Edit tour

Windows Analysis Report
ConnectWiseControl.Client.exe

Overview

General Information

Sample Name:	ConnectWiseControl.Client.exe
Analysis ID:	849197
MD5:	dbac4578027bb4fd75ac8b10312157d0
SHA1:	f26b77dc1657cdb4ee10177d3e6c7c5c52726568
SHA256:	22ed0ca25db71cef62ab471c12ee0989c18a326dbc9b4e5518cfcd9678863bd3
Infos:

Detection

Score:	36
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Multi AV Scanner detection for submitted file

Uses 32bit PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Queries the volume information (name, serial number etc) of a device

PE file contains an invalid checksum

Drops certificate files (DER)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Stores large binary data to the registry

JA3 SSL client fingerprint seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

HTTP GET or POST without a user agent

Contains long sleeps (>= 3 min)

Enables debug privileges

Classification

Process Tree

System is w10x64_ra

ConnectWiseControl.Client.exe (PID: 7024 cmdline: C:\Users\user\Desktop\ConnectWiseControl.Client.exe MD5: DBAC4578027BB4FD75AC8B10312157D0)

dfsvc.exe (PID: 6992 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe MD5: 60C91843ADCE3750F2A0835F0594D438)

cleanup

Joe Sandbox Signatures

• AV Detection
• Compliance
• Networking
• E-Banking Fraud
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ConnectWiseControl.Client.exe

Virustotal: Detection: 18%

Perma Link

Source: ConnectWiseControl.Client.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ConnectWiseControl.Client.exe

Static PE information: certificate valid

Source: unknown

HTTPS traffic detected: 145.40.105.166:443 -> 192.168.2.3:49731 version: TLS 1.2

Source: ConnectWiseControl.Client.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbR3pLUIARz9 source: dfsvc.exe, 00000002.00000002.2201529805.0000022844BA2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Misc\Bootstrapper\Release\ClickOnceRunner.pdb source: ConnectWiseControl.Client.exe
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Deployment.pdb source: dfsvc.exe, 00000002.00000002.2206538601.0000022844CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: dfsvc.exe, 00000002.00000002.2201529805.0000022844BA2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.pdbpdbtem.pdb source: dfsvc.exe, 00000002.00000002.2201529805.0000022844BA2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.pdb source: dfsvc.exe, 00000002.00000002.2201529805.0000022844BA2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: dfsvc.exe, 00000002.00000002.2185221509.0000022842D9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.pdb source: dfsvc.exe, 00000002.00000002.2185221509.0000022842D26000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: b.pdb source: dfsvc.exe, 00000002.00000002.2201529805.0000022844BA2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: dfsvc.exe, 00000002.00000002.2185221509.0000022842D4E000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2201529805.0000022844B09000.00000004.00000020.00020000.00000000.sdmp

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?y=Guest&h=instance-qltwa7-relay.screenconnect.com&p=443&s=93b2b33c-7da5-4aac-9916-c3c95fea3204&k=BgIAAACkAABSU0ExAAgAAAEAAQCZ4tmJR17udjp4gfURDoWxttb7TDFYTUaNOWp8sTqNE5iULGAJGZHKgQfhquB9LuVFW7czCACd4Ni5SZ8Yjsk8MupFz6XQ0KczPe%2fCsXb%2bTLdY74iLSjlGAMD3FbTuloLzTC1yZzOTA4RoxJ3evXvfO95BnnitC0aEEM5%2fuLvZVfYGjAlFmp%2fvtGOAReYR1Mum29ZbHydKTsL4Qbd6XmTxvXxLFrFn1UcO7ee3pF8HB4vh9GbkQ4WVRNbl5yAX1AcOjqehKoDJZT%2bVMbRAxwX4wfU%2fikm%2bEivRkZBsUzK66IzLTDyCkq8NTYyi82KdGBQ4Qc90HR6cESlKH32WNMW1&r=&i=Untitled%20Session HTTP/1.1Host: connect.screenconnect.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: connect.screenconnect.comAccept-Encoding: gzip

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: ConnectWiseControl.Client.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: ConnectWiseControl.Client.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: ConnectWiseControl.Client.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: F2E248BEDDBB2D85122423C41028BFD40.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: ConnectWiseControl.Client.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: dfsvc.exe, 00000002.00000002.2142950261.000002282ACC6000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282ACAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://connect.screenconnect.com
Source: dfsvc.exe, 00000002.00000002.2185221509.0000022842D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: dfsvc.exe, 00000002.00000002.2185221509.0000022842D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: ConnectWiseControl.Client.exe, 00000001.00000002.1428524763.000000000086D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCe1
Source: ConnectWiseControl.Client.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: ConnectWiseControl.Client.exe, 00000001.00000002.1428524763.000000000086D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTr
Source: ConnectWiseControl.Client.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: ConnectWiseControl.Client.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ConnectWiseControl.Client.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: ConnectWiseControl.Client.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: dfsvc.exe, 00000002.00000002.2201529805.0000022844BA2000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: dfsvc.exe, 00000002.00000002.2201529805.0000022844BA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab84
Source: dfsvc.exe, 00000002.00000003.1699045046.0000022844BC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab=
Source: dfsvc.exe, 00000002.00000002.2201529805.0000022844B64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enta(
Source: dfsvc.exe, 00000002.00000003.1699045046.0000022844BB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?f87ba61c60
Source: dfsvc.exe, 00000002.00000003.1456388436.00000228433C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://en.w
Source: dfsvc.exe, 00000002.00000003.1456509327.00000228433C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://en.w(Q
Source: dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: ConnectWiseControl.Client.exe, 00000001.00000002.1428524763.000000000086D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicer
Source: ConnectWiseControl.Client.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: ConnectWiseControl.Client.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: ConnectWiseControl.Client.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: ConnectWiseControl.Client.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: dfsvc.exe, 00000002.00000002.2142950261.000002282A601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: dfsvc.exe, 00000002.00000002.2142950261.000002282ACC6000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282ACAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://server-nix317f89b6-web.screenconnect.com
Source: dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: ConnectWiseControl.Client.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: dfsvc.exe, 00000002.00000003.1455062412.00000228433BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com$
Source: dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: dfsvc.exe, 00000002.00000002.2142950261.000002282A99C000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282A884000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282A95E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.o
Source: dfsvc.exe, 00000002.00000002.2142950261.000002282A8C9000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282A9D6000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282A99C000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282A949000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282A9C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.or
Source: dfsvc.exe, 00000002.00000002.2142950261.000002282A692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2core
Source: dfsvc.exe, 00000002.00000002.2142950261.000002282A692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2core-us
Source: dfsvc.exe, 00000002.00000002.2142950261.000002282A692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2core=
Source: dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: dfsvc.exe, 00000002.00000002.2142950261.000002282ABA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://connect.screenc
Source: dfsvc.exe, 00000002.00000002.2142950261.000002282ACAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://connect.screenconnect.com
Source: dfsvc.exe, 00000002.00000002.2206538601.0000022844C42000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2201529805.0000022844B64000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282A9D6000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282ABA0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282A95E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282A949000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://connect.screenconnect.com/Bin/ScreenConnect.Client.application
Source: dfsvc.exe, 00000002.00000002.2142950261.000002282ABA0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282A95E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://connect.screenconnect.com/Bin/ScreenConnect.Client.application#ScreenConnect.WindowsClient.a
Source: dfsvc.exe, 00000002.00000002.2201529805.0000022844B64000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2185221509.0000022842CFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://connect.screenconnect.com/Bin/ScreenConnect.Client.application(
Source: AXV12UXD.log.2.dr	String found in binary or memory: https://connect.screenconnect.com/Bin/ScreenConnect.Client.application?y=Guest&h=instance-qltwa7-rel
Source: dfsvc.exe, 00000002.00000002.2185221509.0000022842CFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://connect.screenconnect.com/Bin/ScreenConnect.Client.applicationB
Source: dfsvc.exe, 00000002.00000002.2185221509.0000022842CFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://connect.screenconnect.com/Bin/ScreenConnect.Client.applicationH
Source: dfsvc.exe, 00000002.00000002.2142950261.000002282A9D6000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282A95E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://connect.screenconnect.com/Bin/ScreenConnect.Client.applicationX
Source: dfsvc.exe, 00000002.00000002.2142950261.000002282ACAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://connect.screenconnect.com/Bin/ScreenConnect.Client.dll
Source: dfsvc.exe, 00000002.00000002.2142950261.000002282ACC6000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2185221509.0000022842D63000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282ABA0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282A795000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282AD3B000.00000004.00000800.00020000.00000000.sdmp, AXV12UXD.log.2.dr	String found in binary or memory: https://connect.screenconnect.com/Bin/ScreenConnect.Client.manifest
Source: dfsvc.exe, 00000002.00000002.2142950261.000002282ACAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://connect.screenconnect.com/Bin/ScreenConnect.ClientService.dll
Source: AXV12UXD.log.2.dr	String found in binary or memory: https://connect.screenconnect.com/Bin/ScreenConnect.ClientService.exe
Source: dfsvc.exe, 00000002.00000002.2206538601.0000022844C42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://connect.screenconnect.com/Bin/ScreenConnect.ClientService.exec
Source: dfsvc.exe, 00000002.00000002.2142950261.000002282ACAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://connect.screenconnect.com/Bin/ScreenConnect.Core.dll
Source: dfsvc.exe, 00000002.00000002.2142950261.000002282ACAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://connect.screenconnect.com/Bin/ScreenConnect.Windows.dll
Source: dfsvc.exe, 00000002.00000002.2142950261.000002282ACAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://connect.screenconnect.com/Bin/ScreenConnect.WindowsBackstageShell.exe
Source: dfsvc.exe, 00000002.00000002.2142950261.000002282ACAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://connect.screenconnect.com/Bin/ScreenConnect.WindowsBackstageShell.exe.config
Source: dfsvc.exe, 00000002.00000002.2142950261.000002282ACAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://connect.screenconnect.com/Bin/ScreenConnect.WindowsClient.exe
Source: dfsvc.exe, 00000002.00000002.2142950261.000002282ACAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://connect.screenconnect.com/Bin/ScreenConnect.WindowsClient.exe.config

Source: unknown

DNS traffic detected: queries for: connect.screenconnect.com

Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?y=Guest&h=instance-qltwa7-relay.screenconnect.com&p=443&s=93b2b33c-7da5-4aac-9916-c3c95fea3204&k=BgIAAACkAABSU0ExAAgAAAEAAQCZ4tmJR17udjp4gfURDoWxttb7TDFYTUaNOWp8sTqNE5iULGAJGZHKgQfhquB9LuVFW7czCACd4Ni5SZ8Yjsk8MupFz6XQ0KczPe%2fCsXb%2bTLdY74iLSjlGAMD3FbTuloLzTC1yZzOTA4RoxJ3evXvfO95BnnitC0aEEM5%2fuLvZVfYGjAlFmp%2fvtGOAReYR1Mum29ZbHydKTsL4Qbd6XmTxvXxLFrFn1UcO7ee3pF8HB4vh9GbkQ4WVRNbl5yAX1AcOjqehKoDJZT%2bVMbRAxwX4wfU%2fikm%2bEivRkZBsUzK66IzLTDyCkq8NTYyi82KdGBQ4Qc90HR6cESlKH32WNMW1&r=&i=Untitled%20Session HTTP/1.1Host: connect.screenconnect.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: connect.screenconnect.comAccept-Encoding: gzip

Source: unknown

HTTPS traffic detected: 145.40.105.166:443 -> 192.168.2.3:49731 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4

Jump to dropped file

Source: ConnectWiseControl.Client.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ConnectWiseControl.Client.exe

Virustotal: Detection: 18%

Source: C:\Users\user\Desktop\ConnectWiseControl.Client.exe

File read: C:\Users\user\Desktop\ConnectWiseControl.Client.exe

Jump to behavior

Source: ConnectWiseControl.Client.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ConnectWiseControl.Client.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ec23d1294499b4ffba61f212cb1217cd\mscorlib.ni.dll

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ConnectWiseControl.Client.exe C:\Users\user\Desktop\ConnectWiseControl.Client.exe
Source: C:\Users\user\Desktop\ConnectWiseControl.Client.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
Source: C:\Users\user\Desktop\ConnectWiseControl.Client.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Jump to behavior

Source: C:\Users\user\Desktop\ConnectWiseControl.Client.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File created: C:\Users\user\AppData\Local\Deployment

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File created: C:\Users\user\AppData\Local\Temp\Deployment

Jump to behavior

Source: classification engine

Classification label: sus36.winEXE@3/8@6/1

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: ConnectWiseControl.Client.exe

Static PE information: certificate valid

Source: ConnectWiseControl.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ConnectWiseControl.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ConnectWiseControl.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ConnectWiseControl.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ConnectWiseControl.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ConnectWiseControl.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: ConnectWiseControl.Client.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: ConnectWiseControl.Client.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbR3pLUIARz9 source: dfsvc.exe, 00000002.00000002.2201529805.0000022844BA2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Misc\Bootstrapper\Release\ClickOnceRunner.pdb source: ConnectWiseControl.Client.exe
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Deployment.pdb source: dfsvc.exe, 00000002.00000002.2206538601.0000022844CC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: dfsvc.exe, 00000002.00000002.2201529805.0000022844BA2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.pdbpdbtem.pdb source: dfsvc.exe, 00000002.00000002.2201529805.0000022844BA2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.pdb source: dfsvc.exe, 00000002.00000002.2201529805.0000022844BA2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: dfsvc.exe, 00000002.00000002.2185221509.0000022842D9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.pdb source: dfsvc.exe, 00000002.00000002.2185221509.0000022842D26000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: b.pdb source: dfsvc.exe, 00000002.00000002.2201529805.0000022844BA2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: dfsvc.exe, 00000002.00000002.2185221509.0000022842D4E000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2201529805.0000022844B09000.00000004.00000020.00020000.00000000.sdmp

Source: ConnectWiseControl.Client.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: ConnectWiseControl.Client.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: ConnectWiseControl.Client.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: ConnectWiseControl.Client.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: ConnectWiseControl.Client.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: ConnectWiseControl.Client.exe

Static PE information: real checksum: 0x18c9f should be: 0x19087

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Code function: 2_2_00007FFF61D3DE05 pushad ; iretd

2_2_00007FFF61D3DE06

Source: C:\Users\user\Desktop\ConnectWiseControl.Client.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Window / User API: threadDelayed 7521

Jump to behavior

Source: C:\Users\user\Desktop\ConnectWiseControl.Client.exe TID: 7020	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ConnectWiseControl.Client.exe TID: 7020	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -599850s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -599729s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -599596s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -599450s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -599302s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -599150s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -598979s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -598797s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -598674s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -598550s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -598400s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -598296s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -598191s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -598050s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -597900s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -597787s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -597650s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -597537s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -597401s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -597271s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -597129s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -597000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -596895s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -596750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -596629s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -596500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -596395s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -596258s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -596147s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -596000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -595874s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -595750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -595636s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -595532s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -595413s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -595300s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -595150s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -594950s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -594750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -594625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -594450s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -594333s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -594200s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -594092s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -593950s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -593798s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -593651s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -593545s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -593401s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -593250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -593130s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -593001s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -592850s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -592650s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -592537s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -592400s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -592200s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -592060s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -591940s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7088	Thread sleep time: -591800s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599850	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599729	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599596	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599450	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599302	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599150	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598979	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598674	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598550	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598400	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598191	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598050	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597900	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597787	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597650	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597537	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597401	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597271	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597129	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596895	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596629	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596395	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596258	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596147	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595636	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595413	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595300	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595150	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594950	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594450	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594333	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594200	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594092	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593950	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593798	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593651	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593545	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593401	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593130	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 592850	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 592650	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 592537	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 592400	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 592200	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 592060	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 591940	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 591800	Jump to behavior

Source: C:\Users\user\Desktop\ConnectWiseControl.Client.exe	Thread delayed: delay time: 40000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599850	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599729	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599596	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599450	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599302	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599150	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598979	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598674	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598550	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598400	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598191	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598050	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597900	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597787	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597650	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597537	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597401	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597271	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597129	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596895	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596629	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596395	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596258	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596147	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595636	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595413	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595300	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595150	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594950	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594450	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594333	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594200	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594092	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593950	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593798	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593651	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593545	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593401	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593130	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 592850	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 592650	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 592537	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 592400	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 592200	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 592060	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 591940	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 591800	Jump to behavior

Source: dfsvc.exe, 00000002.00000002.2185221509.0000022842CC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: dfsvc.exe, 00000002.00000002.2206538601.0000022844C3E000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000003.1702146476.0000022844C3F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: dfsvc.exe, 00000002.00000003.1696780990.0000022844C3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW&
Source: dfsvc.exe, 00000002.00000002.2185221509.0000022842CC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWcert.com9

Source: C:\Users\user\Desktop\ConnectWiseControl.Client.exe

Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ConnectWiseControl.Client.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Modify Registry	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	21 Virtualization/Sandbox Evasion	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Process Injection	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Obfuscated Files or Information	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ConnectWiseControl.Client.exe	19%	Virustotal		Browse

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
1.0.ConnectWiseControl.Client.exe.f60000.0.unpack	100%	Avira	HEUR/AGEN.1363355		Download File

Domains

Source	Detection	Scanner	Label	Link
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.w3.or	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://en.w	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.w3.o	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.xrml.org/schema/2001/11/xrml2core-us	0%	Avira URL Cloud	safe
http://www.xrml.org/schema/2001/11/xrml2core	0%	Virustotal		Browse
http://www.sajatypeworks.com$	0%	Avira URL Cloud	safe
http://www.xrml.org/schema/2001/11/xrml2core	0%	Avira URL Cloud	safe
http://www.xrml.org/schema/2001/11/xrml2core=	0%	Avira URL Cloud	safe
http://ocsp.digicer	0%	Avira URL Cloud	safe
http://en.w(Q	0%	Avira URL Cloud	safe
https://connect.screenc	0%	Avira URL Cloud	safe
http://www.xrml.org/schema/2001/11/xrml2core=	0%	Virustotal		Browse

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
server-nix317f89b6-web.screenconnect.com	145.40.105.166	true	false		high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown
connect.screenconnect.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://connect.screenconnect.com/Bin/ScreenConnect.Client.manifest	false		high
https://connect.screenconnect.com/Bin/ScreenConnect.Client.application?y=Guest&h=instance-qltwa7-relay.screenconnect.com&p=443&s=93b2b33c-7da5-4aac-9916-c3c95fea3204&k=BgIAAACkAABSU0ExAAgAAAEAAQCZ4tmJR17udjp4gfURDoWxttb7TDFYTUaNOWp8sTqNE5iULGAJGZHKgQfhquB9LuVFW7czCACd4Ni5SZ8Yjsk8MupFz6XQ0KczPe%2fCsXb%2bTLdY74iLSjlGAMD3FbTuloLzTC1yZzOTA4RoxJ3evXvfO95BnnitC0aEEM5%2fuLvZVfYGjAlFmp%2fvtGOAReYR1Mum29ZbHydKTsL4Qbd6XmTxvXxLFrFn1UcO7ee3pF8HB4vh9GbkQ4WVRNbl5yAX1AcOjqehKoDJZT%2bVMbRAxwX4wfU%2fikm%2bEivRkZBsUzK66IzLTDyCkq8NTYyi82KdGBQ4Qc90HR6cESlKH32WNMW1&r=&i=Untitled%20Session	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://connect.screenconnect.com/Bin/ScreenConnect.WindowsClient.exe.config	dfsvc.exe, 00000002.00000002.2142950261.000002282ACAE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://connect.screenconnect.com/Bin/ScreenConnect.ClientService.dll	dfsvc.exe, 00000002.00000002.2142950261.000002282ACAE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://connect.screenconnect.com/Bin/ScreenConnect.WindowsBackstageShell.exe	dfsvc.exe, 00000002.00000002.2142950261.000002282ACAE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://connect.screenconnect.com/Bin/ScreenConnect.Client.applicationX	dfsvc.exe, 00000002.00000002.2142950261.000002282A9D6000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282A95E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.xrml.org/schema/2001/11/xrml2core-us	dfsvc.exe, 00000002.00000002.2142950261.000002282A692000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://connect.screenconnect.com/Bin/ScreenConnect.Client.application#ScreenConnect.WindowsClient.a	dfsvc.exe, 00000002.00000002.2142950261.000002282ABA0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282A95E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.xrml.org/schema/2001/11/xrml2core	dfsvc.exe, 00000002.00000002.2142950261.000002282A692000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.xrml.org/schema/2001/11/xrml2core=	dfsvc.exe, 00000002.00000002.2142950261.000002282A692000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.w3.or	dfsvc.exe, 00000002.00000002.2142950261.000002282A8C9000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282A9D6000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282A99C000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282A949000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282A9C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://connect.screenconnect.com/Bin/ScreenConnect.ClientService.exec	dfsvc.exe, 00000002.00000002.2206538601.0000022844C42000.00000004.00000020.00020000.00000000.sdmp	false		high
https://connect.screenconnect.com/Bin/ScreenConnect.Client.application(	dfsvc.exe, 00000002.00000002.2201529805.0000022844B64000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2185221509.0000022842CFE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://connect.screenconnect.com/Bin/ScreenConnect.ClientService.exe	AXV12UXD.log.2.dr	false		high
http://www.goodfont.co.kr	dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://en.w	dfsvc.exe, 00000002.00000003.1456388436.00000228433C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://server-nix317f89b6-web.screenconnect.com	dfsvc.exe, 00000002.00000002.2142950261.000002282ACC6000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282ACAE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://connect.screenconnect.com/Bin/ScreenConnect.Client.dll	dfsvc.exe, 00000002.00000002.2142950261.000002282ACAE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://connect.screenconnect.com/Bin/ScreenConnect.Client.application	dfsvc.exe, 00000002.00000002.2206538601.0000022844C42000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2201529805.0000022844B64000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282A9D6000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282ABA0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282A95E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282A949000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://connect.screenconnect.com/Bin/ScreenConnect.Client.applicationB	dfsvc.exe, 00000002.00000002.2185221509.0000022842CFE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://connect.screenconnect.com/Bin/ScreenConnect.Windows.dll	dfsvc.exe, 00000002.00000002.2142950261.000002282ACAE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.w3.o	dfsvc.exe, 00000002.00000002.2142950261.000002282A99C000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282A884000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282A95E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://connect.screenconnect.com	dfsvc.exe, 00000002.00000002.2142950261.000002282ACC6000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2142950261.000002282ACAE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://connect.screenconnect.com/Bin/ScreenConnect.Core.dll	dfsvc.exe, 00000002.00000002.2142950261.000002282ACAE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.digicer	ConnectWiseControl.Client.exe, 00000001.00000002.1428524763.000000000086D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://connect.screenconnect.com	dfsvc.exe, 00000002.00000002.2142950261.000002282ACAE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://connect.screenconnect.com/Bin/ScreenConnect.Client.applicationH	dfsvc.exe, 00000002.00000002.2185221509.0000022842CFE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fonts.com	dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com$	dfsvc.exe, 00000002.00000003.1455062412.00000228433BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.zhongyicts.com.cn	dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://connect.screenc	dfsvc.exe, 00000002.00000002.2142950261.000002282ABA0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://connect.screenconnect.com/Bin/ScreenConnect.WindowsBackstageShell.exe.config	dfsvc.exe, 00000002.00000002.2142950261.000002282ACAE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	dfsvc.exe, 00000002.00000002.2142950261.000002282A601000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	dfsvc.exe, 00000002.00000002.2194293147.00000228445F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://en.w(Q	dfsvc.exe, 00000002.00000003.1456509327.00000228433C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://connect.screenconnect.com/Bin/ScreenConnect.Client.application?y=Guest&h=instance-qltwa7-rel	AXV12UXD.log.2.dr	false		high
https://connect.screenconnect.com/Bin/ScreenConnect.WindowsClient.exe	dfsvc.exe, 00000002.00000002.2142950261.000002282ACAE000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
145.40.105.166	server-nix317f89b6-web.screenconnect.com	Netherlands		34108	BREEDBANDDELFTNL	false

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	849197
Start date and time:	2023-04-18 20:45:27 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 64 bit version 1909 (MS Office 2019, IE 11, Chrome 104, Firefox 88, Adobe Reader DC 21, Java 8 u291, 7-Zip)
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	1
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	ConnectWiseControl.Client.exe
Detection:	SUS
Classification:	sus36.winEXE@3/8@6/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 8.248.115.254, 67.26.75.254, 8.253.95.249, 8.253.204.120, 67.27.158.126, 209.197.3.8
Excluded domains from analysis (whitelisted): client.wns.windows.com, fg.download.windowsupdate.com.c.footprint.net, login.live.com, slscr.update.microsoft.com, cacerts.digicert.com, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, wu-bg-shim.trafficmanager.net
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:46:03	API Interceptor	549x Sleep call for process: dfsvc.exe modified
20:46:03	API Interceptor	1x Sleep call for process: ConnectWiseControl.Client.exe modified

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 62582 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	62582
Entropy (8bit):	7.996063107774368
Encrypted:	true
SSDEEP:	1536:Jk3XPi43VgGp0gB2itudTSRAn/TWTdWftu:CHa43V5p022iZ4CgA
MD5:	E71C8443AE0BC2E282C73FAEAD0A6DD3
SHA1:	0C110C1B01E68EDFACAEAE64781A37B1995FA94B
SHA-256:	95B0A5ACC5BF70D3ABDFD091D0C9F9063AA4FDE65BD34DBF16786082E1992E72
SHA-512:	B38458C7FA2825AFB72794F374827403D5946B1132E136A0CE075DFD351277CF7D957C88DC8A1E4ADC3BCAE1FA8010DAE3831E268E910D517691DE24326391A6
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF....v.......,...................I.................BVrl .authroot.stl....oJ5..CK..8U....a..3.1.P. J.".t..2F2e.dHH......$E.KB.2D..-SJE....^..'..y.}..,{m.....\...]4.G.......h....148...e.gr.....48:.L...g.....Xef.x:..t...J...6-....kW6Z>....&......ye.U.Q&z:.vZ..._....a...]..T.E.....B.h.,...[....V.O.3..EW.x.?.Q..$.@.W..=.B.f..8a.Y.JK..g./%p..C.4CD.s..Jd.u..@.g=...a.. .h%..'.xjy7.E..\.....A..':.4TdW?Ko3$.Hg.z.d~....../q..C.....`...A[ W(.........9...GZ.;....l&?........F...p?... .p.....{S.L4..v.+...7.T?.....p..`..&..9.......f...0+.L.....1.2b)..vX5L'.~....2vz.,E.Ni.{#...o..w.?.#.3..h.v<.S%.].tD@!Le.w.q.7.8....QW.FT.....hE.........Y............./.%Q...k....Y.n..v.A..../...>B..5\..-Ko.......O<.b.K.{.O.b...._.7...4.;%9N..K.X>......kg-9..r.c.g.G\|.[.-...HT...",?.q...ad....7RE.......!f..#../....?.-.^.K.c^...+{.g......]<..$.=.O....ii7.wJ+S..Z..d.....>..J*...T..Q7..`.r,<$....\d:K`..T.n....N.....C..j.;.1SX..j....1...R....+....Yg....]....3..9..S..D..`.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	7.688784034406474
Encrypted:	false
SSDEEP:	24:nIGWnSIGWnSGc9VIyy0KuiUQ+7n0TCDZJCCAyuIqwmCFUZnPQ1LSdT:nIL7LJSRQ+QgAyuxwfynPQmR
MD5:	78F2FCAA601F2FB4EBC937BA532E7549
SHA1:	DDFB16CD4931C973A2037D3FC83A4D7D775D05E4
SHA-256:	552F7BDCF1A7AF9E6CE672017F4F12ABF77240C78E761AC203D1D9D20AC89988
SHA-512:	BCAD73A7A5AFB7120549DD54BA1F15C551AE24C7181F008392065D1ED006E6FA4FA5A60538D52461B15A12F5292049E929CFFDE15CC400DEC9CDFCA0B36A68DD
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0...0..x..........W..!2.9...wu\0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...130801120000Z..380115120000Z0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40.."0....H.............0..........sh..]J<0"0i3..%..!=..Y..).=X.v..{....0....8..V.m...y....._..<R.R....~...W.YUr.h.p..u.js2...D.......t;mq.-... .. .c)-..^N..!a.4...^.[......4@_.zf.w.H.fWW.TX..+.O.0.V..{]..O^.5.1..^......@.y.x...j.8.....7...}...>..p.U.A2...sn..\|!L....u]xf.:1D.3@...ZI...g.'..O9..X..$\F.d..i.v.v=Y]Bv...izH....f.t..K...c....:.=...E%...D.+~....am.3...K...}....!........p,A`..c.D..vb~.....d.3....C....w.....!..T)%.l..RQGt.&..Au.z._.?..A..[..P.1..r."..\|Lu?c.!_. Qko....O..E_. ........~.&...i/..-............B0@0...U.......0....0...U...........0...U..........q]dL..g?....O0....H..............a.}.l.........dh.V.w.p...J...x\.._...)V.6I]Dc...f.#.=y.mk.T..<.C@..P.R..;...ik.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1106395177888357
Encrypted:	false
SSDEEP:	6:kKy8Nry/7UN+SkQlPlEGYRMY9z+4KlDA3RUecZUt:XRCvkPlE99SNxAhUext
MD5:	EE96586F17F74C5E42F9955A6075FF43
SHA1:	D8F1CA1573598FAD9D22BA555EB42388E0F96FAD
SHA-256:	A5D88710A74D8F1074CAE3E09488A95BEAB0A29947E82F3E2524DA2359145E54
SHA-512:	76A1FA196EC7E8C61F260E674CDDE0E0C6DAA5086FEACEFF4D98F0874BD090C3939B43BFFCDE1BD906AE0700C59658A10F0651813DDE27FDED3B503A294728D5
Malicious:	false
Reputation:	low
Preview:	p...... ........c...>s..(....................................................... ..........).K......&...........v...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.d.2.f.9.2.9.a.7.4.b.d.9.1.:.0."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.0578008846792466
Encrypted:	false
SSDEEP:	6:kKskNLLDcJgjcalgRAOAUSW0PTKDXMOXISKlUp:EkNLLYS4tWOxSW0PAMsZp
MD5:	A72FA4B4F06DD1BC1571EB6EEDE37A1A
SHA1:	AC806D0FB07EED0BE2CA61D7AADDB99C106E196F
SHA-256:	066CD39446E19F18E5FE6D75F28FDD42949497DFA5C04EA6E0168042D11384E5
SHA-512:	6F6804B5EB1F3651BCF89965FA6BC3BA3AB7AD7B95FC64A142FF1B2E0735E4C8DB63290E432D59644CD26207AC813ED1AF053DC515F920CA1292DEBC3B75BDAD
Malicious:	false
Preview:	p...... ....l......];s..(....................................................... ............n......................h.t.t.p.:././.c.a.c.e.r.t.s...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.R.o.o.t.G.4...c.r.t...".5.a.2.8.6.4.1.7.-.5.9.4."...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QFX1KV1T\AXV12UXD.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (656), with CRLF line terminators
Category:	modified
Size (bytes):	12652
Entropy (8bit):	3.83156145161052
Encrypted:	false
SSDEEP:	96:tEBtdf0wt4vTZgmBpdf0wt4vTZeISaOy0l6df0wt4vTZri3c/yI8///YgrxOiUeB:OzCTZgmtzCTZlXzCTZWMKTye1j3n
MD5:	B6DEFAF1EA2C887EF2FF43D922E0DEB7
SHA1:	0F317DCA739141D6AEFFE5A370072CEE72A27A09
SHA-256:	77DDC32A82362A915D760F88DDE731B61F0CB129ABCF7393D6F07B647827AA54
SHA-512:	678499D0C57C8F185D17AF09C81A0A1F91378A011364BE977AAE433AC08F66C9EB3211088D896BDFE9EF604771F9EA6CDC5581B5CA9388FB72739C796EEE5346
Malicious:	false
Preview:	..P.L.A.T.F.O.R.M. .V.E.R.S.I.O.N. .I.N.F.O.......W.i.n.d.o.w.s. .......:. .1.0...0...1.8.3.6.3...0. .(.W.i.n.3.2.N.T.).......C.o.m.m.o.n. .L.a.n.g.u.a.g.e. .R.u.n.t.i.m.e. ...:. .4...0...3.0.3.1.9...4.2.0.0.0.......S.y.s.t.e.m...D.e.p.l.o.y.m.e.n.t...d.l.l. .....:. .4...8...3.7.5.2...0. .b.u.i.l.t. .b.y.:. .N.E.T.4.8.R.E.L.1.......c.l.r...d.l.l. .......:. .4...8...4.0.1.8...0. .b.u.i.l.t. .b.y.:. .N.E.T.4.8.R.E.L.1.L.A.S.T._.C.......d.f.d.l.l...d.l.l. .......:. .4...8...3.7.5.2...0. .b.u.i.l.t. .b.y.:. .N.E.T.4.8.R.E.L.1.......d.f.s.h.i.m...d.l.l. .......:. .1.0...0...1.8.3.6.2...1. .(.W.i.n.B.u.i.l.d...1.6.0.1.0.1...0.8.0.0.).........S.O.U.R.C.E.S.......D.e.p.l.o.y.m.e.n.t. .u.r.l.......:. .h.t.t.p.s.:././.c.o.n.n.e.c.t...s.c.r.e.e.n.c.o.n.n.e.c.t...c.o.m./.B.i.n./.S.c.r.e.e.n.C.o.n.n.e.c.t...C.l.i.e.n.t...a.p.p.l.i.c.a.t.i.o.n.?.y.=.G.u.e.s.t.&.h.=.i.n.s.t.a.n.c.e.-.q.l.t.w.a.7.-.r.e.l.a.y...s.c.r.e.e.n.c.o.n.n.e.c.t...c.o.m.&.p.=.4.4.3.&.s.=.9.3.b.2.b.3.3.c.-.7.d.a.5.-.4.a.a.c.-.9.

C:\Users\user\AppData\Local\Temp\Deployment\0GNZA0P7.GP0\GZMYT4PJ.TLZ\ScreenConnect.WindowsClient.exe.manifest

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (10073), with CRLF line terminators
Category:	dropped
Size (bytes):	17059
Entropy (8bit):	5.976059030468437
Encrypted:	false
SSDEEP:	192:oRKeB4K8C982tl7B9UFU468QX8s8oBHJ2218s8ovN8s8oTN2x2QPIlFDL4EDh7BY:zeBt8M82fLaf6NX9/X9FX9R/QPIYM7Y7
MD5:	9165412EE08839B9702BD4971864A133
SHA1:	A229E0582DC95272BC15ACD59B73B5B6C8C5ABCD
SHA-256:	6BB1C1AA5663AD33EDA2256037DA8E7439502C206D4C0047270A2FD1F006BB50
SHA-512:	7B84CE7685DACA320545EC6A0DD55E7F4D85BB53F58F8FEB163439CC06357E17CBB4E021DD957A7AF6287FE34B3379DB85DD452EBE118CE4023394D5A18A62E5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <asmv1:assemblyIdentity name="ScreenConnect.WindowsClient.exe" version="23.2.9.8466" publicKeyToken="25b0fbb6ef7eb094" language="neutral" processorArchitecture="msil" type="win32" />.. <application />.. <entryPoint>.. <assemblyIdentity name="ScreenConnect.WindowsClient" version="23.2.9.8466" publicKeyToken="4B14C015C87C1AD8" language="neutral" processorArchitecture="msil" />.. <commandLine file="ScreenConnect.WindowsClient.exe" parameter

C:\Users\user\AppData\Local\Temp\Deployment\V22DML8R.HV6\H7XARK6N.WM3.application

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (63849), with CRLF line terminators
Category:	dropped
Size (bytes):	147997
Entropy (8bit):	5.444247651158987
Encrypted:	false
SSDEEP:	3072:F+k0/nDw6APSIU6WV7WkrX/9yMidm2o9HuzhJOvP:slDw6AP6VCdmt8vOvP
MD5:	F1FFA28C9FB6D72CE24FAE50A5E75853
SHA1:	4C484FC1C671527494CF1E759B3648AA1A2839F7
SHA-256:	145DB2A5A3A2BB769D16C7C21B82ECDE4A740E8CD4084CC30F9876CB8578E59A
SHA-512:	244F0710D253A5C6C2C5EB8436AE32CE86A092ABE0002A5E5FF7266501A01CC3CFA5F6859584BC7563B5A3F76F2BB5D91E0BC47665936379DA9A6829B9FB694A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?><asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xrml="urn:mpeg:mpeg21:2003:01-REL-R-NS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <assemblyIdentity name="ScreenConnect.WindowsClient.application" version="23.2.9.8466" publicKeyToken="25b0fbb6ef7eb094" language="neutral" processorArchitecture="msil" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <description asmv2:publisher="ScreenConnect Software" asmv2:product="ScreenConnect Client" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <deployment install="false" trustURLParameters="tru

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2660496737-530772487-1027249058-1002\932a2db58c237abd381d22df4c63a04a_7ff3f708-074b-4ff4-b2c5-fe065076e0a1

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	87
Entropy (8bit):	3.463057265798253
Encrypted:	false
SSDEEP:	3:/lqlhGXKRjgjkFmURueGvx2VTUz:4DRPAx2Kz
MD5:	D2DED43CE07BFCE4D1C101DFCAA178C8
SHA1:	CE928A1293EA2ACA1AC01B61A344857786AFE509
SHA-256:	8EEE9284E733B9D4F2E5C43F71B81E27966F5CD8900183EB3BB77A1F1160D050
SHA-512:	A05486D523556C75FAAEEFE09BB2F8159A111B1B3560142E19048E6E3898A506EE4EA27DD6A4412EE56A7CE7C21E8152B1CDD92804BAF9FAC43973FABE006A2F
Malicious:	false
Preview:	......../...............................Microsoft Enhanced Cryptographic Provider v1.0.

CertCreateCertificateContext, CertDeleteCertificateFromStore, CertOpenSystemStoreA, CryptMsgClose, CertFreeCertificateContext, CertAddCertificateContextToStore, CryptQueryObject, CertCloseStore, CryptMsgGetParam

KERNEL32.dll

ReadFile, GetModuleFileNameW, SetFilePointer, LocalAlloc, CreateFileW, Sleep, LoadLibraryA, CloseHandle, GetProcAddress, LocalFree, WriteConsoleW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, RaiseException, GetStdHandle, WriteFile, GetModuleFileNameA, MultiByteToWideChar, WideCharToMultiByte, ExitProcess, GetModuleHandleExW, GetACP, HeapAlloc, HeapFree, FindClose, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, LCMapStringW, SetStdHandle, GetFileType, GetStringTypeW, GetProcessHeap, HeapSize, HeapReAlloc, FlushFileBuffers, GetConsoleCP, GetConsoleMode, SetFilePointerEx, DecodePointer

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 58
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2023 20:46:09.004134893 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:09.004214048 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:09.004337072 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:09.477523088 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:09.477587938 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:09.863102913 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:09.863241911 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:09.934554100 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:09.934617043 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:09.935560942 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:09.978310108 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.132814884 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.178845882 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.384036064 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.384114981 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.384145975 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.384232044 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.384233952 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.384283066 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.384311914 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.384340048 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.384349108 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.384349108 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.384397984 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.384429932 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.384466887 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.384500980 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.384550095 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.494482040 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.494517088 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.494612932 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.494672060 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.494703054 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.494728088 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.495017052 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.495086908 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.495124102 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.495145082 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.495201111 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.535217047 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.617742062 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.617829084 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.617902994 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.617945910 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.617971897 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.618000984 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.618041992 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.618100882 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.618211031 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.618228912 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.618248940 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.618349075 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.658773899 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.728943110 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.729010105 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.729088068 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.729136944 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.729176998 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.729254007 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.729288101 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.729314089 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.729346991 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.729365110 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.729408026 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.729427099 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.729477882 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.770581961 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.852241039 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.852257013 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.852312088 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.852389097 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.852421999 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.852456093 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.852474928 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.852612019 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.852648020 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.852673054 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.852683067 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.852709055 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.893556118 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.962882042 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.962985992 CEST	443	49731	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:12.963015079 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:12.963059902 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:13.014112949 CEST	49731	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:25.464968920 CEST	49734	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:25.465064049 CEST	443	49734	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:25.465174913 CEST	49734	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:25.465600967 CEST	49734	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:25.465634108 CEST	443	49734	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:25.719355106 CEST	443	49734	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:25.728100061 CEST	49734	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:25.728163958 CEST	443	49734	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:26.105290890 CEST	443	49734	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:26.105353117 CEST	443	49734	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:26.105396032 CEST	443	49734	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:26.105501890 CEST	49734	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:26.105549097 CEST	443	49734	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:26.105585098 CEST	49734	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:26.105633020 CEST	49734	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:26.105669022 CEST	443	49734	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:26.105730057 CEST	49734	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:26.105743885 CEST	443	49734	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:26.105786085 CEST	443	49734	145.40.105.166	192.168.2.3
Apr 18, 2023 20:46:26.105865002 CEST	49734	443	192.168.2.3	145.40.105.166
Apr 18, 2023 20:46:26.109262943 CEST	49734	443	192.168.2.3	145.40.105.166

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2023 20:46:08.799962997 CEST	49735	53	192.168.2.3	1.1.1.1
Apr 18, 2023 20:46:08.831942081 CEST	53	49735	1.1.1.1	192.168.2.3
Apr 18, 2023 20:46:08.861574888 CEST	60255	53	192.168.2.3	1.1.1.1
Apr 18, 2023 20:46:08.892779112 CEST	53	60255	1.1.1.1	192.168.2.3
Apr 18, 2023 20:46:25.377913952 CEST	61624	53	192.168.2.3	1.1.1.1
Apr 18, 2023 20:46:25.409537077 CEST	53	61624	1.1.1.1	192.168.2.3
Apr 18, 2023 20:46:25.431564093 CEST	56375	53	192.168.2.3	1.1.1.1
Apr 18, 2023 20:46:25.462487936 CEST	53	56375	1.1.1.1	192.168.2.3
Apr 18, 2023 20:47:02.429888964 CEST	59296	53	192.168.2.3	1.1.1.1
Apr 18, 2023 20:47:02.461617947 CEST	53	59296	1.1.1.1	192.168.2.3
Apr 18, 2023 20:47:02.465924978 CEST	61173	53	192.168.2.3	1.1.1.1
Apr 18, 2023 20:47:02.526011944 CEST	53	61173	1.1.1.1	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 18, 2023 20:46:08.799962997 CEST	192.168.2.3	1.1.1.1	0xc40	Standard query (0)	connect.screenconnect.com	A (IP address)	IN (0x0001)	false
Apr 18, 2023 20:46:08.861574888 CEST	192.168.2.3	1.1.1.1	0xc474	Standard query (0)	connect.screenconnect.com	A (IP address)	IN (0x0001)	false
Apr 18, 2023 20:46:25.377913952 CEST	192.168.2.3	1.1.1.1	0xfe77	Standard query (0)	connect.screenconnect.com	A (IP address)	IN (0x0001)	false
Apr 18, 2023 20:46:25.431564093 CEST	192.168.2.3	1.1.1.1	0x51f3	Standard query (0)	connect.screenconnect.com	A (IP address)	IN (0x0001)	false
Apr 18, 2023 20:47:02.429888964 CEST	192.168.2.3	1.1.1.1	0xed9b	Standard query (0)	connect.screenconnect.com	A (IP address)	IN (0x0001)	false
Apr 18, 2023 20:47:02.465924978 CEST	192.168.2.3	1.1.1.1	0xbd02	Standard query (0)	connect.screenconnect.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 18, 2023 20:46:08.831942081 CEST	1.1.1.1	192.168.2.3	0xc40	No error (0)	connect.screenconnect.com	server-nix317f89b6-web.screenconnect.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2023 20:46:08.831942081 CEST	1.1.1.1	192.168.2.3	0xc40	No error (0)	server-nix317f89b6-web.screenconnect.com		145.40.105.166	A (IP address)	IN (0x0001)	false
Apr 18, 2023 20:46:08.892779112 CEST	1.1.1.1	192.168.2.3	0xc474	No error (0)	connect.screenconnect.com	server-nix317f89b6-web.screenconnect.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2023 20:46:08.892779112 CEST	1.1.1.1	192.168.2.3	0xc474	No error (0)	server-nix317f89b6-web.screenconnect.com		145.40.105.166	A (IP address)	IN (0x0001)	false
Apr 18, 2023 20:46:25.409537077 CEST	1.1.1.1	192.168.2.3	0xfe77	No error (0)	connect.screenconnect.com	server-nix317f89b6-web.screenconnect.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2023 20:46:25.409537077 CEST	1.1.1.1	192.168.2.3	0xfe77	No error (0)	server-nix317f89b6-web.screenconnect.com		145.40.105.166	A (IP address)	IN (0x0001)	false
Apr 18, 2023 20:46:25.462487936 CEST	1.1.1.1	192.168.2.3	0x51f3	No error (0)	connect.screenconnect.com	server-nix317f89b6-web.screenconnect.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2023 20:46:25.462487936 CEST	1.1.1.1	192.168.2.3	0x51f3	No error (0)	server-nix317f89b6-web.screenconnect.com		145.40.105.166	A (IP address)	IN (0x0001)	false
Apr 18, 2023 20:46:30.577485085 CEST	1.1.1.1	192.168.2.3	0xba13	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2023 20:46:30.577485085 CEST	1.1.1.1	192.168.2.3	0xba13	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Apr 18, 2023 20:47:02.461617947 CEST	1.1.1.1	192.168.2.3	0xed9b	No error (0)	connect.screenconnect.com	server-nix317f89b6-web.screenconnect.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2023 20:47:02.461617947 CEST	1.1.1.1	192.168.2.3	0xed9b	No error (0)	server-nix317f89b6-web.screenconnect.com		145.40.105.166	A (IP address)	IN (0x0001)	false
Apr 18, 2023 20:47:02.526011944 CEST	1.1.1.1	192.168.2.3	0xbd02	No error (0)	connect.screenconnect.com	server-nix317f89b6-web.screenconnect.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2023 20:47:02.526011944 CEST	1.1.1.1	192.168.2.3	0xbd02	No error (0)	server-nix317f89b6-web.screenconnect.com		145.40.105.166	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

connect.screenconnect.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49731	145.40.105.166	443	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	kBytes transferred	Direction	Data
2023-04-18 18:46:12 UTC	0	OUT	GET /Bin/ScreenConnect.Client.application?y=Guest&h=instance-qltwa7-relay.screenconnect.com&p=443&s=93b2b33c-7da5-4aac-9916-c3c95fea3204&k=BgIAAACkAABSU0ExAAgAAAEAAQCZ4tmJR17udjp4gfURDoWxttb7TDFYTUaNOWp8sTqNE5iULGAJGZHKgQfhquB9LuVFW7czCACd4Ni5SZ8Yjsk8MupFz6XQ0KczPe%2fCsXb%2bTLdY74iLSjlGAMD3FbTuloLzTC1yZzOTA4RoxJ3evXvfO95BnnitC0aEEM5%2fuLvZVfYGjAlFmp%2fvtGOAReYR1Mum29ZbHydKTsL4Qbd6XmTxvXxLFrFn1UcO7ee3pF8HB4vh9GbkQ4WVRNbl5yAX1AcOjqehKoDJZT%2bVMbRAxwX4wfU%2fikm%2bEivRkZBsUzK66IzLTDyCkq8NTYyi82KdGBQ4Qc90HR6cESlKH32WNMW1&r=&i=Untitled%20Session HTTP/1.1 Host: connect.screenconnect.com Accept-Encoding: gzip Connection: Keep-Alive
2023-04-18 18:46:12 UTC	0	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 147997 Content-Type: application/x-ms-application; charset=utf-8 Server: ScreenConnect/23.2.9.8466-675837347 Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex Date: Tue, 18 Apr 2023 18:46:11 GMT Connection: close
2023-04-18 18:46:12 UTC	0	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 61 73 6d 76 31 3a 61 73 73 65 6d 62 6c 79 20 78 73 69 3a 73 63 68 65 6d 61 4c 6f 63 61 74 69 6f 6e 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 31 20 61 73 73 65 6d 62 6c 79 2e 61 64 61 70 74 69 76 65 2e 78 73 64 22 20 6d 61 6e 69 66 65 73 74 56 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 78 6d 6c 6e 73 3a 61 73 6d 76 31 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 31 22 20 78 6d 6c 6e 73 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 32 22 20 78 6d 6c 6e 73 3a 61 73 6d 76 32 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2=
2023-04-18 18:46:12 UTC	16	IN	Data Raw: 41 41 41 53 46 41 41 41 4c 32 49 41 41 4a 74 68 41 41 41 48 59 51 41 41 64 43 63 41 41 41 63 33 41 41 43 6a 46 51 41 41 53 6d 77 41 41 49 59 49 41 41 41 4c 51 67 41 41 48 6d 73 41 41 50 67 6e 41 41 42 75 57 41 41 41 50 32 67 41 41 4c 45 39 41 41 41 38 52 51 41 41 63 55 77 41 41 4d 5a 46 41 41 44 6a 4b 77 41 41 64 68 4d 41 41 50 41 4f 41 41 43 44 57 77 41 41 52 52 73 41 41 4e 42 6f 41 41 41 66 47 51 41 41 55 68 6b 41 41 45 4a 41 41 41 41 4a 4c 67 41 41 56 54 49 41 41 4e 30 38 41 41 43 49 4b 77 41 41 32 42 30 41 41 48 41 35 41 41 43 42 59 41 41 41 61 56 45 41 41 50 77 59 41 41 43 39 56 41 41 41 2b 47 38 41 41 48 77 50 41 41 44 46 45 67 41 41 7a 42 55 41 41 4b 38 36 41 41 41 37 42 77 41 41 5a 31 63 41 41 48 38 37 41 41 42 63 54 51 41 41 65 46 77 41 41 4e 35 Data Ascii: AAASFAAAL2IAAJthAAAHYQAAdCcAAAc3AACjFQAASmwAAIYIAAALQgAAHmsAAPgnAABuWAAAP2gAALE9AAA8RQAAcUwAAMZFAADjKwAAdhMAAPAOAACDWwAARRsAANBoAAAfGQAAUhkAAEJAAAAJLgAAVTIAAN08AACIKwAA2B0AAHA5AACBYAAAaVEAAPwYAAC9VAAA+G8AAHwPAADFEgAAzBUAAK86AAA7BwAAZ1cAAH87AABcTQAAeFwAAN5
2023-04-18 18:46:12 UTC	29	IN	Data Raw: 41 61 41 42 68 41 48 49 41 61 51 42 75 41 47 63 41 56 41 42 70 41 48 51 41 62 41 42 6c 41 46 30 4c 41 41 42 4f 51 77 42 76 41 47 34 41 64 41 42 79 41 47 38 41 62 41 42 51 41 47 45 41 62 67 42 6c 41 47 77 41 51 77 42 73 41 47 55 41 59 51 42 79 41 45 45 41 62 67 42 75 41 47 38 41 64 41 42 68 41 48 51 41 61 51 42 76 41 47 34 41 63 77 42 45 41 47 55 41 63 77 42 6a 41 48 49 41 61 51 42 77 41 48 51 41 61 51 42 76 41 47 34 41 62 51 73 41 41 45 4a 44 41 47 38 41 62 67 42 30 41 48 49 41 62 77 42 73 41 46 41 41 59 51 42 75 41 47 55 41 62 41 42 44 41 47 77 41 5a 51 42 68 41 48 49 41 51 51 42 75 41 47 34 41 62 77 42 30 41 47 45 41 64 41 42 70 41 47 38 41 62 67 42 7a 41 46 51 41 61 51 42 30 41 47 77 41 5a 51 43 61 43 77 41 41 56 45 4d 41 62 77 42 75 41 48 51 41 63 67 Data Ascii: AaABhAHIAaQBuAGcAVABpAHQAbABlAF0LAABOQwBvAG4AdAByAG8AbABQAGEAbgBlAGwAQwBsAGUAYQByAEEAbgBuAG8AdABhAHQAaQBvAG4AcwBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AbQsAAEJDAG8AbgB0AHIAbwBsAFAAYQBuAGUAbABDAGwAZQBhAHIAQQBuAG4AbwB0AGEAdABpAG8AbgBzAFQAaQB0AGwAZQCaCwAAVEMAbwBuAHQAcg
2023-04-18 18:46:12 UTC	45	IN	Data Raw: 74 41 47 6b 41 63 77 42 7a 41 47 6b 41 62 77 42 75 41 45 63 41 63 67 42 68 41 47 34 41 64 41 42 4a 41 47 34 41 63 77 42 30 41 48 49 41 64 51 42 6a 41 48 51 41 61 51 42 76 41 47 34 41 63 77 42 4d 41 47 6b 41 63 77 42 30 41 45 59 41 62 77 42 79 41 47 30 41 59 51 42 30 41 45 4d 41 59 51 42 75 41 47 34 41 62 77 42 30 41 46 51 41 63 67 42 70 41 47 63 41 5a 77 42 6c 41 48 49 41 55 41 42 79 41 47 38 41 62 51 42 77 41 48 51 41 5a 53 59 41 41 4d 34 42 54 51 42 68 41 47 4d 41 51 77 42 68 41 48 51 41 59 51 42 73 41 47 6b 41 62 67 42 68 41 46 49 41 5a 51 42 32 41 47 6b 41 5a 51 42 33 41 46 4d 41 65 51 42 7a 41 48 51 41 5a 51 42 74 41 45 45 41 59 77 42 6a 41 47 55 41 63 77 42 7a 41 45 51 41 61 51 42 68 41 47 77 41 62 77 42 6e 41 46 4d 41 59 77 42 79 41 47 55 41 5a 51 Data Ascii: tAGkAcwBzAGkAbwBuAEcAcgBhAG4AdABJAG4AcwB0AHIAdQBjAHQAaQBvAG4AcwBMAGkAcwB0AEYAbwByAG0AYQB0AEMAYQBuAG4AbwB0AFQAcgBpAGcAZwBlAHIAUAByAG8AbQBwAHQAZSYAAM4BTQBhAGMAQwBhAHQAYQBsAGkAbgBhAFIAZQB2AGkAZQB3AFMAeQBzAHQAZQBtAEEAYwBjAGUAcwBzAEQAaQBhAGwAbwBnAFMAYwByAGUAZQ
2023-04-18 18:46:12 UTC	57	IN	Data Raw: 67 64 32 39 31 62 47 51 67 65 57 39 31 49 47 78 70 61 32 55 67 64 47 38 67 5a 47 38 2f 41 52 68 45 62 32 34 6e 64 43 42 46 62 6d 46 69 62 47 55 67 64 47 68 6c 49 45 5a 6c 59 58 52 31 63 6d 55 42 47 46 64 70 62 6d 52 76 64 33 4d 67 52 6d 56 68 64 48 56 79 5a 53 42 53 5a 58 46 31 61 58 4a 6c 5a 41 45 53 52 57 35 68 59 6d 78 6c 49 48 52 6f 5a 53 42 47 5a 57 46 30 64 58 4a 6c 41 51 56 4d 59 58 4e 7a 62 77 45 45 54 6d 39 75 5a 51 45 52 55 32 56 73 5a 57 4e 30 49 45 31 76 62 6d 6c 30 62 33 49 6f 63 79 6b 42 42 45 68 70 5a 32 67 42 41 30 78 76 64 77 45 47 54 57 56 6b 61 58 56 74 41 51 78 42 62 47 77 67 55 48 4a 70 62 6e 52 6c 63 6e 4d 42 44 30 52 6c 5a 6d 46 31 62 48 51 67 55 48 4a 70 62 6e 52 6c 63 67 45 4b 54 6d 38 67 55 48 4a 70 62 6e 52 6c 63 67 45 49 51 57 Data Ascii: gd291bGQgeW91IGxpa2UgdG8gZG8/ARhEb24ndCBFbmFibGUgdGhlIEZlYXR1cmUBGFdpbmRvd3MgRmVhdHVyZSBSZXF1aXJlZAESRW5hYmxlIHRoZSBGZWF0dXJlAQVMYXNzbwEETm9uZQERU2VsZWN0IE1vbml0b3IocykBBEhpZ2gBA0xvdwEGTWVkaXVtAQxBbGwgUHJpbnRlcnMBD0RlZmF1bHQgUHJpbnRlcgEKTm8gUHJpbnRlcgEIQW
2023-04-18 18:46:12 UTC	73	IN	Data Raw: 67 50 48 41 67 63 33 52 35 62 47 55 39 49 6d 5a 76 62 6e 51 74 63 32 6c 36 5a 54 6f 67 4d 54 4a 77 65 44 73 69 50 6e 73 77 66 53 42 79 5a 58 46 31 61 58 4a 6c 63 79 42 68 49 48 4a 6c 64 6d 6c 6c 64 79 42 76 5a 69 42 30 61 47 55 67 5a 6d 39 73 62 47 39 33 61 57 35 6e 49 48 42 6c 63 6d 31 70 63 33 4e 70 62 32 35 7a 4f 6a 77 76 63 44 34 4e 43 6a 77 76 59 6d 39 6b 65 54 34 4e 43 6a 77 76 61 48 52 74 62 44 34 4e 43 67 45 57 56 48 6c 77 5a 53 42 35 62 33 56 79 49 47 31 6c 63 33 4e 68 5a 32 55 67 61 47 56 79 5a 51 45 51 65 7a 42 39 49 47 6c 7a 49 48 52 35 63 47 6c 75 5a 79 34 75 4c 67 45 33 51 57 52 74 61 57 35 70 63 33 52 79 59 58 52 70 64 6d 55 67 54 47 39 6e 62 32 34 67 61 47 46 7a 49 47 4a 6c 5a 57 34 67 63 6d 56 78 64 57 56 7a 64 47 56 6b 49 47 5a 76 63 69 Data Ascii: gPHAgc3R5bGU9ImZvbnQtc2l6ZTogMTJweDsiPnswfSByZXF1aXJlcyBhIHJldmlldyBvZiB0aGUgZm9sbG93aW5nIHBlcm1pc3Npb25zOjwvcD4NCjwvYm9keT4NCjwvaHRtbD4NCgEWVHlwZSB5b3VyIG1lc3NhZ2UgaGVyZQEQezB9IGlzIHR5cGluZy4uLgE3QWRtaW5pc3RyYXRpdmUgTG9nb24gaGFzIGJlZW4gcmVxdWVzdGVkIGZvci
2023-04-18 18:46:12 UTC	85	IN	Data Raw: 4e 64 6e 35 55 39 61 62 54 77 47 76 66 49 54 42 53 78 72 79 76 49 57 4f 67 7a 58 4b 4f 62 58 78 4a 79 2f 33 51 49 76 38 72 34 49 78 64 70 4b 65 74 4f 59 50 65 59 50 31 6a 45 66 4f 4a 48 2f 58 41 68 63 43 67 41 67 4d 57 4a 35 73 47 2f 50 6e 5a 51 6a 48 2f 71 55 38 41 4c 67 56 61 50 34 76 59 4d 55 48 79 69 4b 36 55 59 70 7a 6f 67 59 43 43 51 49 39 6f 4d 6d 59 6e 6d 51 33 38 38 70 57 51 38 45 51 41 69 73 4a 6c 66 38 4f 34 2b 6a 73 6e 43 4e 7a 31 41 68 34 62 38 68 71 41 47 39 46 33 6b 37 7a 62 32 33 37 38 66 42 4e 67 78 32 4a 56 68 6a 74 37 41 48 2b 31 38 31 6a 6b 71 57 42 63 75 77 4f 35 42 51 44 55 56 7a 74 77 79 4a 4a 44 42 50 66 32 5a 41 2f 2b 6e 55 72 50 30 64 69 54 6e 65 69 35 53 75 58 34 37 34 72 52 32 51 4e 6f 2b 74 50 59 32 39 76 62 48 44 57 4b 41 74 Data Ascii: Ndn5U9abTwGvfITBSxryvIWOgzXKObXxJy/3QIv8r4IxdpKetOYPeYP1jEfOJH/XAhcCgAgMWJ5sG/PnZQjH/qU8ALgVaP4vYMUHyiK6UYpzogYCCQI9oMmYnmQ388pWQ8EQAisJlf8O4+jsnCNz1Ah4b8hqAG9F3k7zb2378fBNgx2JVhjt7AH+181jkqWBcuwO5BQDUVztwyJJDBPf2ZA/+nUrP0diTnei5SuX474rR2QNo+tPY29vbHDWKAt
2023-04-18 18:46:12 UTC	101	IN	Data Raw: 63 33 45 48 6c 33 4e 77 43 35 64 7a 63 41 4f 58 63 33 43 54 6c 33 4e 79 63 35 64 7a 63 30 2b 58 63 33 4e 37 6c 33 4e 78 71 35 64 7a 63 42 2b 58 63 33 41 7a 6c 33 4e 78 31 35 64 7a 63 38 4f 58 63 33 50 2f 6c 33 4e 7a 2b 35 64 7a 63 35 4f 58 63 33 48 54 6c 33 4e 77 4d 35 64 7a 63 41 41 41 41 41 41 44 6c 33 4e 77 47 35 64 7a 63 62 65 58 63 33 4e 6a 6c 33 4e 7a 37 35 64 7a 63 2f 2b 58 63 33 50 72 6c 33 4e 79 6d 35 64 7a 63 4d 75 58 63 33 42 50 6c 33 4e 78 73 35 64 7a 63 63 75 58 63 33 44 6a 6c 33 4e 77 56 35 64 7a 63 41 75 58 63 33 41 44 6c 33 4e 77 41 35 64 7a 63 41 65 58 63 33 41 33 6c 33 4e 77 74 35 64 7a 63 58 75 58 63 33 48 62 6c 33 4e 77 59 35 64 7a 63 4a 65 58 63 33 49 2f 6c 33 4e 7a 7a 35 64 7a 63 2f 2b 58 63 33 50 33 6c 33 4e 7a 6c 35 64 7a 63 67 2b Data Ascii: c3EHl3NwC5dzcAOXc3CTl3Nyc5dzc0+Xc3N7l3Nxq5dzcB+Xc3Azl3Nx15dzc8OXc3P/l3Nz+5dzc5OXc3HTl3NwM5dzcAAAAAADl3NwG5dzcbeXc3Njl3Nz75dzc/+Xc3Prl3Nym5dzcMuXc3BPl3Nxs5dzccuXc3Djl3NwV5dzcAuXc3ADl3NwA5dzcAeXc3A3l3Nwt5dzcXuXc3Hbl3NwY5dzcJeXc3I/l3Nzz5dzc/+Xc3P3l3Nzl5dzcg+
2023-04-18 18:46:12 UTC	113	IN	Data Raw: 41 41 41 41 4d 41 42 41 77 41 41 41 47 67 53 2f 6b 51 41 41 41 41 47 55 45 78 55 52 63 77 79 4d 76 2f 2f 2f 30 49 77 6d 74 34 41 41 41 41 2b 53 55 52 42 56 46 6a 44 37 64 4b 37 44 51 41 67 44 4d 54 51 32 34 44 39 74 38 77 47 6f 65 4d 6a 6c 44 70 49 5a 37 65 76 74 59 6a 6f 69 30 61 65 41 58 33 77 42 74 53 51 56 77 46 59 51 4b 77 52 41 41 44 77 41 41 6d 6f 59 51 64 34 41 42 48 31 4e 51 46 39 39 2b 50 4e 6d 44 41 59 4c 77 41 41 41 41 42 4a 52 55 35 45 72 6b 4a 67 67 69 42 70 41 41 41 41 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 42 41 41 41 41 41 51 43 41 41 41 41 41 41 36 6d 4b 43 39 41 41 41 41 41 6e 52 53 54 6c 4d 41 41 48 61 54 7a 54 67 41 41 41 41 69 53 55 52 42 56 48 6a 61 59 32 41 67 43 76 78 48 41 42 77 43 53 45 70 52 Data Ascii: AAAAMABAwAAAGgS/kQAAAAGUExURcwyMv///0Iwmt4AAAA+SURBVFjD7dK7DQAgDMTQ24D9t8wGoeMjlDpIZ7evtYjoi0aeAX3wBtSQVwFYQKwRAADwAAmoYQd4ABH1NQF99+PNmDAYLwAAAABJRU5ErkJggiBpAAAAiVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAAAAAA6mKC9AAAAAnRSTlMAAHaTzTgAAAAiSURBVHjaY2AgCvxHABwCSEpR
2023-04-18 18:46:12 UTC	129	IN	Data Raw: 6c 57 44 54 75 73 61 5a 78 50 7a 65 59 32 37 44 74 64 52 32 67 76 67 38 76 6f 37 36 30 56 6f 57 71 41 42 46 4b 6f 47 76 56 70 56 4f 5a 75 59 41 52 79 4d 41 73 38 54 77 46 6c 2b 43 63 36 68 43 4d 30 4d 4d 49 41 52 72 55 48 58 50 69 67 64 54 64 54 71 67 4d 4d 61 74 4d 6b 41 31 6d 71 48 44 6f 76 51 73 31 79 41 41 59 78 6b 44 56 71 68 2b 30 72 6a 61 49 4a 52 34 50 73 45 73 49 4d 79 64 46 69 45 33 75 41 43 44 47 44 30 61 74 42 71 31 39 38 6a 37 5a 67 76 35 4c 36 2f 64 5a 52 47 41 31 69 70 44 42 30 57 6f 65 39 77 41 51 59 77 63 6a 56 6f 76 65 76 76 6b 56 62 55 6c 39 49 5a 42 56 34 67 67 44 30 6b 63 46 69 45 6e 75 4d 43 44 47 43 30 61 74 43 61 31 39 2f 6f 41 54 7a 76 62 68 54 59 62 67 43 58 39 35 53 4c 30 46 39 38 7a 67 55 59 51 48 5a 56 50 38 33 50 69 65 37 4a Data Ascii: lWDTusaZxPzeY27DtdR2gvg8vo760VoWqABFKoGvVpVOZuYARyMAs8TwFl+Cc6hCM0MMIARrUHXPigdTdTqgMMatMkA1mqHDovQs1yAAYxkDVqh+0rjaIJR4PsEsIMydFiE3uACDGD0atBq198j7Zgv5L6/dZRGA1ipDB0Woe9wAQYwcjVovevvkVbUl9IZBV4ggD0kcFiEnuMCDGC0atCa19/oATzvbhTYbgCX95SL0F98zgUYQHZVP83Pie7J
2023-04-18 18:46:12 UTC	141	IN	Data Raw: 44 53 4f 70 56 34 41 50 7a 51 49 43 77 41 42 6e 4b 73 56 61 51 78 74 77 41 5a 68 41 51 68 67 72 55 67 70 4b 2f 46 74 77 4f 5a 77 41 41 68 67 56 2b 44 69 62 63 41 50 6f 67 4c 34 70 54 4d 4b 49 49 41 62 71 2b 42 69 34 4c 6e 34 4e 6d 42 7a 4f 41 41 45 73 47 6b 63 46 62 51 42 6d 38 4d 42 49 49 42 4e 34 39 41 47 44 49 41 41 72 75 45 30 6a 6a 46 73 41 7a 35 30 52 41 45 45 73 43 74 77 34 57 33 41 32 6f 41 42 45 4d 41 68 56 2b 41 39 62 63 41 41 43 4f 42 36 74 69 49 74 61 41 4d 47 51 41 44 6e 6e 38 59 78 68 6d 33 41 54 78 78 52 41 41 48 73 43 6e 79 33 31 56 37 2b 7a 6d 73 44 42 6b 41 41 35 37 6f 43 32 77 59 4d 67 41 41 65 77 7a 53 4f 56 46 6f 75 39 67 4a 34 58 78 63 53 41 41 49 34 31 30 44 4b 70 66 67 32 34 4b 64 4f 4b 49 41 41 31 6f 71 55 6d 4d 61 78 33 77 76 67 Data Ascii: DSOpV4APzQICwABnKsVaQxtwAZhAQhgrUgpK/FtwOZwAAhgV+DibcAPogL4pTMKIIAbq+Bi4Ln4NmBzOAAEsGkcFbQBm8MBIIBN49AGDIAAruE0jjFsAz50RAEEsCtw4W3A2oABEMAhV+A9bcAACOB6tiItaAMGQADnn8Yxhm3ATxxRAAHsCny31V7+zmsDBkAA57oC2wYMgAAewzSOVFou9gJ4XxcSAAI410DKpfg24KdOKIAA1oqUmMax3wvg

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49734	145.40.105.166	443	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	kBytes transferred	Direction	Data
2023-04-18 18:46:25 UTC	145	OUT	GET /Bin/ScreenConnect.Client.manifest HTTP/1.1 Host: connect.screenconnect.com Accept-Encoding: gzip
2023-04-18 18:46:26 UTC	145	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 17059 Content-Type: text/html Server: ScreenConnect/23.2.9.8466-675837347 Microsoft-HTTPAPI/2.0 X-Robots-Tag: noindex Date: Tue, 18 Apr 2023 18:46:25 GMT Connection: close
2023-04-18 18:46:26 UTC	145	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 61 73 6d 76 31 3a 61 73 73 65 6d 62 6c 79 20 78 73 69 3a 73 63 68 65 6d 61 4c 6f 63 61 74 69 6f 6e 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 31 20 61 73 73 65 6d 62 6c 79 2e 61 64 61 70 74 69 76 65 2e 78 73 64 22 20 6d 61 6e 69 66 65 73 74 56 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 78 6d 6c 6e 73 3a 61 73 6d 76 31 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 31 22 20 78 6d 6c 6e 73 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 32 22 20 78 6d 6c 6e 73 3a 61 73 6d 76 Data Ascii: <?xml version="1.0" encoding="utf-8"?><asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv
2023-04-18 18:46:26 UTC	161	IN	Data Raw: 30 52 70 5a 32 6c 44 5a 58 4a 30 56 48 4a 31 63 33 52 6c 5a 46 4a 76 62 33 52 48 4e 43 35 6a 63 6d 77 77 48 41 59 44 56 52 30 67 42 42 55 77 45 7a 41 48 42 67 56 6e 67 51 77 42 41 7a 41 49 42 67 5a 6e 67 51 77 42 42 41 45 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 4d 42 51 41 44 67 67 49 42 41 44 6f 6a 52 44 32 4e 43 48 62 75 6a 37 77 36 6d 64 4e 57 34 41 49 61 70 66 68 49 4e 50 4d 73 74 75 5a 30 5a 76 65 55 63 72 45 41 79 71 39 73 4d 43 63 54 45 70 36 51 52 4a 39 4c 2f 5a 36 6a 66 43 62 56 4e 37 77 36 58 55 68 74 6c 64 55 2f 53 66 51 6e 75 78 61 42 52 56 44 39 6e 4c 32 32 68 65 42 32 66 6a 64 78 79 79 4c 33 57 71 71 51 7a 2f 57 54 61 75 50 72 49 4e 48 56 55 48 6d 49 6d 6f 71 4b 77 62 61 39 6f 55 67 59 66 74 7a 59 67 42 6f 52 47 52 6a 4e 59 5a 6d 42 Data Ascii: 0RpZ2lDZXJ0VHJ1c3RlZFJvb3RHNC5jcmwwHAYDVR0gBBUwEzAHBgVngQwBAzAIBgZngQwBBAEwDQYJKoZIhvcNAQEMBQADggIBADojRD2NCHbuj7w6mdNW4AIapfhINPMstuZ0ZveUcrEAyq9sMCcTEp6QRJ9L/Z6jfCbVN7w6XUhtldU/SfQnuxaBRVD9nL22heB2fjdxyyL3WqqQz/WTauPrINHVUHmImoqKwba9oUgYftzYgBoRGRjNYZmB

Statistics

Click to jump to process

Memory Usage

• ConnectWiseControl.Client.exe
• dfsvc.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry
• Network

Click to dive into process behavior distribution

Behavior

• ConnectWiseControl.Client.exe
• dfsvc.exe

Click to jump to process

Target ID:	1
Start time:	20:46:02
Start date:	18/04/2023
Path:	C:\Users\user\Desktop\ConnectWiseControl.Client.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\ConnectWiseControl.Client.exe
Imagebase:	0xf60000
File size:	86288 bytes
MD5 hash:	DBAC4578027BB4FD75AC8B10312157D0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	2
Start time:	20:46:02
Start date:	18/04/2023
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
Imagebase:	0x228288b0000
File size:	24112 bytes
MD5 hash:	60C91843ADCE3750F2A0835F0594D438
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	20.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	0

Show Legend

Hide Nodes/Edges

Executed Functions

Function 00007FFF61E515E2 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateUrlCacheEntryW.WININET ref: 00007FFF61E94353

Strings

u(@, xrefs: 00007FFF61E941D8
u(@, xrefs: 00007FFF61E943D0

Memory Dump Source

Source File: 00000002.00000002.2211209888.00007FFF61E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF61E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7fff61e50000_dfsvc.jbxd

Similarity

API ID: CacheCreateEntry
String ID: u(@$u(@
API String ID: 3741994674-43446500
Opcode ID: 9d649600cdf0858b9af93f02cb6d4f4c89912d16474906e38d7f4c39322e53d1
Instruction ID: 02780a246fa33252a626acba72f0ca653d4a0f4d76e8b09cfcf7746bd375be6f
Opcode Fuzzy Hash: 9d649600cdf0858b9af93f02cb6d4f4c89912d16474906e38d7f4c39322e53d1
Instruction Fuzzy Hash: 00819030918A4D8FEBA8EF18D8457E977D0FF68710F50462AE85DC7292CF74E9858B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF61E51754 Relevance: 1.6, APIs: 1, Instructions: 131
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32 ref: 00007FFF61E51827

Memory Dump Source

Source File: 00000002.00000002.2211209888.00007FFF61E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF61E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7fff61e50000_dfsvc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 862ea0869ec3811fb804bf9dd11781cd60fc8eb3f6925d91a2339f768371be43
Instruction ID: 1d0168c94e8e3fd41efe08fb0e6ff586c227ceffa2932280aa1bc24de3ab01f7
Opcode Fuzzy Hash: 862ea0869ec3811fb804bf9dd11781cd60fc8eb3f6925d91a2339f768371be43
Instruction Fuzzy Hash: AD41D231D0CA5C8FDB58DF688849AE9BBF1EFA5320F04426FD049D3252DF74A8068B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF61E515B2 Relevance: 1.6, APIs: 1, Instructions: 102
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32 ref: 00007FFF61E51827

Memory Dump Source

Source File: 00000002.00000002.2211209888.00007FFF61E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF61E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7fff61e50000_dfsvc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 911f0a6e543670718d03c8671da8cae96ba97433412db4b8e3a50df95b10b157
Instruction ID: 59f0da8f595859106bedd457bcd4d2fcac3e54d36ec16fa84e3c16de819cd965
Opcode Fuzzy Hash: 911f0a6e543670718d03c8671da8cae96ba97433412db4b8e3a50df95b10b157
Instruction Fuzzy Hash: 8A215E71D08A1C9FDB58DF9CC849AE9BBE1EB69321F04422ED00AD3651DB71A8568B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF61E51492 Relevance: 1.6, APIs: 1, Instructions: 102
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32 ref: 00007FFF61E51827

Memory Dump Source

Source File: 00000002.00000002.2211209888.00007FFF61E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF61E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7fff61e50000_dfsvc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 911f0a6e543670718d03c8671da8cae96ba97433412db4b8e3a50df95b10b157
Instruction ID: 59f0da8f595859106bedd457bcd4d2fcac3e54d36ec16fa84e3c16de819cd965
Opcode Fuzzy Hash: 911f0a6e543670718d03c8671da8cae96ba97433412db4b8e3a50df95b10b157
Instruction Fuzzy Hash: 8A215E71D08A1C9FDB58DF9CC849AE9BBE1EB69321F04422ED00AD3651DB71A8568B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF61E59AC3 Relevance: 1.6, APIs: 1, Instructions: 82
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 00007FFF61E59B3C

Memory Dump Source

Source File: 00000002.00000002.2211209888.00007FFF61E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF61E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7fff61e50000_dfsvc.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6d544a4748073a66bfc561b9c52fbb04b988157a2a22532ba6ddfb8f0ce42066
Instruction ID: b4718bab8c8f70a9908e8ba97e7ec92d5c6b785c532c53d0fac439631e925529
Opcode Fuzzy Hash: 6d544a4748073a66bfc561b9c52fbb04b988157a2a22532ba6ddfb8f0ce42066
Instruction Fuzzy Hash: AF216D70A0CA588FDB98DF5CE445BA8BBE0FB59324F14429EE04ED3252CB35A951CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF61D3ED57 Relevance: 1.3, Strings: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

u(@, xrefs: 00007FFF61D3ED76

Memory Dump Source

Source File: 00000002.00000002.2209880856.00007FFF61D3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF61D3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7fff61d3d000_dfsvc.jbxd

Similarity

API ID:
String ID: u(@
API String ID: 0-4105956338
Opcode ID: 082db7402410b2ed7cc7fc32956e9e2376b92e60c46970a730e79f7e14a15a0a
Instruction ID: 4f09df3064e568a0c34a8510b18d77970e1205d028ce813bb343234b8f712eae
Opcode Fuzzy Hash: 082db7402410b2ed7cc7fc32956e9e2376b92e60c46970a730e79f7e14a15a0a
Instruction Fuzzy Hash: A5110A3190CF088F9BA8EF1EE48595677E1FB98320B10065BD459C7666DA31E891CB82

Uniqueness

Uniqueness Score: -1.00%

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BREEDBANDDELFTNL	ConnectWiseControl.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	145.40.105.158
	ConnectWiseControl.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	145.40.105.158
	zYKmzRjmtw.elf	Get hash	malicious	Mirai, Moobot	Browse	145.36.198.129
	KFpUnuhUHp.elf	Get hash	malicious	Unknown	Browse	145.41.61.212
	dGCnwOnxb1.elf	Get hash	malicious	IPStorm	Browse	145.40.65.77
	B0MdnLnOIa.elf	Get hash	malicious	IPStorm	Browse	145.40.65.77
	suO9QdfkQa.elf	Get hash	malicious	Mirai	Browse	145.32.114.166
	zMxKF1sZ6K.dll	Get hash	malicious	Wannacry	Browse	145.42.171.136
	GyKpRhKQY1.elf	Get hash	malicious	Mirai	Browse	145.36.25.204
	fz0voW3Wbv.elf	Get hash	malicious	Mirai	Browse	145.43.169.167
	ascaris.arm7.elf	Get hash	malicious	Mirai	Browse	145.32.231.0
	ascaris.arm5.elf	Get hash	malicious	Mirai	Browse	145.32.249.109
	j0H36jpoaP.elf	Get hash	malicious	Mirai	Browse	145.43.210.112
	hJINC2WsSz.elf	Get hash	malicious	Unknown	Browse	145.41.118.160
	SecuriteInfo.com.Linux.Siggen.9999.8884.7030.elf	Get hash	malicious	Mirai	Browse	145.40.82.200
	1kTl1FqLU2	Get hash	malicious	Mirai	Browse	145.41.224.146
	https://apmgj-vqaaa-aaaad-qdona-cai.raw.ic0.app/	Get hash	malicious	Unknown	Browse	145.40.97.98
	qzUm7aiIni	Get hash	malicious	Mirai	Browse	145.41.118.139
	https://xdqnp-xiaaa-aaaad-qdkma-cai.ic0.app/	Get hash	malicious	Unknown	Browse	145.40.68.46
	https://xdqnp-xiaaa-aaaad-qdkma-cai.ic0.app/	Get hash	malicious	Unknown	Browse	145.40.68.46

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.365735980719454
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ConnectWiseControl.Client.exe
File size:	86288
MD5:	dbac4578027bb4fd75ac8b10312157d0
SHA1:	f26b77dc1657cdb4ee10177d3e6c7c5c52726568
SHA256:	22ed0ca25db71cef62ab471c12ee0989c18a326dbc9b4e5518cfcd9678863bd3
SHA512:	fa5dfc0cb16cc300dac0ee01845d135036353eaf4ffbbce5f2a12533680cd37d6f5432106e11e3b6238d4debac01152eb4a4a88cd458343aac6a1d3b604ee8ce
SSDEEP:	1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3s/:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3K
TLSH:	C0835B13B5D18475E8B20E3118B1D9F4993F7E114E648EAB2398427E0F351D1AE3AE7B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ll..-...-...-..Q....-..Q....-..Q....-..eV...-..eV...-..eV...-...U...-...-...-..kV...-..kV...-..kV...-..Rich.-.................

Entrypoint:	0x4014ba
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6377E339 [Fri Nov 18 19:55:37 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	7631a79a9071099fa4803e1c4c5df207

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	8/17/2022 2:00:00 AM 8/16/2025 1:59:59 AM
Subject Chain	CN="Connectwise, LLC", O="Connectwise, LLC", L=Tampa, S=Florida, C=US
Version:	3
Thumbprint MD5:	AAE704EC2810686C3BF7704E660AFB5D
Thumbprint SHA-1:	4C2272FBA7A7380F55E2A424E9E624AEE1C14579
Thumbprint SHA-256:	82B4E7924D5BED84FB16DDF8391936EB301479CEC707DC14E23BC22B8CDEAE28
Serial:	0B9360051BCCF66642998998D5BA97CE

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9d38	0x9e00	False	0.6047270569620253	data	6.5891945477373035	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb000	0x5d82	0x5e00	False	0.4187998670212766	OpenPGP Secret Key	4.852409164250541	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x11000	0x118c	0x800	False	0.16357421875	data	1.9966704570134595	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x13000	0x1e0	0x200	False	0.52734375	data	4.703723272345726	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x14000	0xde0	0xe00	False	0.7806919642857143	data	6.505236561547605	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	7lNejSq0Ny.exe	Get hash	malicious	Nymaim	Browse	192.229.221.95
	7lNejSq0Ny.exe	Get hash	malicious	Nymaim	Browse	192.229.221.95
	http://download.winzip.com/tools/winzip/releases/242f4cc2-7a84-474e-b7b5-58b72fdd356f_2.9.0.24/or/0/SmartAlertsSetup.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	fe1b82d8fada96c0ebe4429000c600ff88c19a55340a9.exe	Get hash	malicious	Nymaim	Browse	192.229.221.95
	fe1b82d8fada96c0ebe4429000c600ff88c19a55340a9.exe	Get hash	malicious	Nymaim	Browse	192.229.221.95
	O3HGI3KLlF.exe	Get hash	malicious	CryptbotV2, MinerDownloader, Nymaim, RedLine, Xmrig	Browse	192.229.221.95
	30wjeyzPn0.dll	Get hash	malicious	Unknown	Browse	192.229.221.95
	ConnectWiseControl.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	192.229.221.95
	ConnectWiseControl.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	192.229.221.95
	N6bBAm4wjg.exe	Get hash	malicious	CryptbotV2, MinerDownloader, Nymaim, RedLine, Xmrig	Browse	192.229.221.95
	setup.exe	Get hash	malicious	SmokeLoader	Browse	192.229.221.95
	http://go.onelink.me/107872968?pid=InProduct&c=Global_Internal_YGrowth_AndroidEmailSig__AndroidUsers&af_wl=ym&af_sub1=Internal&af_sub2=Global_YGrowth&af_sub3=EmailSignature&af_web_dp=http://v1f6wei4.hyundaieastern.com/?email=nobody@example.com	Get hash	malicious	Unknown	Browse	192.229.221.95
	qw8OQtx1Iw.exe	Get hash	malicious	DanaBot	Browse	192.229.221.95
	7yhuaZ89Jp.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	YNVi4YtxQd.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	FoX64.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	FoX64.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	SecuriteInfo.com.Trojan.Generic.30350.11493.exe	Get hash	malicious	ScreenConnect Tool	Browse	192.229.221.95

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	SecuriteInfo.com.Win32.PWSX-gen.8648.28187.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	145.40.105.166
	New_Chemical_Order.exe	Get hash	malicious	AgentTesla	Browse	145.40.105.166
	DHL_AWB_975539839616.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	145.40.105.166
	SecuriteInfo.com.Variant.Tedy.335016.8684.22862.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	145.40.105.166
	DHL_Shipment_Dos_for_Notification_8641295843.exe	Get hash	malicious	AgentTesla	Browse	145.40.105.166
	URGENT_REQUIREMENT.exe	Get hash	malicious	AgentTesla	Browse	145.40.105.166
	TT_COPY.exe	Get hash	malicious	AgentTesla	Browse	145.40.105.166
	Shipping_Documents.pdf.exe	Get hash	malicious	Snake Keylogger, StormKitty	Browse	145.40.105.166
	Zahlungsbenachrichtigung_Deutsche_Bank02000443900058656.exe	Get hash	malicious	Remcos	Browse	145.40.105.166
	USD8,000.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	145.40.105.166
	Bestar_Steel_RFQ_0100423(MECH)NBI_April-1423.exe	Get hash	malicious	AgentTesla	Browse	145.40.105.166
	SecuriteInfo.com.Trojan.DownloaderNET.367.3878.24557.exe	Get hash	malicious	AgentTesla	Browse	145.40.105.166
	Debit_Note.exe	Get hash	malicious	AgentTesla	Browse	145.40.105.166
	Request_For_Quote_180423.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	145.40.105.166
	Order_PO230325174.exe	Get hash	malicious	AgentTesla	Browse	145.40.105.166
	098765456789.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	145.40.105.166
	DHL-AWB.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	145.40.105.166
	https://lderkd.clinicaragaalbacete.com/bnx/	Get hash	malicious	HTMLPhisher	Browse	145.40.105.166
	faM38WHiAE.exe	Get hash	malicious	AgentTesla	Browse	145.40.105.166
	4YiZKbBn05.exe	Get hash	malicious	AgentTesla	Browse	145.40.105.166

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10614	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x13000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x11800	0x3910
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x14000	0xde0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xfe40	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xfd80	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb000	0x144	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ConnectWiseControl.Client.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QFX1KV1T\AXV12UXD.log

C:\Users\user\AppData\Local\Temp\Deployment\0GNZA0P7.GP0\GZMYT4PJ.TLZ\ScreenConnect.WindowsClient.exe.manifest

C:\Users\user\AppData\Local\Temp\Deployment\V22DML8R.HV6\H7XARK6N.WM3.application

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2660496737-530772487-1027249058-1002\932a2db58c237abd381d22df4c63a04a_7ff3f708-074b-4ff4-b2c5-fe065076e0a1

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
ConnectWiseControl.Client.exe