3bfb7d791369e27c3b07a4bae9ae7b7a95168a78f141f0388e94ec79ea034bad

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-11_1de29e1b40e18031f34062bbb027a837_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Size 3.7MB
Sample261113-tp87psdv5w
SHA256 3bfb7d791369e27c3b07a4bae9ae7b7a95168a78f141f0388e94ec79ea034bad
MD5 1de29e1b40e18031f34062bbb027a837
SHA1 0d4d7614188389d6785f078841ecf764bcdace70
SHA512 a3ff935b263bfe4d4bbc94f13cdd9ad03ab3dafe733abe472aa99eba76047d8edbc39a2aac6d005bc0d619a4c97cba52eb95f20c49b77fc32382c0d6ab3d2937
SSDEEP 49152:mnxXHul7f31zTeQ2JuXJkGYYZTk+T1iH7efPjrCotzDAuC:4e7fFngu4M6efPjXe
TLSH
T13306BF4AFBC6A677D83E063684662314A3B4F4454B56C7AB6AD0BB3D1C323D06E253CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 7 IoCs

flow	pid	Process
10	3396	dfsvc.exe
10	3396	dfsvc.exe
10	3396	dfsvc.exe
10	3396	dfsvc.exe
10	3396	dfsvc.exe
10	3396	dfsvc.exe
10	3396	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
2288	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\A9QC0ZA2.B6L\ZRC3KRBD.JCW\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-11_1de29e1b40e18031f34062bbb027a837_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-11_1de29e1b40e18031f34062bbb027a837_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.WindowsClient.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-11_1de29e1b40e18031f34062bbb027a837_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\Files\ScreenConnect.WindowsBackstageShell.exe_8 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_0000000000000 = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d002200680074007400700073003a002f002f006d0069006e007500740065006d0061006e00680065006c0070002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320036002e0037002e0036002e0039003700380033002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320036002e0037002e0036002e0039003700380033002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0030003000300030003000300030003000300030003000300030003000300030002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e00530065007400200063006c006100730073003d002200530079007300740065006d002e00530065006300750072006900740079002e005000650072006d0069007300730069006f006e0053006500740022000d000a00760065007200730069006f006e003d002200310022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d00220028006800740074007000730029003a002f002f006d0069006e007500740065006d0061006e00680065006c0070005c002e0063006f006d002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300030003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\Files\ScreenConnect.WindowsFileManager.exe_0e21 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0007_none_0a65ab3dbb4427e4\lock!020000000a7f590ef00800005c080000000000000000000 = 30303030303866302c30316464373338613336633263346366	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d\implication!scre..tion_0000000000000000_001a.0007_20 = 68747470733a2f2f6d696e7574656d616e68656c702e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e372e362e393738332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02\lock!0a0000000a7f590ef00800005c080000000000000000000 = 30303030303866302c30316464373338613336633263346366	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\scre..ient_420d02d3849b7992_001a.0007_none_cd6203d30	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\lock!06000000167d590e440d000030080000000000000000000 = 30303030306434342c30316464373338613330306638356636	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "0P2NY15MLMVJP1YX16PX95EX"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e372e362e393738332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\SizeOfStronglyNamedComponent = 09bf050000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\Files\ScreenConnect.WindowsBackstageShell.exe.c = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02\lock!18000000197f590ef00800005c080000000000000000000 = 30303030303866302c30316464373338613336633263346366	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\scre..core_420d02d3849b7992_001a.0007_none_374ca600f	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6\lock!080000000a7f590ef00800005c080000000000000000000 = 30303030303866302c30316464373338613336633263346366	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6\lock!16000000197f590ef00800005c080000000000000000000 = 30303030303866302c30316464373338613336633263346366	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d\lock!14000000197f590ef00800005c080000000000000000000 = 30303030303866302c30316464373338613336633263346366	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_3da05c4de3687b7b\LastRunVersion = 68747470733a2f2f6d696e7574656d616e68656c702e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e372e362e393738332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e372e362e393738332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 54007200750065000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_20de1e6ba74b6119\scre...exe_0000000000000000_001a.0007_none_5cdffd35b	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d\SizeOfStronglyNamedComponent = 4b1c030000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_0000000000000 = 0000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_none_0a65ab3dbb4427e4\SizeOfStronglyNamedComponent = 1c0e020000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_f4da863c93273aba	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02\Files\ScreenConnect.Windows.dll_fc0d83aff7df0b5 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\scre..core_420d02d3849b7992_001a.0007_none_374ca600f = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\Files\ScreenConnect.WindowsFileManager.exe.conf = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\scre..ient_420d02d3849b7992_001a.0007_none_98937f24d	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02\lock!0c000000167d590e440d000030080000000000000000000 = 30303030306434342c30316464373338613330306638356636	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2\lock!1c000000197f590ef00800005c080000000000000000000 = 30303030303866302c30316464373338613336633263346366	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_20de1e6ba74b6119\scre...exe_0000000000000000_001a.0007_none_5cdffd35b = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf\Files\ScreenConnect.WindowsClient.exe_6492277df = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\lock!12000000197f590ef00800005c080000000000000000000 = 30303030303866302c30316464373338613336633263346366	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\lock!1d000000387f590ef00800005c0800000000000000000000cbf8 = 30303030303866302c30316464373338613336633263346366	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_0000000000000000_3da05c4de3687b7b	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0007_f4da863c93273aba	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32362e372e362e393738332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0007_none_0a65ab3dbb4427e4	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\scre..ient_420d02d3849b7992_001a.0007_none_98937f24d = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02	ScreenConnect.WindowsClient.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\A9QC0ZA2.B6L\ZRC3KRBD.JCW\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2104	2026-11-11_1de29e1b40e18031f34062bbb027a837_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
Token: SeDebugPrivilege	3396	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 3396	2104	2026-11-11_1de29e1b40e18031f34062bbb027a837_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe	89
PID 3396 wrote to memory of 2288	3396	dfsvc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-11-11_1de29e1b40e18031f34062bbb027a837_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-11_1de29e1b40e18031f34062bbb027a837_amadey_elex_glassworm_hellokitty_icedid_ransomhub_remcos_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Modifies registry class
    PID:2288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\manifests\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7.cdf-ms
Size 14KB
SHA256 be9678a0ff38010a2d9c120b85930c3b11c056fcbbed0c151bca31b15be80132
MD5 e5551b6fa7dabe60c300729cb7de676b
SHA1 c82aed8b176424a4aa227668f2fb88c5a78ee6f8
SHA512 0ca3fc66376af2c32755373de60d0b50fb3f364de1150c90fa6b0f9e25dcb7c88003549389588f4110a3cc44e62522f3cbc7436c528ab6d69506c929c7f5d91d
SSDEEP 192:xrEwHfSL+b/Zgbrp9VPP8bYfp5t2g/JuYNqOWbJx8TytIGr94:x/I+ip9VMKSIGr94
TLSH
T19D62B511FB14F133E2A24B32ACBAE3D567257EBA1DA51147B084373D987118A8F323D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\manifests\scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2.cdf-ms
Size 3KB
SHA256 cc5de2659fb34b57fe34d9b9c5559e1e124af16faeb60fdd43e4bb135941f430
MD5 dc97b206d8da80233c029dc136a611ed
SHA1 b231a5e302579c66a6e555b94086ee6c9c068947
SHA512 22793b2e2ae0ab6f604b28db42f47bea346bdb72afa150ef9317aa85caebdb915ae737df9845950c9de64e777af5fe6a87c096b39f2ca6129dc96a4d96a82e59
TLSH
T1C8612E027744DA13EA790332ACF2D2DE6FB83E83CE81810FB4C03B5F79364A556112A4
MD5 SHA1 SHA512 TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\manifests\scre..core_420d02d3849b7992_001a.0007_none_374ca600f509fbd2.manifest
Size 1KB
SHA256 ede66ce32d594547cde8019666ac28a765f0794ea6702374e7a54e1cb6405371
MD5 deee761ec1bb0649fe7030b219a8c6db
SHA1 8729fc42a89f5e8fde6e7bf58a5c14fb8f075db9
SHA512 82fe38b4473cfda697e4333b58dd086e30568cc430a28741a1ed56d574b0c1841200d4ff2bb2ab13adfea519ce9670e5b53d934e078ba02fa25fbd59fbd7fd67
TLSH
T10D21370181C8FA261F3302D2BEE7E42197AE5B33188D194B74A9699FCB2DAD64747173
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\manifests\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02.cdf-ms
Size 5KB
SHA256 c78683a921d86e4c4ca63455e332c3ba2700e2a0e210e2b0da19c8a3a0836a83
MD5 a6a1a3ecceaa8850a1ed7d5eee602ca0
SHA1 3abcc747e888006489b68c7b81a22b2c7124aefc
SHA512 839daf41edbc8c625d821abaa931937a464f1f12b91e8790f2cf2a7230faf31e3b291080e490a0896f8b882b826169ff6181ec81f4b211f5f2ee20d840f0211c
SSDEEP 96:siiqSl4PSheV+Ww7OhiI6OuYP2I+NjKAcwiS9t:l+l4PzJN36KuIwKi
TLSH
T1E3B18C01B284EA13D5790733AC9BD3DC2B64BE42DF430A1B31D8BB7F79327965211195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\manifests\scre..dows_420d02d3849b7992_001a.0007_none_3bc47de231580f02.manifest
Size 1KB
SHA256 665bc6817a6d5f562b3dd6d0248536879a34c057a18ff78b9324a9e391a88775
MD5 e12934bad7831d66034f6de67506420f
SHA1 b6340514efd0d95e21ca952e4fb49e6fbb62c63c
SHA512 9657ee285be5852e3208dfd3669740e7e58b0a899516e1b9092ab5a3ec24cd1464c340aa94b017f79d072ae4ec93bf112aadde174d2be4c000fb41ce7910fa98
TLSH
T12B41D11181C8FA250F3302C2BEEBE431979E5723158E194B7499AD9BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\manifests\scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf.cdf-ms
Size 7KB
SHA256 23952dbd5d9e750f9da3884ef2f4e7998f5f91947827a45b66c344bdb890569b
MD5 91eb342db81cc36f2999a2bc39aecfdd
SHA1 ce3149a97e7547d08a2816594e1c7229dd97eb42
SHA512 ce8e95ec6c66ddf90ed0960e8df485d2668316a15a44e9454fac795df41e63eec273176bd1f262299667fe271184c91e90513606e4baf1701cfb41bcbe8846d7
SSDEEP 96:69OOrPxnCTU748kFeV+WwwOh486yOr2PqvgoG6v+WHO0pcbSDviVZHclj:VenAd8kaJccylhZAD6Yj
TLSH
T141F12402B290ED16D5AD0A33ACD6C3ED36367E96DE43470B70C4BF2FBA726D65212095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\manifests\scre..ient_420d02d3849b7992_001a.0007_none_98937f24ddeddedf.manifest
Size 2KB
SHA256 62d5e8e172a93812c7daa3380ad84a86da0addb558519924f45e339c4ce46f95
MD5 53ab26b64de452e7cfbe60143a0ba458
SHA1 57d52b8c27bb38944416bfeb9438e5023cd7a3b0
SHA512 87350008595ded29636eeb7b3fa4e5f775796750eba5c7ddda25cef132f3f9f59a5b73c7e9ad086263ec9dec771d73eeff6fb2f6374491e86dc77ee0cda8ca72
TLSH
T1D751C31591C4FA350F3302C2BEEBE4709B9E5B23158E190B7099A99FCF2DA97474B067
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\manifests\scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6.cdf-ms
Size 2KB
SHA256 058aaabfc96e96dde92cc6b19355b8ea4383154873205e446e2a7e3c9e696787
MD5 056b803c8ad5dda0a38db1ad0172ce5d
SHA1 be3381f882c74f77e925d67adbd5e57b505e3b0b
SHA512 6069b679b7a90f622335f56045acd1e548c696fed9f57727de77ee3592876ee66d377811ee30d1127fa0ef9fdfffc74d782a3962b4f9f99d6abbca095a329e5b
TLSH
T17451DF053744E673EA7A0232AC96D3D932747D83EF42120BB1C0BB7F6D726C556160D2
MD5 SHA1 SHA512 TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\manifests\scre..ient_420d02d3849b7992_001a.0007_none_cd6203d3045951d6.manifest
Size 1KB
SHA256 9a12c29d45de7e20c7e9ef65f0afae9df2baf63c2de5ab91d2b1ffa7e4fa45c8
MD5 7b9dbfb89d98df763d60034f803e979c
SHA1 6dcf85c57edb2deceff9eeed2f41f3f245fb9d69
SHA512 57fbaf8db2fc629fa9836cfd23be68442140cb688776c927bbd171c6aabf378dbb3e800ff64f2d3cbc57b83f38cd55284a3afe927e5331f9b176e72b84475998
TLSH
T166113B0191C4FA361F3341D1BEE7E461A76D5B3314CE194BB0A9685F8B2AAD747470B3
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0007_none_0a65ab3dbb4427e4.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\manifests\scre..tion_0000000000000000_001a.0007_none_0a65ab3dbb4427e4.cdf-ms
Size 4KB
SHA256 902dc52cebfd2af36a524f9535f09144932b659612a1530eb1ed169b907b3908
MD5 e7af3c7b87a824250174c3787e352d2e
SHA1 3b80d4b0d635853143f17fcb7e7f8e9939613d47
SHA512 1ec990e3fdeb655564466b760943a74eb4a54370b1910ea523a4548ce9e23128387c85017ec024bdfc1c7f48b117717a96b6a2847a8ec85c4e9fb98bb7248974
SSDEEP 48:7P/mrIEAqzIv+EFgm0Ru9o0m5RD7lpU7gFUTUETkSif4sQgbmZFms4Ch+UQRcH:zOUSGZ0EW0m5R/lpUmIkS0QPfmvVUQRi
TLSH
T1DE913F80B740F823D61447729CE3D2D032357DA64FD6971B70987B2FAD367C596222A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\manifests\scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d.cdf-ms
Size 4KB
SHA256 509586580e82ada82943a55723dcd41eb675ff222c459740e2593ba52a3b3d01
MD5 436f639426b48c0f4b050d19a171232b
SHA1 9d0c15bb278acf4dce02ec10c723f049c0b7d878
SHA512 14b3b26522bf630d7fe20b8fe791d6b2c62e1b066d1a65954b2e1850a79142b36ec6cd9a35ef5a5d47979624c2110bcef5b2c69187e8e4f630eb160401329afa
SSDEEP 96:KQADBUDqeV+Ww8Oh44cuOuYPE+jXf5kZEZz:KBilJsiuK8YS6z
TLSH
T110A1A905B385E623D6650333AC87C3DD2AA1BD82EF430A4B71D47F7F3A327865222092
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\manifests\scre..vice_420d02d3849b7992_001a.0007_none_e8a03e498ac95f3d.manifest
Size 1KB
SHA256 e2cd552287be0e819f8691c834468bcf49023bf4f9598beb1fd4a42550e1dd01
MD5 219aa38b5278789dffbf782e507eda00
SHA1 8ac39ba1817be35c84b2ee0beeca1a69ca0610d7
SHA512 086c6adbb1bd71e979b6abc69ccb35d98983885046f168bbfa123a2bab5a5e11291ef7ad0003fce5217f9f87572b461c936d73f15039ae052653c56ce347fe73
TLSH
T13131F50191C4FA351F3302C1BEE7E4709B9E5B23158E190BB09A695FCF29A97434B073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\ScreenConnect.ClientService.exe
Size 93KB
SHA256 fa88997b02d98d2d2829b8d9f4aca92ef4ae55f0c21ed82db81ee86c423c9d46
MD5 8667c39f52f3fef8cc452e002c4a856b
SHA1 cecc186b75dc811800dc376a0eba6fe7c232ccdd
SHA512 11ce57245b224b53475c1c0b6b1763181c690dff1a0f8cedb4b9268f2a6b14207294fe08b6c335362cb25620ffe4ee99c1aebbfa1b1c37feec14c19e41fd062b
SSDEEP 1536:Mg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgkU0HMP7RekZg:1hbNDxZGXfdHrX7rAc6myJkgkU0Ha1e
TLSH
T12E935B13B5C28871D573093158E0DAB09A7FF9215E61DEAB3788022E4F742C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\ScreenConnect.WindowsBackstageShell.exe
Size 136KB
SHA256 4a2671841e0bd23ba1218bb46ab8206a2431a0119dacfae892022256e11259d6
MD5 b4f8cd448c9e299e035a60bd8268b0b5
SHA1 74b932b5fb28794c9a1e0caa054cec305f69a2ae
SHA512 310705a667e673ced9330c0e1f5bf489c5897080e049130d05c3ae0d8321a7975e78c413ec120554bc8465622b32178731fe484d64f085f46610e2ee8345a22d
SSDEEP 3072:4XNerVwv+ra5s550jHPTAf0NvKKNm0DyB+k:4KfoqqMWK1D
TLSH
T1DBD39E50BB59D526C5AE0E3BA4B2B71106B1B083DAD3C74B6C9822BD7E1CFC16F542C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\scre...exe_0000000000000000_001a.0007_none_5cdffd35bb8904e7\ScreenConnect.WindowsFileManager.exe
Size 115KB
SHA256 25175b7a9f75772a6e1aaea428102d9d3ef0f18896b423f0465b8bf229763b9c
MD5 5c448e2743ef0c78052ebdd46c950c80
SHA1 9124b319950a3dd5cd63462a65555d943e3b0067
SHA512 1150ea2d29dc13c14de32136e479f24d6d9f7aad06179133b88713d078ca2aa21ab399204e95838d9f76c4b1d8fd5b955d56f0520b9d38e9fcf2c78696d146ca
SSDEEP 1536:BgnaeGOSYhevKypfuqvhUZI5BLP+VVVVVVVVVVVVVVVVVVVVVVVVVSg1Q7Tl:BgnaxrYhevKy1uNuBLNwQt
TLSH
T176B3295135266231DEC9C533A051DAB099337F6607FEC2BE2CA1BA3629F13943E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0grzmnv1.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\0grzmnv1.newcfg
Size 834B
SHA256 d9666b46606aa433299016ceeebb850ec60dc4316bc9a1c873e61928b94e9902
MD5 d7d74d6ab9302ca3a0b77c17963f25d9
SHA1 3d84a4578da2f3d87974e0d3b175e24840fefb8d
SHA512 a919c298f0c0a06b34b77b0b981259fdeb1a765bcbefac22cb3349f24bc2ff7d87afb4c89279d8dcf8e8d58d9754e4a95a87f3305ceae4ef9d5fc9a455cd75fb
TLSH
T119012D5971C0AE8A02732932C5314781ED711B5B016A60D874EE21379F704DB07E32DE
MD5 SHA1 SHA512 TLSH

Submit Download

4wboa0y4.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\4wboa0y4.newcfg
Size 834B
SHA256 2cb0db556965b149fd15cab360a59d3f1e79229996d7e8b7b80a83fb81dbd6af
MD5 3c4752364cb329f93472d0dcebf14de4
SHA1 f7d39ea1308705118693725c1a47da02ca015cdb
SHA512 d7f67be1d965628bee33c4165ecb9bb98069bfa81f1135f27cd477b778ce947bb1a536ef2f30150404d2c0028d2b3af8b140066cadbe2ee906e6311385abdeb6
TLSH
T192012D5971C0AE8A02736932C5314781ED711B5B016660D838AE21379F704DB07E32DD
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\ScreenConnect.WindowsClient.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

be0tm25u.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\be0tm25u.newcfg
Size 660B
SHA256 0ce711da15e0a6d38e7c41cff2e8c1288991acaca5b01fb76ce289ae6bf05a12
MD5 600f14134e924deb4d3cd7bd9cd53891
SHA1 22189282e11bfa43a1ad446187892c7fc63a13af
SHA512 7d5d226b484b213b1c5b6b5f432f8eff924461d0e9ab8b05711cf45e2c316a7caa08d23245036756a5a2c32c679dbec8c501074cc4c4502ef2a96dc8b06d5b6b
TLSH
T1D701285971C0AE8B03B36A33C5228741EE715A9B016620D874AE217B9F304DF07E32DE
MD5 SHA1 SHA512 TLSH

Submit Download

c12gjftq.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\c12gjftq.newcfg
Size 834B
SHA256 158156570b81ee962b671eaf331db34d9596713d7e2710fe742ca7a36e75981d
MD5 a5e530860656e41d29c89f54d6f7a30b
SHA1 d0d72612e41cca6edf61d8a92e0f65a8ab3ba831
SHA512 ec56cb61684e6e17218d951ce7568acd79bb0b09e4e70bc82e76006c91225eaa2a538f705fda3bf82a549cfee5346a1d87652a851df5c9bb1e00c33e06d29be2
TLSH
T12F012D5971C0AE8A02736932C6314781ED71175B016A60D834EE61779F704DB07E32DE
MD5 SHA1 SHA512 TLSH

Submit Download

sqohk4qy.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\sqohk4qy.newcfg
Size 834B
SHA256 b389aba306870d2d5449fe5ace63800631b896f638134127ff9c5d4ab4c79fb4
MD5 c6e611202cd3030bcf809b4adfeaf900
SHA1 98879af4535f0407badc25d7795363afb307466d
SHA512 ee848c6bcdcf8a8b4616d2b1c63103079974b024f3ce52be2217d7f6e0d9ed9b768de6ef72f064045a541efc97107cea77ffabefd99748f9ebf709f1bf5a1290
TLSH
T1C901405971C0AE8A03732932C5314781ED71175B016660D834EE21379F704DF0BE32DD
MD5 SHA1 SHA512 TLSH

Submit Download

tbmvrda5.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\tbmvrda5.newcfg
Size 834B
SHA256 5941ae0a115271a99d228b936cfbab58e9bff8f5563be873e13e142470e6defb
MD5 7b9e0ed3e9ff181345ef2f897c3e1a2b
SHA1 afce3bb510f85e2502e186befc756a90d670b0ae
SHA512 8de9fab7adf39cc173343f8d14c14d7450badf71bb3f88949de7a7efc14e3404049ec33314fcc9b5e5b540024b6ee7c1ea70699eb483c822454891c3c888786a
TLSH
T199012D5971C4AE8A02736932C5314781ED71175B016A60D838AE21379F704DB07E32DE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\41MCGH6X.2X2\4YR7XWT1.0J0\scre..tion_0000000000000000_001a.0007_f4da863c93273aba\user.config
Size 520B
SHA256 53dfb5384e9a6d94e914fa50c3c9e51d520a288a4dc9c2f98abfe09ad58aab2c
MD5 23f45a71784b000dbf7524177f6ade1b
SHA1 209479ca21e8ee165d1c3db1351cdc6d71ae7887
SHA512 61d6284e5e1e3c83a4a8236bfdef07a334f2c25aded029e82aac65a9aa61a25798fe28485929378c6b9dbf876bb811fb85501644abaed80ffd84f84ffa0f20b7
TLSH
T109F0E2A531806E4B07A36E23C5128741EE726A9B0561249874AF627A9F315DE03A32DE
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A9QC0ZA2.B6L\ZRC3KRBD.JCW\ScreenConnect.Client.dll
Size 628KB
SHA256 8ed29767837e883bc9577cc4fb3705d60dedd7fe8d28515aa26646e0302bed24
MD5 4a35c09d240c685b085ce550f68d9252
SHA1 1b85f45bae4dda9836376963a901aacc4049feaf
SHA512 0ae85ae7e71038a39ce6400ddab38bb39e8f8d3ae1546c56ce4d1dd27c47919a01529f81d4539ff917e3565a81feb3bee706bd1ebb8e8f1e837373207c774650
SSDEEP 12288:6cZ7YfSLFwTE5Hzhmj5KazHTEavSW7OQniu3bsAuaq:6cWCwA5hERzEn8qu3bPuaq
TLSH
T1B0D4C04DE794AD29ED6E0B73B59127209AB0ACCA945BE30F1DA4737D4D723847E4C2C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A9QC0ZA2.B6L\ZRC3KRBD.JCW\ScreenConnect.ClientService.dll
Size 192KB
SHA256 2ccff7ba32fb18af838459307fd2bb9ed1e4cd1805cf0675eccdaad31827e1e9
MD5 616dbe982fa7cfcdf79b8bba3187833b
SHA1 3a30149340d6a9f94c8027916a8634c329ffbf94
SHA512 b4b26a064a8333afd9ad6da3ac3f361c307ca5c93f072672d53206974a92b4df1ac0f39d23c65b3fdac29c829ef951580806d293642a32c08b0eb4df88cdc0eb
SSDEEP 3072:lyuiZD7L1WbX2Ma+rYmh53mP8vQIMAw8yNgaYxlfQiVwKXorZc:uvL62sbe8PFyOxFO1u
TLSH
T1FB14AF48BB5AD416C99F0E3BE861B26002F1A443DDE7D78F6C8862DE1E563C51F543CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A9QC0ZA2.B6L\ZRC3KRBD.JCW\ScreenConnect.Core.dll
Size 1.3MB
SHA256 8e868637ac960e1c7c98cba86ee157a25a37aa560434ff2f1e4abdf81774d5d6
MD5 9bc65903fe3e5b080a89197e231827d9
SHA1 33c304d9dc24741e9c888725bf5f6f70b0f782bc
SHA512 b33123e4f772802ad2aab6d153b926586b5952239ac3cc066cd56e928c080395163154eb266ddcc04072b789851ff9c410140437b70655d378e3bb4cc6b9a06d
SSDEEP 24576:zBYjbswXly3xJCFuC5onhQ6tN7f3vtNk1KW2eQ2JL:unxXHul7f31zTeQ2JL
TLSH
T179558D8E7B89E627DA7D0A3784602214A7B0E0D25F67D70B69E0FB7D0C953A87E451CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A9QC0ZA2.B6L\ZRC3KRBD.JCW\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 91b1c12ab90387e29e1bc357cbf9c0edc829872e9a964d2538ea2f5ac1eece3f
MD5 3f4816cfcb143113bac5d7564f664fd4
SHA1 7a7fe42dfea511ab33cebb757acac38359628427
SHA512 7af0408163c1a4d73a6a9219825da1cf30b3ee97af10bc9af2142aaf8f39742a2ad0ea7adb1caf0ec20783dcb14b846de9e7259d4cc3f83346f00e39871f55b0
SSDEEP 24576:qZbsJXFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKPTsO:PXJkGYYZTk+T1iH7efPjre
TLSH
T1E295AD41E6C368FAD46B053888BE632AB7747C040355CBFB97D4AA392D337C09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A9QC0ZA2.B6L\ZRC3KRBD.JCW\ScreenConnect.WindowsClient.exe
Size 1.5MB
SHA256 dbf62f4d0d159245a18a55627ee1477214188e4973b4af9be3cd4977293bc845
MD5 3e998dcaa9f9531933fed9ddd51e57c0
SHA1 799cd91f67f0458ec9838ea08ca8be33f6ccd3be
SHA512 6d9a4dca64c98e8b71b88112f835265c56e79c444c93688a488f97bfb707857f87e51c0dd7b6c7e913c8c2566f05799f7e9c6034ba16b3722efb430596bd4623
SSDEEP 24576:hlzNWqSl6HT38IIT9zCrReOAu4vbBkZxcKAPH4PDA:hRNWqi6IIIBzCFMNBNz
TLSH
T14F759E89BE99EE3BC86F077780602114A7F08891CF63DB575894B77E1DC93C46D48A8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A9QC0ZA2.B6L\ZRC3KRBD.JCW\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 1b2decf03e1be09ce872495755fcd17b2eef7c2b760ebabdb9fc151eb910835d
MD5 7e57755b0dcc1669d7a40505cc5478b3
SHA1 4e56b2f8ea59cfa8266801d8b0df9ed8c192adfe
SHA512 2d91095b465ad3ff0ccec6e9f07c6856dc3175745805197ddbee1380cc26b8cecacf5e678853208938a0cc46fd9d3c62f3db5d3759b0f8ab4dc3b145a3049c51
SSDEEP 192:oRombespJpKppvp3+pDMD7H9UFUlQnKVUD:/mbespJp+pvpOpDcdaUQnqO
TLSH
T16BF1AC5688C07D21573381C4FEE39914BD157F2302AE148EBC8D19AF9FB65899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A9QC0ZA2.B6L\ZRC3KRBD.JCW\ScreenConnect.WindowsFileManager.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

HEBTWJM0.97P.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\TY45MR8V.YWA\HEBTWJM0.97P.application
Size 127KB
SHA256 14c78bfcfc4c35efa0c795f2e21133ec32a439e5e0a64a3ee42eff165c9fe18b
MD5 e97754b4ac5feb689141aa6ab4339cd7
SHA1 59537744e5c5759f188957201cd0bd15831afe08
SHA512 8c2e7deff38eaba5b15d26745cf598b38d6eaf09307499aa58f8821dffe4d063422015664ece8838d9863044b92b60bb2aedb4787f883412fc75acd7abb1b1a2
SSDEEP 1536:4zpjCtVfbzcCU5XxVNwWLVIRTLtjwpt0/K4EnIXh+3nJKQ/IuKE:8tVNtJIRTLKpt0/Gnu2nJX1
TLSH
T1AED3D63A8F30F4C0877DB021D1652D6B3DC11B979B731FACDA0A186A0E69756EF4A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2104-13-0x0000000074690000-0x0000000074E4C000-memory.dmp

Download

memory/2104-6-0x0000000005590000-0x00000000055FE000-memory.dmp

Download

memory/2104-21-0x0000000074690000-0x0000000074E4C000-memory.dmp

Download

memory/2104-0-0x00000000746A2000-0x00000000746A3000-memory.dmp

Download

memory/2104-16-0x0000000074690000-0x0000000074E4C000-memory.dmp

Download

memory/2104-12-0x00000000746A2000-0x00000000746A3000-memory.dmp

Download

memory/2104-11-0x0000000009180000-0x0000000009364000-memory.dmp

Download

memory/2104-10-0x0000000005AE0000-0x0000000005B72000-memory.dmp

Download

memory/2104-9-0x0000000005E60000-0x000000000641A000-memory.dmp

Download

memory/2104-1-0x0000000004FB0000-0x0000000004FB8000-memory.dmp

Download

memory/2104-8-0x0000000074690000-0x0000000074E4C000-memory.dmp

Download

memory/2104-7-0x0000000074690000-0x0000000074E4C000-memory.dmp

Download

memory/2104-5-0x0000000074690000-0x0000000074E4C000-memory.dmp

Download

memory/2104-4-0x00000000051F0000-0x0000000005340000-memory.dmp

Download

memory/2104-3-0x0000000074690000-0x0000000074E4C000-memory.dmp

Download

memory/2104-2-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

Download

memory/2288-343-0x0000000000D10000-0x0000000000EA0000-memory.dmp

Download

memory/3396-14-0x00000285478F0000-0x00000285478F8000-memory.dmp

Download

memory/3396-68-0x0000028566B90000-0x0000028566C32000-memory.dmp

Download

memory/3396-62-0x0000028566D80000-0x0000028566ED0000-memory.dmp

Download

memory/3396-56-0x0000028566E00000-0x0000028566F90000-memory.dmp

Download

memory/3396-50-0x00000285669A0000-0x00000285669D4000-memory.dmp

Download

memory/3396-44-0x0000028566EC0000-0x00000285670A4000-memory.dmp

Download

memory/3396-34-0x0000028566950000-0x00000285669A0000-memory.dmp

Download

memory/3396-25-0x00007FFE02B10000-0x00007FFE034B4000-memory.dmp

Download

memory/3396-24-0x00007FFE02B10000-0x00007FFE034B4000-memory.dmp

Download

memory/3396-23-0x00007FFE02B10000-0x00007FFE034B4000-memory.dmp

Download

memory/3396-22-0x00007FFE02B10000-0x00007FFE034B4000-memory.dmp

Download

memory/3396-18-0x00007FFE02B10000-0x00007FFE034B4000-memory.dmp

Download

memory/3396-388-0x00007FFE02B10000-0x00007FFE034B4000-memory.dmp

Download

memory/3396-389-0x00007FFE02B10000-0x00007FFE034B4000-memory.dmp

Download

memory/3396-390-0x00007FFE02B10000-0x00007FFE034B4000-memory.dmp

Download

memory/3396-20-0x00007FFE02B10000-0x00007FFE034B4000-memory.dmp

Download

memory/3396-19-0x00007FFE02B10000-0x00007FFE034B4000-memory.dmp

Download

memory/3396-17-0x00007FFE02C9F000-0x00007FFE02CA0000-memory.dmp

Download

memory/3396-15-0x00000285498D0000-0x0000028549A58000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads