUJkGYYZTk+T1iH7efPDpB
TLSH
T1F995AE45F6C365F6D42F047888BE632AB6743C040315CAFB97D4AA3A6D33BC09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0J9AM9OK.H4E\X50Y3W2Y.D3T\ScreenConnect.WindowsBackstageShell.exe
Size 123KB
SHA256 8f096174b0ded0a598f634567c618e12808088848cd07eb99ca4ac57a744cdd9
MD5 18bc89e0906835cc6a00e5436b8dd3c3
SHA1 71acfc99d1196eada6b1d0055047f10add1fe9b5
SHA512 e6926cf657f7950e4c6cdb4a1d49d1a7d5b560aa56ada9e3a0ab23fea249e462f16642d6b502f66b7b0dbcec7da8a0ce17a60d0c27afa1f3a6ec9191c81638fa
SSDEEP 3072:pi5eyX76RBZaVS2TzDy9IKD9kbX99Q+rBaSo4:M/eRBZaVS2TzO9IKD9M9tL
TLSH
T109C3AE447B8DD115DAAF1D36B8A2B3201BF2709E8AD7D74B2C94367DAE123D00F992C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0J9AM9OK.H4E\X50Y3W2Y.D3T\ScreenConnect.WindowsClient.exe
Size 1.6MB
SHA256 b7a495f517b9bf23f529552b145121f922ab4915e24b663ae68b3007daea3804
MD5 8ede304ea46425445ac71373dd27a697
SHA1 7c19981dd00acacfda38c49123ff8df529621a4b
SHA512 c55c93c756842556cb92fecba56093a34e4a4beb751249f5a8ff51dd881199b6cfdee453ab1a4b5ed7957a771f8e2db231abd6a742837c18bf98b847b42dd833
SSDEEP 24576:0ISZPKTScCKnyILsHjXDIaP6Zy7q2GxeKDWUbdasVO7WoIG1WNi5JksNdHRU/Dqs:0ImPfcCKyIuvhG0mzO7ZcD85AoY
TLSH
T10B75BF497ED5FE56D9AF0B3B94612200BBF0C8958B23CB4B2894B77E0E853C45D496CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0J9AM9OK.H4E\X50Y3W2Y.D3T\ScreenConnect.WindowsClient.exe.manifest
Size 25KB
SHA256 cbc0bd5b4465a759e7a525eef9804ad6607eb568683cb0e2fec06355e2a622bd
MD5 921941f1592f67e16bbcf68816cdf90d
SHA1 9ded8c10da99b137f272bade72e14fa78db6f52a
SHA512 abaaf1c60c6760d0f28fb4dac97e36e55aecf027cba4d8377e0890f88e4ff2ccf3f666f3f8a71b46a8f9f7a4c5148e35c10c9eabd7be33098fe9ada67906b151
SSDEEP 384:bWie3UGUSUiUGU4GiaqZfazEezPUEezuEeznljP2psHM7YR6Ip1PguC1bS4VkTk5:bWiILBt5raZVPLs0RjPmbS4VR5
TLSH
T158C25B5A8CC17D21033291A0FFE38A14FE443B6345FD009A7D4D15AF9F95A4A67A32EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0J9AM9OK.H4E\X50Y3W2Y.D3T\ScreenConnect.WindowsFileManager.exe
Size 108KB
SHA256 74b0f8719c6b45206a6d790a0b6e5ecb2df66f2a9a97e5b75f883ea4d7653d64
MD5 91a19e82443b5d302373edf5e5380a14
SHA1 6a50c2736ebe3d8611dc204bae7fc774b164d33a
SHA512 d524309696e57a1154753d1f83964d53e4bb0e57b72aae3d0b5cebccf6b4af183d8c50e31d85c1bd3b1db2e6271a70e80ca4da87c7344e970cc976bfb74f4a1f
SSDEEP 1536:77HN1iOSVfVI2HtwI5BLP+VVVVVVVVVVVVVVVVVVVVVVVVVSg2i7c:jS9LwuBLNHiw
TLSH
T10BB33951352A6135DF85C433A052E9B099377F6217FDC6BE2CA1BE3628E03943E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0J9AM9OK.H4E\X50Y3W2Y.D3T\ScreenConnect.WindowsFileManager.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

NB05H83B.XNA.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Z1BGQ8GV.80D\NB05H83B.XNA.application
Size 114KB
SHA256 ffde2b8158bf70a8a915e34e89624413915d0defb45fdfd3477cbf9e09194fb0
MD5 21778c03bfd703f7f997a084a0a38870
SHA1 184f7122d2bd6cf01d2e3d9631f14f36e8b0d637
SHA512 63dc824e4dfc524b88f736637903947af83d257f89f24271036529bbb12bb03ca7aaa50cda422133e74e9192b82773927ba78a9eb5db2ac855f93eaa84a7994d
SSDEEP 1536:ATe4vExrWsLK+zuLD4UABnjRnfduUW5Ab4KpSE5GP/uLTvooycupKQ/IuKE:M8xrWsnuuBn1nfdvg2XOcupX1
TLSH
T1DCB3A73ACE30F4C0477DB021D1A52D673D811B93DB731BACD90A186B0E69796EF5A68C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1332-312-0x00000000007C0000-0x0000000000956000-memory.dmp

Download

memory/1332-476-0x000000001CE70000-0x000000001D03A000-memory.dmp

Download

memory/1332-460-0x000000001CE70000-0x000000001D03A000-memory.dmp

Download

memory/1332-458-0x000000001CE70000-0x000000001D03A000-memory.dmp

Download

memory/1332-456-0x000000001CE70000-0x000000001D03A000-memory.dmp

Download

memory/1332-442-0x000000001CE70000-0x000000001D03A000-memory.dmp

Download

memory/1332-440-0x000000001CE70000-0x000000001D03A000-memory.dmp

Download

memory/1332-424-0x000000001CE70000-0x000000001D03A000-memory.dmp

Download

memory/1332-408-0x000000001CE70000-0x000000001D03A000-memory.dmp

Download

memory/1332-378-0x000000001CE70000-0x000000001D03A000-memory.dmp

Download

memory/2744-25-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp

Download

memory/2744-16-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp

Download

memory/2744-24-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp

Download

memory/2744-23-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp

Download

memory/2744-22-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp

Download

memory/2744-21-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp

Download

memory/2744-58-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp

Download

memory/2744-19-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp

Download

memory/2744-18-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp

Download

memory/2744-17-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp

Download

memory/2744-234-0x000001B9F0A90000-0x000001B9F0C5A000-memory.dmp

Download

memory/2744-50-0x000001B9F0A90000-0x000001B9F0C5A000-memory.dmp

Download

memory/2744-15-0x000001B9EFBD0000-0x000001B9EFD58000-memory.dmp

Download

memory/2744-13-0x00007FF9B4BAF000-0x00007FF9B4BB0000-memory.dmp

Download

memory/2744-14-0x000001B9ED510000-0x000001B9ED518000-memory.dmp

Download

memory/2744-69-0x000001B9F4BC0000-0x000001B9F4D56000-memory.dmp

Download

memory/2744-28-0x000001B9EFDB0000-0x000001B9EFE00000-memory.dmp

Download

memory/2744-52-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp

Download

memory/2744-75-0x000001B9F4920000-0x000001B9F49BE000-memory.dmp

Download

memory/2744-63-0x000001B9F4B40000-0x000001B9F4C9A000-memory.dmp

Download

memory/2744-51-0x00007FF9B4A20000-0x00007FF9B53C4000-memory.dmp

Download

memory/2744-81-0x000001B9F4C40000-0x000001B9F4E20000-memory.dmp

Download

memory/2744-87-0x000001B9F47A0000-0x000001B9F47D0000-memory.dmp

Download

memory/3504-9-0x0000000074580000-0x0000000074D3C000-memory.dmp

Download

memory/3504-5-0x0000000005590000-0x00000000055F8000-memory.dmp

Download

memory/3504-0-0x0000000074592000-0x0000000074593000-memory.dmp

Download

memory/3504-4-0x0000000005680000-0x00000000057DA000-memory.dmp

Download

memory/3504-7-0x0000000005DA0000-0x000000000635A000-memory.dmp

Download

memory/3504-2-0x0000000002F90000-0x0000000002F9C000-memory.dmp

Download

memory/3504-8-0x0000000005880000-0x0000000005912000-memory.dmp

Download

memory/3504-6-0x0000000074580000-0x0000000074D3C000-memory.dmp

Download

memory/3504-3-0x0000000074580000-0x0000000074D3C000-memory.dmp

Download

memory/3504-10-0x0000000005AB0000-0x0000000005C90000-memory.dmp

Download

memory/3504-11-0x0000000074592000-0x0000000074593000-memory.dmp

Download

memory/3504-12-0x0000000074580000-0x0000000074D3C000-memory.dmp

Download

memory/3504-1-0x0000000002F70000-0x0000000002F78000-memory.dmp

Download

memory/3504-20-0x0000000074580000-0x0000000074D3C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads