Edit tour

Windows Analysis Report
Facture_160087511.html

Overview

General Information

Sample name:	Facture_160087511.html
Analysis ID:	1417307
MD5:	a357597ee910609541b96d20695b5f72
SHA1:	b8e29385c4cb7f8d38fbdb35fa942eceb6ee9882
SHA256:	a118598b60795591743786e6ca24d1f8aaf4060d01297a1994a4cef8589518c6
Infos:

Detection

ScreenConnect Tool

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Changes security center settings (notifications, updates, antivirus, firewall)

Detected javascript redirector / loader

Enables network access during safeboot for specific services

HTML document with suspicious name

HTML document with suspicious title

Machine Learning detection for dropped file

Reads the Security eventlog

Reads the System eventlog

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Drops PE files

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Dfsvc.EXE Network Connection To Uncommon Ports

Stores files to the Windows start menu directory

Stores large binary data to the registry

Tries to load missing DLLs

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected ScreenConnect Tool

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 5832 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\Facture_160087511.html MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 1388 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1960,i,18272814820219539674,15330357100788410989,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6808 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5364 --field-trial-handle=1960,i,18272814820219539674,15330357100788410989,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 8024 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5780 --field-trial-handle=1960,i,18272814820219539674,15330357100788410989,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

svchost.exe (PID: 7160 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

rundll32.exe (PID: 6464 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

svchost.exe (PID: 5752 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 1976 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 6912 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6880 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6368 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 3812 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 6852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 2536 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

ScreenConnect.Client.exe (PID: 7048 cmdline: "C:\Users\user\Downloads\ScreenConnect.Client.exe" MD5: 8A12242557A55CBB4DA424325DF63911)

dfsvc.exe (PID: 6684 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe" MD5: B4088F44B80D363902E11F897A7BAC09)

ScreenConnect.WindowsClient.exe (PID: 7448 cmdline: "C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe" MD5: 5DEC65C4047DE914C78816B8663E3602)

ScreenConnect.ClientService.exe (PID: 7548 cmdline: "C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=instance-tboidi-relay.screenconnect.com&p=443&s=c8a2909f-65b5-4670-8f89-c71e38a77a6c&k=BgIAAACkAABSU0ExAAgAAAEAAQAl53tb%2bMpSbYGLCYaC9h4oRRU9k1ZX87qXMQxyh8Kf3H04WThcifZ0uqJl%2bAMhVhJHY5ffkrh%2bdjThL4g5FiNETSuihDbBOlV8x%2bObrd%2bY2UXgvIeEh9yYeKD1sPpXb%2btU2lj%2b17y%2f%2fXmPLIx%2b1rrmNOoVHwKVU45%2foBT%2by6Gq9nqpczPVQbSojDwB7LhsQUOvqAYtrfOvSYTAeZ3Bzy7GnvtE3%2fO4gseuF9qIH101Lv4D2bXCmzZRLLZBpyrMTl5iO9RdN%2bRs79EeFPaTHMvj8o0Ge5PIQH7taMDk6rfw%2b7Lwfm6%2bFPxhk2yqw4Ol%2fhIukS%2bJp8j73qGi3kmUj4ns&r=&i=" "1" MD5: DC615E9D8EC81CBF2E2452516373E5A0)

svchost.exe (PID: 7172 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

ScreenConnect.ClientService.exe (PID: 7584 cmdline: "C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=instance-tboidi-relay.screenconnect.com&p=443&s=c8a2909f-65b5-4670-8f89-c71e38a77a6c&k=BgIAAACkAABSU0ExAAgAAAEAAQAl53tb%2bMpSbYGLCYaC9h4oRRU9k1ZX87qXMQxyh8Kf3H04WThcifZ0uqJl%2bAMhVhJHY5ffkrh%2bdjThL4g5FiNETSuihDbBOlV8x%2bObrd%2bY2UXgvIeEh9yYeKD1sPpXb%2btU2lj%2b17y%2f%2fXmPLIx%2b1rrmNOoVHwKVU45%2foBT%2by6Gq9nqpczPVQbSojDwB7LhsQUOvqAYtrfOvSYTAeZ3Bzy7GnvtE3%2fO4gseuF9qIH101Lv4D2bXCmzZRLLZBpyrMTl5iO9RdN%2bRs79EeFPaTHMvj8o0Ge5PIQH7taMDk6rfw%2b7Lwfm6%2bFPxhk2yqw4Ol%2fhIukS%2bJp8j73qGi3kmUj4ns&r=&i=" "1" MD5: DC615E9D8EC81CBF2E2452516373E5A0)

ScreenConnect.WindowsClient.exe (PID: 7668 cmdline: "C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe" "RunRole" "7aab98a9-9cfc-434a-9f82-e0e9079a01a3" "User" MD5: 5DEC65C4047DE914C78816B8663E3602)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsClient.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsClient.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsClient.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000018.00000000.1511215044.00000000002B2000.00000002.00000001.01000000.0000000C.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
00000018.00000002.1525632320.0000000002847000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security

Sigma Signatures

System Summary

Sigma detected: Dfsvc.EXE Network Connection To Uncommon Ports

Source: Network Connection

Author: Nasreddine Bencherchali (Nextron Systems): Data: DestinationIp: 192.168.2.17, DestinationIsIpv6: false, DestinationPort: 49712, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe, Initiated: true, ProcessId: 6684, Protocol: tcp, SourceIp: 158.69.9.165, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 660, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7160, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Machine Learning detection for dropped file

Source: C:\Users\user\Downloads\Unconfirmed 748427.crdownload	Joe Sandbox ML: detected
Source: C:\Users\user\Downloads\Unconfirmed 748427.crdownload	Joe Sandbox ML: detected
Source: C:\Users\user\Downloads\Unconfirmed 748427.crdownload	Joe Sandbox ML: detected

Phishing

Detected javascript redirector / loader

Source: Facture_160087511.html

HTTP Parser: Low number of body elements: 0

HTML document with suspicious title

Source: file:///C:/Users/user/Desktop/Facture_160087511.html

Tab title: Facture_160087511.html

Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.17:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 158.69.9.165:443 -> 192.168.2.17:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.21.200:443 -> 192.168.2.17:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.17:49732 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File opened: C:\Users\user\AppData\Local\Apps\
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File opened: C:\Users\user\AppData\Local\
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File opened: C:\Users\user\
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 31MB

Networking

Enables network access during safeboot for specific services

Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe

Registry value created: NULL Service

Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.122.249
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.122.249
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.222.123
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.222.123
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88

Source: unknown

DNS traffic detected: queries for: svacamp.com

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.17:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 158.69.9.165:443 -> 192.168.2.17:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.21.200:443 -> 192.168.2.17:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.17:49732 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_BE4413523710330F97BEE5D4A544C42B	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnect
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security

Reads the System eventlog

Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System

System Summary

HTML document with suspicious name

Source: Name includes: Facture_160087511.html

Initial sample: facture

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Downloads\ScreenConnect.Client.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Downloads\ScreenConnect.Client.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Downloads\ScreenConnect.Client.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\ScreenConnect.Client.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\ScreenConnect.Client.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\ScreenConnect.Client.exe	Section loaded: dfshim.dll
Source: C:\Users\user\Downloads\ScreenConnect.Client.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\ScreenConnect.Client.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Downloads\ScreenConnect.Client.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Downloads\ScreenConnect.Client.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\ScreenConnect.Client.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Downloads\ScreenConnect.Client.exe	Section loaded: netutils.dll
Source: C:\Users\user\Downloads\ScreenConnect.Client.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\ScreenConnect.Client.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dfshim.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dwrite.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: textshaping.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: textinputframework.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: coremessaging.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cryptnet.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cabinet.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usosvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: updatepolicy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usocoreps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usoapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: smartscreenps.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: policymanager.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: shdocvw.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: thumbcache.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: pcacli.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: dfshim.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: samlib.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll

Source: classification engine

Classification label: mal72.phis.evad.winHTML@43/54@13/101

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6852:120:WilError_03
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Mutant created: \BaseNamedObjects\Global\netfxeventlog.1.0

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File created: C:\Users\user\AppData\Local\Temp\Deployment

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\Facture_160087511.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1960,i,18272814820219539674,15330357100788410989,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5364 --field-trial-handle=1960,i,18272814820219539674,15330357100788410989,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1960,i,18272814820219539674,15330357100788410989,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5364 --field-trial-handle=1960,i,18272814820219539674,15330357100788410989,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Users\user\Downloads\ScreenConnect.Client.exe "C:\Users\user\Downloads\ScreenConnect.Client.exe"
Source: C:\Users\user\Downloads\ScreenConnect.Client.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
Source: C:\Users\user\Downloads\ScreenConnect.Client.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe"
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=instance-tboidi-relay.screenconnect.com&p=443&s=c8a2909f-65b5-4670-8f89-c71e38a77a6c&k=BgIAAACkAABSU0ExAAgAAAEAAQAl53tb%2bMpSbYGLCYaC9h4oRRU9k1ZX87qXMQxyh8Kf3H04WThcifZ0uqJl%2bAMhVhJHY5ffkrh%2bdjThL4g5FiNETSuihDbBOlV8x%2bObrd%2bY2UXgvIeEh9yYeKD1sPpXb%2btU2lj%2b17y%2f%2fXmPLIx%2b1rrmNOoVHwKVU45%2foBT%2by6Gq9nqpczPVQbSojDwB7LhsQUOvqAYtrfOvSYTAeZ3Bzy7GnvtE3%2fO4gseuF9qIH101Lv4D2bXCmzZRLLZBpyrMTl5iO9RdN%2bRs79EeFPaTHMvj8o0Ge5PIQH7taMDk6rfw%2b7Lwfm6%2bFPxhk2yqw4Ol%2fhIukS%2bJp8j73qGi3kmUj4ns&r=&i=" "1"
Source: unknown	Process created: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=instance-tboidi-relay.screenconnect.com&p=443&s=c8a2909f-65b5-4670-8f89-c71e38a77a6c&k=BgIAAACkAABSU0ExAAgAAAEAAQAl53tb%2bMpSbYGLCYaC9h4oRRU9k1ZX87qXMQxyh8Kf3H04WThcifZ0uqJl%2bAMhVhJHY5ffkrh%2bdjThL4g5FiNETSuihDbBOlV8x%2bObrd%2bY2UXgvIeEh9yYeKD1sPpXb%2btU2lj%2b17y%2f%2fXmPLIx%2b1rrmNOoVHwKVU45%2foBT%2by6Gq9nqpczPVQbSojDwB7LhsQUOvqAYtrfOvSYTAeZ3Bzy7GnvtE3%2fO4gseuF9qIH101Lv4D2bXCmzZRLLZBpyrMTl5iO9RdN%2bRs79EeFPaTHMvj8o0Ge5PIQH7taMDk6rfw%2b7Lwfm6%2bFPxhk2yqw4Ol%2fhIukS%2bJp8j73qGi3kmUj4ns&r=&i=" "1"
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe" "RunRole" "7aab98a9-9cfc-434a-9f82-e0e9079a01a3" "User"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe"
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe" "RunRole" "7aab98a9-9cfc-434a-9f82-e0e9079a01a3" "User"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5780 --field-trial-handle=1960,i,18272814820219539674,15330357100788410989,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5780 --field-trial-handle=1960,i,18272814820219539674,15330357100788410989,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Downloads\ScreenConnect.Client.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.ClientService.exe	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\a859b993-1a6c-433e-adfe-3c7effaf6efb.tmp	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 748427.crdownload	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsClient.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsFileManager.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application

Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (c8a2909f-65b5-4670-8f89-c71e38a77a6c)

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Users\user\Downloads\ScreenConnect.Client.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Memory allocated: 1D368690000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Memory allocated: 1D36A180000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Memory allocated: 870000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Memory allocated: 1A7C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Memory allocated: 1370000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Memory allocated: 2D50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Memory allocated: 4D50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Memory allocated: 1B80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Memory allocated: 1C30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Memory allocated: 3C30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Memory allocated: 22F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Memory allocated: 1A4E0000 memory reserve \| memory write watch

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599873
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599762
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599650
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599539
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599429
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599317
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599190
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599062
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598950
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598838
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598726
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598614
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598486
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598359
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598247
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598135
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598023
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597912
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597784
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597656
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597545
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597433
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597321
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597209
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597081
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596954
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596827
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596715
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596603
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596491
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596380
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596252
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596124
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596013
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595900
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595789
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595678
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595551
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595423
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595295
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595183
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595072
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594960
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594850
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594738
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594611
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594468
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594357
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Window / User API: threadDelayed 9557

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsFileManager.exe	Jump to dropped file

Source: C:\Users\user\Downloads\ScreenConnect.Client.exe TID: 7112	Thread sleep time: -40000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6604	Thread sleep count: 9557 > 30
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -599873s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -599762s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6604	Thread sleep count: 182 > 30
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -599650s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -599539s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -599429s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -599317s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -599190s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -599062s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -598950s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -598838s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -598726s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -598614s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -598486s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -598359s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -598247s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -598135s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -598023s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -597912s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -597784s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -597656s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -597545s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -597433s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -597321s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -597209s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -597081s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -596954s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -596827s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -596715s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -596603s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -596491s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -596380s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -596252s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -596124s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -596013s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -595900s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -595789s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -595678s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -595551s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -595423s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -595295s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -595183s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -595072s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -594960s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -594850s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -594738s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -594611s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -594468s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4860	Thread sleep time: -594357s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6700	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe TID: 7472	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe TID: 7572	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe TID: 7792	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation

Source: C:\Users\user\Downloads\ScreenConnect.Client.exe	Thread delayed: delay time: 40000
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599873
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599762
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599650
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599539
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599429
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599317
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599190
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599062
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598950
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598838
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598726
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598614
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598486
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598359
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598247
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598135
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598023
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597912
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597784
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597656
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597545
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597433
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597321
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597209
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597081
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596954
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596827
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596715
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596603
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596491
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596380
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596252
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596124
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596013
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595900
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595789
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595678
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595551
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595423
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595295
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595183
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595072
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594960
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594850
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594738
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594611
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594468
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594357
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File opened: C:\Users\user\AppData\Local\Apps\
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File opened: C:\Users\user\AppData\Local\
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File opened: C:\Users\user\
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\

Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe

Process token adjusted: Debug

Source: C:\Users\user\Downloads\ScreenConnect.Client.exe

Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Memory allocated: page read and write | page guard

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Process created: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe"

Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\nkn6d4gd.we6\gtv6mlew.9mm\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\screenconnect.clientservice.exe" "?e=support&y=guest&h=instance-tboidi-relay.screenconnect.com&p=443&s=c8a2909f-65b5-4670-8f89-c71e38a77a6c&k=bgiaaackaabsu0exaagaaaeaaqal53tb%2bmpsbyglcyac9h4orru9k1zx87qxmqxyh8kf3h04wthcifz0uqjl%2bamhvhjhy5ffkrh%2bdjthl4g5finetsuihdbbolv8x%2bobrd%2by2uxgvieeh9yyekd1sppxb%2btu2lj%2b17y%2f%2fxmplix%2b1rrmnoovhwkvu45%2fobt%2by6gq9nqpczpvqbsojdwb7lhsquovqaytrfovsytaez3bzy7gnvte3%2fo4gseuf9qih101lv4d2bxcmzzrllzbpyrmtl5io9rdn%2brs79eefpathmvj8o0ge5piqh7tamdk6rfw%2b7lwfm6%2bfpxhk2yqw4ol%2fhiuks%2bjp8j73qgi3kmuj4ns&r=&i=" "1"
Source: unknown	Process created: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\nkn6d4gd.we6\gtv6mlew.9mm\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\screenconnect.clientservice.exe" "?e=support&y=guest&h=instance-tboidi-relay.screenconnect.com&p=443&s=c8a2909f-65b5-4670-8f89-c71e38a77a6c&k=bgiaaackaabsu0exaagaaaeaaqal53tb%2bmpsbyglcyac9h4orru9k1zx87qxmqxyh8kf3h04wthcifz0uqjl%2bamhvhjhy5ffkrh%2bdjthl4g5finetsuihdbbolv8x%2bobrd%2by2uxgvieeh9yyekd1sppxb%2btu2lj%2b17y%2f%2fxmplix%2b1rrmnoovhwkvu45%2fobt%2by6gq9nqpczpvqbsojdwb7lhsquovqaytrfovsytaez3bzy7gnvte3%2fo4gseuf9qih101lv4d2bxcmzzrllzbpyrmtl5io9rdn%2brs79eefpathmvj8o0ge5piqh7tamdk6rfw%2b7lwfm6%2bfpxhk2yqw4ol%2fhiuks%2bjp8j73qgi3kmuj4ns&r=&i=" "1"

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsClient.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.Client.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsClient.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsClient.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.Core.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.Client.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.ClientService.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsBackstageShell.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsFileManager.exe.config VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsClient.exe.config VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsBackstageShell.exe.config VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsFileManager.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsClient.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.Core.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.Client.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.Client.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.Client.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.Client.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Downloads\ScreenConnect.Client.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Source: C:\Users\user\Downloads\ScreenConnect.Client.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Source: Yara match	File source: 00000018.00000000.1511215044.00000000002B2000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.1525632320.0000000002847000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsClient.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsClient.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsClient.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	2 Windows Service	2 Windows Service	11 Masquerading	OS Credential Dumping	3 Security Software Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Modify Registry	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	121 Disable or Modify Tools	Security Account Manager	51 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	51 Virtualization/Sandbox Evasion	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Extra Window Memory Injection	11 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Rundll32	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Extra Window Memory Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Source	Detection	Scanner	Label	Link
Facture_160087511.html	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\Downloads\Unconfirmed 748427.crdownload	100%	Joe Sandbox ML
C:\Users\user\Downloads\Unconfirmed 748427.crdownload	100%	Joe Sandbox ML
C:\Users\user\Downloads\Unconfirmed 748427.crdownload	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9\ScreenConnect.Core.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd\ScreenConnect.Client.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924\ScreenConnect.ClientService.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.ClientService.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.Windows.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsBackstageShell.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsClient.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsFileManager.exe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
file:///C:/Users/user/Desktop/Facture_160087511.html	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
server-ovh5023507-web.screenconnect.com	158.69.9.165	true	false	high
server-ovh5023507-relay.screenconnect.com	148.113.163.9	true	false	high
svacamp.com	163.44.198.43	true	false	unknown
www.google.com	142.251.167.106	true	false	high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
instance-tboidi-relay.screenconnect.com	unknown	unknown	false	high
barmaxminerals.screenconnect.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
file:///C:/Users/user/Desktop/Facture_160087511.html	true	Avira URL Cloud: safe	low

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
72.21.81.240	unknown	United States	15133	EDGECASTUS	false
23.52.162.98	unknown	United States	16625	AKAMAI-ASUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.251.111.84	unknown	United States	15169	GOOGLEUS	false
163.44.198.43	svacamp.com	Singapore	135161	GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG	false
142.251.163.113	unknown	United States	15169	GOOGLEUS	false
142.251.167.106	www.google.com	United States	15169	GOOGLEUS	false
172.253.63.113	unknown	United States	15169	GOOGLEUS	false
142.251.167.94	unknown	United States	15169	GOOGLEUS	false
192.229.211.108	fp2e7a.wpc.phicdn.net	United States	15133	EDGECASTUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.190.190.129	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.31.94	unknown	United States	15169	GOOGLEUS	false
158.69.9.165	server-ovh5023507-web.screenconnect.com	Canada	16276	OVHFR	false
148.113.163.9	server-ovh5023507-relay.screenconnect.com	United States	396982	GOOGLE-PRIVATE-CLOUDUS	false
104.96.221.75	unknown	United States	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.17
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417307
Start date and time:	2024-03-28 22:39:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	Facture_160087511.html
Detection:	MAL
Classification:	mal72.phis.evad.winHTML@43/54@13/101
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 142.251.167.94, 142.251.111.84, 142.251.163.113, 142.251.163.139, 142.251.163.102, 142.251.163.138, 142.251.163.101, 142.251.163.100, 34.104.35.123
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Facture_160087511.html

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 69993 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	69993
Entropy (8bit):	7.99584879649948
Encrypted:	true
SSDEEP:
MD5:	29F65BA8E88C063813CC50A4EA544E93
SHA1:	05A7040D5C127E68C25D81CC51271FFB8BEF3568
SHA-256:	1ED81FA8DFB6999A9FEDC6E779138FFD99568992E22D300ACD181A6D2C8DE184
SHA-512:	E29B2E92C496245BED3372578074407E8EF8882906CE10C35B3C8DEEBFEFE01B5FD7F3030ACAA693E175F4B7ACA6CD7D8D10AE1C731B09C5FA19035E005DE3AA
Malicious:	false
Reputation:	unknown
Preview:	MSCF....i.......,...................I.................oXAy .authroot.stl.Ez..Q6..CK..<Tk...p.k..1...3...[..%Y.f..."K.6)..[I.hOB."..rK.RQ..}f..f...}....9.\|.....gA...30.,O2L...0..%.U...U.t.....`dqM2.x..t...<(uad.c...x5V.x..t..agd.v......i...KD..q(. ...JJ......#..'=. ...3.x...}...+T.K..!.'.`w .!.x.r.......YafhG..O.3....'P[..'.D../....n..t....R<..=\E7L0?{..T.f...ID...,...r....3z..O/.b.Iwx.. .o...a\.s........."..'.......<;s.[...l...6.)ll..B.P.....k.... k0.".t!/.,........{...P8....B..0(.. .Q.....d...q,\.$.n.Q.\.p...R..:.hr./..8.S<a.s...+#3....D..h1.a.0....{.9.....:e.......n.~G.{.M.1..OU.....B.Q..y_>.P{...}i.=.a..QQT.U..\|!.pyCD@.....l..70..w..)...W^.`l...%Y.\................i..=hYV.O8W@P.=.r.=..1m..1....)\.p..\|.c.3..t..[...).....l.{.Y....\S.....y....[.mCt....Js;...H....Q..F.....g.O...[..A.=...F[..z....k...mo.lW{`....O...T.g.Y.Uh.;m.'.N..f..}4..9i..t4p_bI..`.....Ie..l.P.... ...Lg......[....5g...~D.s.h'>n.m.c.7...-..P.gG...i$...v.m.b[.yO.P/*.YH.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_BE4413523710330F97BEE5D4A544C42B

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	727
Entropy (8bit):	7.586932358225902
Encrypted:	false
SSDEEP:
MD5:	80BDBBFE1BE811E784857224A8DD0C56
SHA1:	B16C3B0D1F627AC2CB0FE390AADEA0043923F937
SHA-256:	D37DA1396F93724C8C0F4C2451A203259B315679B076F8DB4792A5C01D548C47
SHA-512:	A5FA1B0AF42F67F38378C09A0445B3FF31FBEDB62337FC429817351EBE9DECDA007CEFB7B7F0DCF4C7EEB1DDC4C3D598194939B467002DD94E79C99C06DCFC36
Malicious:	false
Reputation:	unknown
Preview:	0..........0.....+.....0......0...0......h7..;._....a{..e.NB..20240327225427Z0s0q0I0...+.........]....^Idk...NG.X....h7..;._....a{..e.NB....`....fB.........20240327223901Z....20240403213901Z0....H...............<R.w.E<.T......x.~...7..A..X..........Pg..X..A&wW.^..Y.......q.?.Y.[.o&.6A...$.g..nP.c..I.P....>...T.5.6.....FWGm........mx...h=....z.8Q.ka.n.}.6.......X.f...80..x.n..-../a.L.M\|...~b...I.\..3...Q......_.!.Y.F...5.{.5.T...H.p.....\|(i.N.E..:.iS..Q.g.............`ldb..c...)\.M......O..... ...]....h...X.K_G.q...l}.....t..M..Hf\|x..!... \|.../;.ce.....__..<(...&.H....e$U!{.S.d..hu..M..}tq.P..)....Op.S.n~..?...X...yVz.b./07}.......Yd...-....'........fB.t.5.P~..n....BV.Zu.L.-.nT*...>..d...w..[

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	727
Entropy (8bit):	7.5893283342641915
Encrypted:	false
SSDEEP:
MD5:	E927AD0BC016F9AE0B9AB5AEC8589E78
SHA1:	56F30F4A688FC0F5817D78CC483DC08ACF54C06E
SHA-256:	0561D40B4F63D94549BDA218F6380DB5C9174159C2C457D14AEB590206214D34
SHA-512:	63ACDC6AB94F761AF5C637C8E65095EF67E063687AB62F4EBA50F6FE9CD624D87A5A1A856A35FAA79BE8152932B4680D94A9BA93EC0DCED1BD7F434C80E459AE
Malicious:	false
Reputation:	unknown
Preview:	0..........0.....+.....0......0...0..........q]dL..g?....O..20240327184243Z0s0q0I0...+........."..;F..=\@ua..........q]dL..g?....O....@.`.L.^........20240327184243Z....20240403184243Z0....H............./wT..l.vG....Gvc.o..e.../t.I..t ..-.(..+7.7Rnq..O\.!.=...v.`...jG.[...l.s.......;....G.zhU.:..$.4...!......... y.~\I..f....~PX!.F..W).bc.~..vf.:...`...p".....\|...LW...q....8....o]CmZ+..V.'..<....I.[...n.a.y..w%.W..s.......YX....B.5V.....;M..}.<..5..... .Z....\|p..Zb.........t,.F].l;.Zj:8....Z..d..^..l..d..Y...W..n=..`'..^.W........6...&B.....$.@B...#...o.-`U<..n..? .i..Z.P..l...I~Wk.\=.......U.......w.CW0\....$Y.&..C...%.xn`.......[...P...4.{....8..Bfgm...&/...Z....R.DmN.Ra..G...Y..v

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	7.688784034406474
Encrypted:	false
SSDEEP:
MD5:	78F2FCAA601F2FB4EBC937BA532E7549
SHA1:	DDFB16CD4931C973A2037D3FC83A4D7D775D05E4
SHA-256:	552F7BDCF1A7AF9E6CE672017F4F12ABF77240C78E761AC203D1D9D20AC89988
SHA-512:	BCAD73A7A5AFB7120549DD54BA1F15C551AE24C7181F008392065D1ED006E6FA4FA5A60538D52461B15A12F5292049E929CFFDE15CC400DEC9CDFCA0B36A68DD
Malicious:	false
Reputation:	unknown
Preview:	0...0..x..........W..!2.9...wu\0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...130801120000Z..380115120000Z0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40.."0....H.............0..........sh..]J<0"0i3..%..!=..Y..).=X.v..{....0....8..V.m...y....._..<R.R....~...W.YUr.h.p..u.js2...D.......t;mq.-... .. .c)-..^N..!a.4...^.[......4@_.zf.w.H.fWW.TX..+.O.0.V..{]..O^.5.1..^......@.y.x...j.8.....7...}...>..p.U.A2...sn..\|!L....u]xf.:1D.3@...ZI...g.'..O9..X..$\F.d..i.v.v=Y]Bv...izH....f.t..K...c....:.=...E%...D.+~....am.3...K...}....!........p,A`..c.D..vb~.....d.3....C....w.....!..T)%.l..RQGt.&..Au.z._.?..A..[..P.1..r."..\|Lu?c.!_. Qko....O..E_. ........~.&...i/..-............B0@0...U.......0....0...U...........0...U..........q]dL..g?....O0....H..............a.}.l.........dh.V.w.p...J...x\.._...)V.6I]Dc...f.#.=y.mk.T..<.C@..P.R..;...ik.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.448753640320332
Encrypted:	false
SSDEEP:
MD5:	675BD86040D8090B4C88FE856FDB9554
SHA1:	57D1FD76353C9BA4D1BAD78327039ACF67C329C9
SHA-256:	D7B1C72A4172BEDEEFF370D179A8F42DC76E033F50D6D0C75A514AE979DC6854
SHA-512:	AA1FA59C4D71A43353AEEFFBEEA0E64C9D911C3882E06D4F406A5A174184B609033088BF9B079600CA6C1855D8F49099D5CADB0124DA816C4B632F9BD4D59C69
Malicious:	false
Reputation:	unknown
Preview:	p...... ........Su.?7...(...............................................CE.... .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.135433401638173
Encrypted:	false
SSDEEP:
MD5:	14D9DD0533C555B1DC8CB666232E5D5C
SHA1:	A9B850C783536F319B88797BE5A9B7AD0F3F2A65
SHA-256:	77371A15C5E8ABE0D36FB3E032B4B37D2D907C7A13DF86EF058F744382B5579E
SHA-512:	9CCE95C7483763BCC88B05B3B9F2BEF6B0A145DB8BEA5DA9D6DDE2378BC3C6A6EE9FA7336A145606138FC392D176A1240CFB05F808F41DDE64646924D6172659
Malicious:	false
Reputation:	unknown
Preview:	p...... ........z.......(....................................................... ........M.........(...........i...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".b.3.6.8.5.3.8.5.a.4.7.f.d.a.1.:.0."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_BE4413523710330F97BEE5D4A544C42B

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	modified
Size (bytes):	404
Entropy (8bit):	3.9475886557448523
Encrypted:	false
SSDEEP:
MD5:	E97B5E6806DBD5F88EEAB658FAE66D67
SHA1:	01A8E446B39CB7A741F6784C24AC2C426DB6AB38
SHA-256:	4645BAC801A0F896AA1C8070BF5794032FFD2C4CEC52CDEB1AAF27207472CE42
SHA-512:	5530ACD26E6D82E6AB150D2F0AA76F75496031A39F27D3F07DBF0B48CC83CDB01F27143B61AB6C0CBC8E10EEC3F77439ADD1FEE8080D97BAC4670A17D24F1AD4
Malicious:	false
Reputation:	unknown
Preview:	p...... .... .....b.....(................pI......HiW.....................HiW.... ...........I... ...................h.t.t.p.:././.o.c.s.p...d.i.g.i.c.e.r.t...c.o.m./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.S.R.X.e.r.F.0.e.F.e.S.W.R.r.i.p.T.g.T.k.c.J.W.M.m.7.i.Q.Q.U.a.D.f.g.6.7.Y.7.%.2.B.F.8.R.h.v.v.%.2.B.Y.X.s.I.i.G.X.0.T.k.I.C.E.A.u.T.Y.A.U.b.z.P.Z.m.Q.p.m.J.m.N.W.6.l.8.4.%.3.D...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	412
Entropy (8bit):	3.9844304104350527
Encrypted:	false
SSDEEP:
MD5:	70E792987675A41C2C9667D0B32D2178
SHA1:	56853C5BCD001919F67B07F26588564B12F20917
SHA-256:	8476BAA5CDA883D467B794715957842431307D2DED8022405FB68593ECE5EFE5
SHA-512:	5A7C2F720A8FCE1130274F905CBE8F670FBC22B29B9EBA7223F3B2FB22DE95C563A4F34E220DB53CACDCD9DF03B79E7E3177DA49C05AD308E050B5B977A0612B
Malicious:	false
Reputation:	unknown
Preview:	p...... ....(...)_....(................S..v.....n.......................n..... ........5..T... ...................h.t.t.p.:././.o.c.s.p...d.i.g.i.c.e.r.t...c.o.m./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.T.f.I.s.%.2.B.L.j.D.t.G.w.Q.0.9.X.E.B.1.Y.e.q.%.2.B.t.X.%.2.B.B.g.Q.Q.U.7.N.f.j.g.t.J.x.X.W.R.M.3.y.5.n.P.%.2.B.e.6.m.K.4.c.D.0.8.C.E.A.i.t.Q.L.J.g.0.p.x.M.n.1.7.N.q.b.2.T.r.t.k.%.3.D...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.068646898467291
Encrypted:	false
SSDEEP:
MD5:	EDDCC72C77ABAFEE2F1960B8F09DC726
SHA1:	EF6B927617162443F793B8F6348C60AC9C277C36
SHA-256:	5409C6D2CF3BAAAB57EFE6814CE9DBFB4B4F3BDE4A412B811220AA0B75D26282
SHA-512:	F1B5DFA2F6EC0E12E2715A0ED8F3A379DDC9ED56CA193FD96BE4B0D183A1C808EE2AFA5717E3ED9261B63CAA01EAD928494F0CD2D2294CED998BAE60C51DD1FD
Malicious:	false
Reputation:	unknown
Preview:	p...... ....l......Z{...(....................................................... ............n......................h.t.t.p.:././.c.a.c.e.r.t.s...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.R.o.o.t.G.4...c.r.t...".5.a.2.8.6.4.1.7.-.5.9.4."...

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\manifests\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445.cdf-ms

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	25496
Entropy (8bit):	5.119413667292155
Encrypted:	false
SSDEEP:
MD5:	EED6A84F7BDF1788006A03BD2B105973
SHA1:	ECB311C53777CC4C42AE142D30D6619279110980
SHA-256:	1379BC697C44932132194D39ABABD57ABAEDE63004DCF17C6D6D9CEA780B1F07
SHA-512:	60C11317FF8CB4272770373660EA0E92A939B2BA724A12943C777E94600D845802F354EB862BBE1002BDA2D75A4D8D312FAAD103800978876279836C72933DDD
Malicious:	false
Reputation:	unknown
Preview:	PcmH.........I%v...f.......!...T...........................e...?....<.g..J.\|r,..`P....}'.d.........8........R....................U.K...W.....U..c...................'-........s".I...R.....$..........Y.p.:.........S..{.........6.......'~.x.h.....[...........5...M...8..........~9......-.a:...j.......;...K...!.<......6..A....y.].m..C....=4.....E....&..{.!.G....qz...#aI...@.R....K.....E..X.N....u..IV..R......D..S......3LD.SV...[s.T..<Y...O.&r..Vz\...........`.......=...O...T...W...Z...].......,.......L.......T.......\.......`.......\|...........................................@.......0...........<.......T.......h.......\|...0.......................................0...........<.......T.......h.......\|...0.......................................0...........8.......L.......`...0...l.......................................................................,.......8.......L.......`.......l...........................................................................................@...

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\manifests\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9.cdf-ms

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	3452
Entropy (8bit):	4.267328038674719
Encrypted:	false
SSDEEP:
MD5:	A1CFAB7D7297FA770E98D0DF1D0232EA
SHA1:	C8E0ADD7830415A99090086DD137663F02BD6250
SHA-256:	2441C4E3033271C17154CED4517F1A44F89522C3C4F886C30103B18D8989B565
SHA-512:	884824F9F5BDD394DA804B0E6FABD87E786D25F4AAD5FAB430D4A59DBE828A33733C64FA43CD86842258C61B053079F9902421BB8AE8547C57A059DAC619044E
Malicious:	false
Reputation:	unknown
Preview:	PcmH........r0$..)..#...(.......T..........................."........<.g..J.\|r,..`P..............E..X......U..c...................'-........s".I...R.....$..........Y.p.:.......'~.x.h.................z..w.....[~31.X....s)..;$D......B(.........f..VC.........;..........................0...@...0...p...0.......0...................................0.......4.......D.......T.......\...4...h...........P...\...........@...................................,...(...4.......\.......d.......x...(.......................(.......................(...........$...4...,.......`...................................................................................................................................................................................................nameScreenConnect.Core%%processorArchitecture%%%msilpublicKeyToken%%4B14C015C87C1AD8version%23.9.10.8817....................................................MdHd............D...........MdSp(...$...(...(...#............... urn:schemas

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\manifests\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9.cdf-ms

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	5260
Entropy (8bit):	4.092321390177708
Encrypted:	false
SSDEEP:
MD5:	7A570A30415A7C04ADA38470F2D66E42
SHA1:	1598AE78B4EA64F92530B9F7F539FF0BEEB1CBA3
SHA-256:	4E75959C353E7138A6AD4F9E55E41B919C4D868BE04D4F1BE22B63830AE797FD
SHA-512:	840AA43A38BFAF13AC1FC2E00E340004C59FD500836855AA10A21430AF0B02B6F7334F09EC77B4FD2FBC5409073A219F034B45B25DBFD094C2C290C87979327F
Malicious:	false
Reputation:	unknown
Preview:	PcmH........,.>.`3..4...t.......T...............P...........3........<.g..J.\|r,..`P............O.&r..Vz.....U..c...................'-........s".I...R.....$..........Y.p.:.......[.......................z..w.....[~31.X......E..X.....s".I...R....C.........y..&..d."....B(.....#...^.ie...u&...F.....Ey)....+.`...m,......;../............... ...$...'...*...-...0...0.......0...D...0...t...0.......0.......0.......0...4...0...d...................................................................4...........4...P...........l...@.......................................(........... .......(.......<...(...L.......t.......\|...(...............................(.......................(...$.......L.......T...(...d...................(.......................(...............d...........p.......................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\manifests\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6.cdf-ms

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	6588
Entropy (8bit):	3.979099019400539
Encrypted:	false
SSDEEP:
MD5:	52F778CA63D296F3ED275BE04DCE72A6
SHA1:	7FC54390159CB01D610F2ADA8436FD080486D1D9
SHA-256:	E027BA3D2AB2D60426E097FC4351D663CA28DB3CC7C163828A1E953FBD86CC6B
SHA-512:	E089CF5CD58692FE8468C94B7471B55767FACB11CDC73BDAB1F731F3500A73DDFB8136BEE5E75FC2175364B843138F99B384739EF88830237F54D4D7EC1D4B0E
Malicious:	false
Reputation:	unknown
Preview:	PcmH...............@...........T...............t...........?........<.g..J.\|r,..`P.............U.K...W.....U..c...................'-........s".I...R.....$..........Y.p.:...........}'.d................z..w.....[~31.X......E..X.....s".I...R....y..&..d."....B(.....#...C.....&...^.ie...u)...O.&r..Vz,...F.....Ey/...[s.T..<2...f..VC..5......;..8.....V....X;........... ...$...'...*...-...0...3...6...9...<...0.......0.......0.......0...4...0...d...0.......0.......0.......0...$...0...T...0.......................................................................4...$.......X...P...X...........@........................... .......0...(...8.......`.......h.......\|...(...............................(.......................(... .......H.......P...(...d...................(.......................(.......................(...0.......X.......`...(...l...................(.......................(...................................................................................................

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\manifests\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd.cdf-ms

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	3032
Entropy (8bit):	4.267743948908668
Encrypted:	false
SSDEEP:
MD5:	386E6378A4EEAB47A04E210CA0808C56
SHA1:	CCD822DB18B7202A72513CDE304713704660AC4B
SHA-256:	BDB9EF81E278D01200ECDB7F214B4F221DA17F3F58BFAC971C7A2E7F2DE1BA78
SHA-512:	57983035EDB58C5113052B3CB4125FFEB9652C59914503DD38B80724E677B3E3DD927C36283932B5FC3E9F06E7C52D9A9EBF7C41403DC0AC339F55D4502B6A60
Malicious:	false
Reputation:	unknown
Preview:	PcmH........D^...L..............T....................................<.g..J.\|r,..`P............[s.T..<.....U..c...................'-........s".I...R.....$..........Y.p.:.........S..{..................z..w.....[~31.X......E..X.....s".I...R.......;......................0.......0...@...0...p...................................................................4...........<...P...........P...@...h...................................(...............................(...,.......T.......\...(...d...........(...............................................................................................................................................................nameScreenConnect.ClientprocessorArchitecture%%%msilpublicKeyToken%%4B14C015C87C1AD8version%23.9.10.8817....................................................MdHd............<...........MdSp ...$....... ..."............... urn:schemas-microsoft-com:asm.v1.assembly.xmlns.1.0.manifestVersion urn:schemas-microsoft-com:asm.v2.asmv2)

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\manifests\scre..tion_25b0fbb6ef7eb094_0017.0009_none_4b563d129b766e28.cdf-ms

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	14612
Entropy (8bit):	5.711707708879154
Encrypted:	false
SSDEEP:
MD5:	A0A4809477DDAE123E559094159357FA
SHA1:	16DDDC0F47462AD2E5E90A9C9B087BF0B873A41A
SHA-256:	5A2E204545B597A4E8FB8D067CEB24A578242739A16596D4FF6239E9535CA048
SHA-512:	314B6FAC346815E1E0DBC004FE6AB79C6C17C5C942378290C22ED6FE4E2C05B0E8CE6871F3D745303527CB02229682C3EBCE2676DA0A6E28B26C99EC1AAB9554
Malicious:	false
Reputation:	unknown
Preview:	PcmH........F,.g..$...@.......T...............8...........#........<.g..J.\|r,..`PF...}&............Z.....)....E......x...\......=+.p.......I\t.\..>................j.K...6.....U..c...................'-...........-.a.....$..........Y.p.:............8........R...........}'.d....j...........K*...!.................`...........................0...................................................(.......@.......P.......T...'...X...................................................4................3......P....7......@8......H8......P8......p8......t8..L...\|8.......8.......8.......8.......8.......8..ScreenConnect.Client.manifest%%%.W.."(.v......o....T..O#............-........................E......................................4.0.30319%%%Client%%4.0%ScreenConnect Software%%ScreenConnect Client....................................P.......nameScreenConnect.WindowsClient.application%processorArchitecture%%%msilpublicKeyToken%%25b0fbb6ef7eb094version%23.9.10.8817........................

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\manifests\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924.cdf-ms

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	4428
Entropy (8bit):	4.171183581251846
Encrypted:	false
SSDEEP:
MD5:	F4EE4CB53F625C50B1C9660ED2195DD8
SHA1:	AA30CE40E1616AC2769890F211016D9661090ECE
SHA-256:	F6FB15305F3080C23F7F4F46595DA7F0448CFD36024464B452482387568302C2
SHA-512:	165C277265EFFEAD38EB880907F09732C2E40F51C67C34C16A4AA3EC5C1A00129BADD69A77A7961ED35F7FACCD49B183E127186DFF4603EA96B93F90DCCC1AEB
Malicious:	false
Reputation:	unknown
Preview:	PcmH........[..k..H.,...T.......T...............8...........+........<.g..J.\|r,..`P...............3LD.S.....U..c...................'-........s".I...R.....$..........Y.p.:..........6...................z..w.....[~31.X......E..X.....s".I...R....y..&..d......B(.........O.&r..Vz!...[s.T..<$......;..'..................."...%...(...0.......0.......0.......0...D...0...t...0................................................... .......0.......8...4...D.......x...P...l...........@...................,.......4.......D...(...L.......t.......\|...........(...............................(................... ...(...8.......`.......h...(...\|...................(...............L...........0...................................................................................................................................................................................................................................................................................................nameScreenConnect.Cl

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\manifests\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924.manifest

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1636
Entropy (8bit):	5.0848956029560135
Encrypted:	false
SSDEEP:
MD5:	F94D041A8128BE81C4347CAF6A3C47BF
SHA1:	3285F9ACF70C0E4D34F888C28BD3F693E3DF5909
SHA-256:	91A65BACAD5F7F70BDDC6209ED65DD5C375CEF9F3C289EAB83FD90D622ADF46B
SHA-512:	90199543207CAF9B4501BE7E9509DC9526DAFCD5602AAED700314763021C8F3ED06D93A31A90A34CB19D4FB7184AA7D154B197F9E535657AEB9EB872DA377A41
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.ClientService" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="23.9.10.8817" />.. <file name="ScreenConnect.ClientService.dll" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Core" publicKeyToken="4b14c015c87c1ad8" version="23.9.10.8817" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Windows" publicKeyToken="4b14c015c87c1ad8" versio

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\ScreenConnect.WindowsClient.exe.config

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.842791478883622
Encrypted:	false
SSDEEP:
MD5:	728175E20FFBCEB46760BB5E1112F38B
SHA1:	2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
SHA-256:	87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
SHA-512:	FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9\ScreenConnect.Core.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	531456
Entropy (8bit):	6.031735419537473
Encrypted:	false
SSDEEP:
MD5:	B319407E807BE1A49E366F7F8EA7EE2A
SHA1:	B12197A877FB7E33B1CB5BA11B0DA5CA706581BA
SHA-256:	761B7E50BAA229E8AFCD9A50990D7F776DDB5ED1EA5FBB131C802E57CF918742
SHA-512:	DC497643790DC608DECE9C8FE7264EFEDD13724BD24C9BF28A60D848B405FDDEFB8337A60F3F32BB91518910E02C7A2AAF29FC32F86A464DFCAFA365526BDB7F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0............../... ...@....... ...............................8....@.................................1/..O....@.......................`..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................e/......H........2..(.............................................................{9.....{:...V.(;.....}9.....}:......0..A........ur.......4.,/(<....{9....{9...o=...,.(>....{:....{:...o?...... ... )UU.Z(<....{9...o@...X )UU.Z(>....{:...oA...X...0..b........r...p......%..{9......%qu....u...-.&.+...u...oB....%..{:......%qv....v...-.&.+...v...oB....(C.....{D.....{E...V.(;.....}D.....}E....0..A........uw.......4.,/(<....{D....{D...o=...,.(>....{E....{E...o?...... F.b# )UU.

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd\ScreenConnect.Client.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	192512
Entropy (8bit):	6.5759745825926155
Encrypted:	false
SSDEEP:
MD5:	6BC9611D5B6CEE698149A18D986547A8
SHA1:	F36AB74E4E502FDAF81E101836B94C91D80CB8EA
SHA-256:	17377A52EEAE11E8EE01EB629D6A60C10015AD2BB8BC9768E5C8E4B6500A15ED
SHA-512:	3F23670D0BA150DE19A805DB6BEB6EED8538BBAD6FBE3CC21D17D738A43CF411C679A23CEA11549E69BE0321E672F740791D40E92498AEF9D1F8650743EE85EA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R.B..........." ..0.................. ... ....... .......................`.......0....@.................................5...O.... .......................@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................i.......H........................L................................................(......(....^.(...........%...}....:.(......}....:.(......}....:.(......}......{....:.(......}.....0..A........(....s....%.~....%-.&~......\...s....%.....(...+(...+o....o........0..s.......~ .....2. ....+...j..... ......... ...............%.r...p.%.r...p............%.....(!....5..............s"....=.....0...........~....%-.&~......_...s#...%.....(...+..~....%-.&~......`...s%...%.....(...+.r9..

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\5yliz2fi.newcfg

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	584
Entropy (8bit):	5.018889682243647
Encrypted:	false
SSDEEP:
MD5:	8BE78F7CBCB045890C16A7B6F3C0F80C
SHA1:	E4A774BD8D4222959C70D1B8F8CDAC2D6FEC7D30
SHA-256:	D06EB06C3BBCC2F39FB97F182E42698FD6E5CBADDA8147A52E99C9524185062F
SHA-512:	24D39B1EB0FD1D0E5D50A108C14A97BF244684A97B1D7F408A28DCA5C5ACD2B9E8F292A12B27B4C651B3470A0061C784CBFD11332353270D207CE4E6BBFE6712
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-tboidi-relay.screenconnect.com=148.113.163.9-28%2f03%2f2024%2021%3a40%3a36</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\Client.en-US.resources

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe
File Type:	data
Category:	dropped
Size (bytes):	48951
Entropy (8bit):	4.764447249091755
Encrypted:	false
SSDEEP:
MD5:	3E83A3AA62C5FF54ED98E27B3FBECF90
SHA1:	96D8927C870A74A478864240B3ACE94AD543DFB8
SHA-256:	2D88B97D28BE01ABCA4544C6381A4370C1A1CE05142C176742F13B44889DDF90
SHA-512:	EA9D05A4AA1EE5CCCC61C4F5E8994EFBA9EFFF0549B69577BEF1F2A22CCE908739124EFF1E0DB5CFDD69E077AD2D7CDB1307DE92D79673C9309EE621CB139956
Malicious:	false
Reputation:	unknown
Preview:	...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.q...'..6....wp.......y....C\|.)>..Ldt..... $..........1$.../...2.%%3./>>...L.y.0.C._.........1Y..Qj.o....<....=...R..;...C....&.......1p2.r.x.u?Y..R...c......X.....I.5.2q..R...>.E.pw .@ ).w.l.....S...X..'.C.I..-.Y........4.J..P<.E..=c!.@To..#.._.2.....K.!..h...z......t......^..4...D...f..Q...:..%.z.<......^.....;<...r..yC.....Q........4_.Sns..z.......=..]t...X..<....8.e`}..n....S.H[..S@?.~....,...j.2..v.......B....A...a......D..c..w..K,..t...S.....v....7.6\|..&.....r....#....G......Y...i..'.............'.......Z.....#2e..........\|....)..%....A.....4{..u;N......&q...}.tD..x.....4...J...L......5.Q..M....K..3U..M..........5...........t.>.......lYu....3TY.?...r...'.......3.m........=.H...#.o.........n.....,4.~...<h..u...i.H...V......V/...P.$%..z....V".........

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\Client.resources

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.WindowsClient.exe
File Type:	data
Category:	dropped
Size (bytes):	26722
Entropy (8bit):	7.7401940386372345
Encrypted:	false
SSDEEP:
MD5:	5CD580B22DA0C33EC6730B10A6C74932
SHA1:	0B6BDED7936178D80841B289769C6FF0C8EEAD2D
SHA-256:	DE185EE5D433E6CFBB2E5FCC903DBD60CC833A3CA5299F2862B253A41E7AA08C
SHA-512:	C2494533B26128FBF8149F7D20257D78D258ABFFB30E4E595CB9C6A742F00F1BF31B1EE202D4184661B98793B9909038CF03C04B563CE4ECA1E2EE2DEC3BF787
Malicious:	false
Reputation:	unknown
Preview:	...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP)...s^.J.....E.....(....jF.C...1P)...H..../..72J..I.J.a.K8c._.ks`.k.`.kK..m.M6p............b...P...........'...!...............K...............w.......P.......1......."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.1.6.....$A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.2.5.6....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.3.2....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.4.8.....,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.B.l.a.n.k.1.6.;...(A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.M.a.c.2.2.....0A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.O.p.a.q.u.e.1.9.2.8...,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.T.i.t.l.e.1.6.....6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.C.o.l.o.r.4...6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.I.m.a.g.e.:...DB.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.I.m.a.g.e.V.i.s.i.b.l.e.xb..B.l.a.n.k.M.o.n.i.t.o.r.T.e.x.t.C.o.l.o.r..b..D.a.r.k.T.h.e.m.e.B.a.r.B.a.s.e.C.o.l.o.r..b..<D.a.r.k.T.h.

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\guhv21ht.newcfg

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	584
Entropy (8bit):	5.018845167469441
Encrypted:	false
SSDEEP:
MD5:	AFB2E8065F025AC3411A3AEC0ECCF31B
SHA1:	580171FC51C2E41B49214CD922FA49F914758393
SHA-256:	F064C3B4ADE1B1241A06B28E7A14A27BD107F0583A6772F1BF083D76F6B8337B
SHA-512:	6A5C63C81941B3EA7DD394285EF539374568C1BCC20B1850CDA2F69BA4776C287FD7433DB00596EF946E3FCCA4462F6655C4FD34058677E3B118EB0D7693A528
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-tboidi-relay.screenconnect.com=148.113.163.9-28%2f03%2f2024%2021%3a41%3a27</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\iil0umr4.newcfg

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	584
Entropy (8bit):	5.016928642812608
Encrypted:	false
SSDEEP:
MD5:	69D2F2D1821E0B473F54512F54EE0D68
SHA1:	A07B35396883FF002AC73493248CC1E3A5315F08
SHA-256:	3D7BF2E5D3D51981E6F6239171DDEEE46311C105D0036CC1D2CBA2251BDC7F99
SHA-512:	7E4EC68702218D17735ABB67BAC7594A6E8693873E85F796A2029E5A5F38D8E41F6F9C8070F18488305199ED0560BC7569795F547674F32A31EFF84E74589147
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-tboidi-relay.screenconnect.com=148.113.163.9-28%2f03%2f2024%2021%3a40%3a43</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\k2d0ckb5.newcfg

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	584
Entropy (8bit):	5.020110364509098
Encrypted:	false
SSDEEP:
MD5:	A8B885C80DE6FF91C678C07445B39866
SHA1:	3FDE5F34BA6A705977940DF4D49BE9D8C8F66BF4
SHA-256:	FE6AB1885F2E932AC9C942DB9ABE192EC52720CED0797B8EAC1A937FC278D882
SHA-512:	98F934293C6D9A5CD1C26341122506BFDC09FA0B73177ED486739241C26727CC582018FB9963A9DD8963B9BFD8195E70F79B71EBA02C6EE79C7E82AE62CB19CE
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-tboidi-relay.screenconnect.com=148.113.163.9-28%2f03%2f2024%2021%3a41%3a58</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\misekgib.newcfg

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	584
Entropy (8bit):	5.018359861133562
Encrypted:	false
SSDEEP:
MD5:	5DF97320D15F98072DB74A81CA78F3C2
SHA1:	02A1491DB041EC2B1DBD395666A342D80DBDED4A
SHA-256:	03262897EAFA91433CBA233E15867BEDCB0FEFCC3886244C58FC664C496CD98A
SHA-512:	D9C82536E8303ED5273F22A89BFF3DE70C6E04028FD44AA211965A09DD632E8CBE53CAE8D1F147B0BFB5869DC616298CCAABFCD62CE23F2286EFA75ED7999D99
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-tboidi-relay.screenconnect.com=148.113.163.9-28%2f03%2f2024%2021%3a41%3a39</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\oqecrn00.newcfg

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	584
Entropy (8bit):	5.016928642812608
Encrypted:	false
SSDEEP:
MD5:	9512BAEC88144758ADF4A51119C5075F
SHA1:	4525A4E4FBE1B043812FEB303AD0B68308678065
SHA-256:	78430C962A8E4631E5D5AEE3D284BCCC33CC63E837FB71F771F1BA498FB6DC51
SHA-512:	4366DF52B17AAC8BF82BA6A32EC7B64EBE5A4D459FB08C0E847DBC9B33BE8851257E074D28F6462399423B38213234F08BF0CAB6446AB62FB174FFE229AA8523
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-tboidi-relay.screenconnect.com=148.113.163.9-28%2f03%2f2024%2021%3a40%3a34</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\pz05t2zv.newcfg

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	584
Entropy (8bit):	5.018050255881193
Encrypted:	false
SSDEEP:
MD5:	26DB83916B2C3F821D943FB650E0924E
SHA1:	7B9B9218E8AC65826ACF90FB64558D87EC01F84D
SHA-256:	50636733D5C14AB5120B6EB500BF73F7697D619296B53A56A6B405C459E91913
SHA-512:	BA06BCA71211C41C6D2183C0D7149847F696128C35A2C494DCD3B24834F554A2A4F2A809C57EA9A0B40D02892A70AC4B5BF07ED8AFC14ED0603B1267BAC6D49E
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-tboidi-relay.screenconnect.com=148.113.163.9-28%2f03%2f2024%2021%3a40%3a39</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\user.config (copy)

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	9512BAEC88144758ADF4A51119C5075F
SHA1:	4525A4E4FBE1B043812FEB303AD0B68308678065
SHA-256:	78430C962A8E4631E5D5AEE3D284BCCC33CC63E837FB71F771F1BA498FB6DC51
SHA-512:	4366DF52B17AAC8BF82BA6A32EC7B64EBE5A4D459FB08C0E847DBC9B33BE8851257E074D28F6462399423B38213234F08BF0CAB6446AB62FB174FFE229AA8523
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-tboidi-relay.screenconnect.com=148.113.163.9-28%2f03%2f2024%2021%3a40%3a34</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\xd1yuia0.newcfg

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\ScreenConnect.ClientService.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	584
Entropy (8bit):	5.018463911566443
Encrypted:	false
SSDEEP:
MD5:	67DEAFB96D579F7D2E0E2FD2C1D7F7E6
SHA1:	82FA027DAEA904D71D7FDAF39B0411F0B3CC5C18
SHA-256:	10990B8D287DA4656D1ECFB46CB38C7C96FB25AD286694961AF0AF08D74F2137
SHA-512:	7DA0F9ACD15269993149EF47DD698CADD54327C14A8E0ABEA1875AF0AA3EEA7B01B1A218CCA6BE3A296CAA78643322931FE6C89BD71BFAE41BE29FD8A540D748
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-tboidi-relay.screenconnect.com=148.113.163.9-28%2f03%2f2024%2021%3a40%3a49</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924\ScreenConnect.ClientService.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61952
Entropy (8bit):	6.0424578422545006
Encrypted:	false
SSDEEP:
MD5:	22AF3A23BD30484514CDACF67C5B3810
SHA1:	E92A4EAEE9D896964DE541CE2F01C2404B638258
SHA-256:	7C5442121DBA2A30AB9579EC08E111DED372CF9CF90FB3256F273980B975AFA9
SHA-512:	95E40B27E90FCE7CA85E76AFBBC16EB62B4BB977664702B987DE2EB2294E6FE9E6DF5610EC7B2362C2C68493313F30FBBCBD3446DBE8AE2FA47B89407F5D5936
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....h............" ..0.............B.... ... ....... .......................`.......l....@.....................................O.... .......................@......D...8............................................ ............... ..H............text...h.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................!.......H........f................................................................(....^.(.......\|...%...}....:.(......}....:.(......}....:.(......}.....~)...%-.&~(.....f...s....%.)...(...+vs....%.}M.........s....(........0...........s....}.....s....}...........}.......($.....}.....(....&.('..........s....o.....('...~...%-.&~(.....g...s....%.*...o ....s!...}.....s"...}.....s#...}...... .... 0u.........s....s;...}....... ..6........s....s;...}.....(%...($............o%........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\ACGAD3OU.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (649), with CRLF line terminators
Category:	modified
Size (bytes):	15220
Entropy (8bit):	3.8131116323885057
Encrypted:	false
SSDEEP:
MD5:	3C8614F20FECAC86D423EFEFC231B42C
SHA1:	8A9ED7B0E7BA742D37DD156CE1817B101955388C
SHA-256:	2E991B9DEB6E3DA6A2745A083AEA246F8CE4485630495CB0D30E1DA2FCD7E701
SHA-512:	1F1119981C746A5EBB32AFB95E2651B2FA181A0F818D6F4487C7A809350D37C6A35A032377980BE7F1410D113C4F9F78772DC00FA19B1C4A2F208DA772B6212E
Malicious:	false
Reputation:	unknown
Preview:	..P.L.A.T.F.O.R.M. .V.E.R.S.I.O.N. .I.N.F.O.......W.i.n.d.o.w.s. .......:. .1.0...0...1.9.0.4.5...0. .(.W.i.n.3.2.N.T.).......C.o.m.m.o.n. .L.a.n.g.u.a.g.e. .R.u.n.t.i.m.e. ...:. .4...0...3.0.3.1.9...4.2.0.0.0.......S.y.s.t.e.m...D.e.p.l.o.y.m.e.n.t...d.l.l. .....:. .4...8...4.6.5.4...0. .b.u.i.l.t. .b.y.:. .N.E.T.4.8.R.E.L.1.L.A.S.T._.B.......c.l.r...d.l.l. .......:. .4...8...4.6.4.5...0. .b.u.i.l.t. .b.y.:. .N.E.T.4.8.R.E.L.1.L.A.S.T._.B.......d.f.d.l.l...d.l.l. .......:. .4...8...4.6.5.4...0. .b.u.i.l.t. .b.y.:. .N.E.T.4.8.R.E.L.1.L.A.S.T._.B.......d.f.s.h.i.m...d.l.l. .......:. .1.0...0...1.9.0.4.1...3.0.0.0.0. .(.W.i.n.B.u.i.l.d...1.6.0.1.0.1...0.8.0.0.).........S.O.U.R.C.E.S.......D.e.p.l.o.y.m.e.n.t. .u.r.l.......:. .h.t.t.p.s.:././.b.a.r.m.a.x.m.i.n.e.r.a.l.s...s.c.r.e.e.n.c.o.n.n.e.c.t...c.o.m./.B.i.n./.S.c.r.e.e.n.C.o.n.n.e.c.t...C.l.i.e.n.t...a.p.p.l.i.c.a.t.i.o.n.?.e.=.S.u.p.p.o.r.t.&.y.=.G.u.e.s.t.&.h.=.i.n.s.t.a.n.c.e.-.t.b.o.i.d.i.-.r.e.l.a.y...s.c.r.e.e.n.c.o.n.n.e.c.t.

C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.Client.dll.genman

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	5.148278749531531
Encrypted:	false
SSDEEP:
MD5:	9CE092E164085CE2566F654314BF99DC
SHA1:	ACEF36091EC262A4C42AA5A5B394C71B13B4767E
SHA-256:	6B36DDCE4021FD15C29CF63C7102E60EDFE2627D1B00EF97D0B4DE3051737439
SHA-512:	95BD7F9315DC181DE529D940E697B652651BC9E954E96FBC059998909259A719AF062548C533D24350C25A159CB113F568EB7C622AE3069CE25FB9224EBF02A6
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.Client" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="23.9.10.8817" />.. <file name="ScreenConnect.Client.dll" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Core" publicKeyToken="4b14c015c87c1ad8" version="23.9.10.8817" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </depende

C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.ClientService.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	95520
Entropy (8bit):	6.505299402844754
Encrypted:	false
SSDEEP:
MD5:	DC615E9D8EC81CBF2E2452516373E5A0
SHA1:	EC83D37A4F45CAEB07B1605324D0315F959452E9
SHA-256:	E9AB064ED381C29A3930F75CA3E05605C6EE07F30A69C043F576A5461DE3BAFC
SHA-512:	82FE00447FB9785264DFB8032399ADF6D33D91D71058212D252742C9E5FD54F5A52F6BAF4FB05E95F9A4055057C60A33A7C1C642F18A6A4E045B49BE88FA5D9F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..qF.qF.qF....qF.....qF....qF.<.B.qF.<.E.qF.<.C.qF....qF.#..qF.qG..qF.2.O.qF.2...qF.2.D.qF.Rich.qF.........................PE..L.....wc...............!.............!............@..................................t....@.................................p...x....`..X............L.. )...p......`!..p............................ ..@............................................text...:........................... ..`.rdata...f.......h..................@..@.data........@.......,..............@....rsrc...X....`.......6..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.Core.dll.genman

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.130181995746891
Encrypted:	false
SSDEEP:
MD5:	6DA6DC34636435E9C2BD1B5FF79091B5
SHA1:	61B6D8C16330FE9063F041BCC025C10DE82D876B
SHA-256:	98D4EDAA86468540D2D17EF17A9BCD7224B128099A51A8F92A65A88950DCB44C
SHA-512:	0BB929107ECFA257DFB2FF7B37955D8C2402287E989C015632A6292362858667A398AD0563103C1324A29585A8177AAA4BCE3C57D867735E40D2CC5C996BD5B9
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.Core" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="23.9.10.8817" />.. <file name="ScreenConnect.Core.dll" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System.Configuration" publicKeyToken="b03f5f7f11d50a3a" version="2.0.0.0" />.. </dependentAssem

C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.Windows.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1716224
Entropy (8bit):	6.635479721420864
Encrypted:	false
SSDEEP:
MD5:	29454A0CB83F28C24805E9A70E53444A
SHA1:	334202965B07AB69F08B16FED0EE6C7274463556
SHA-256:	998CC3F9AF5BD41CCF0F9BE86192BBE20CDEC08A6FF73C1199E1364195A83E14
SHA-512:	62790920974A2F1B018D466AE3E3B5100006A3C8013F43BDB04AF7074CFE5D992CAAEB610DE2B1B72FF0E4ACF8762DB1513A4A0CF331F9A340AE0CE53C3BE895
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L............" ..0..(...........F... ...`....... ..............................lc....@..................................E..O....`.............................. E..8............................................ ............... ..H............text...(&... ...(.................. ..`.rsrc........`.....................@..@.reloc..............................@..B.................E......H.......$...L...........p...0....D........................................()...^.()..........%...}....:.().....}....:.().....}....:.().....}......s.....s+...:.(,.....(-.....{...."..}....J.(/........(0...&:.(,.....(1.....{2..."..}2....0..(........(3......+.............(0...&..X....i2.v.(,....s4...}.....s5...}....f.{......(...+.....o7.....0...........o8....+..o9......(...+&.o....-....,..o................."........{..........o:...&.......(.....*....0..L.......

C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.Windows.dll.genman

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1982
Entropy (8bit):	5.056583067402645
Encrypted:	false
SSDEEP:
MD5:	1FB3A39063C9FBBC9252D1224CF8C89D
SHA1:	0F0622EB6205F515651E055C17D0067A94308721
SHA-256:	199C3F5089B07F1FB6CB343180620B2094BCDDA9E1F6A3F41269C56402D98439
SHA-512:	8C70FF2FE2F1935454AA6BB4CE0998DA1ADCBFE7219F1EAEE4688EE86BBC730DE30347F39B9B1413CBD345D1BF786491ED2F79142D9333DBA3A7F0EDC9F48E3A
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.Windows" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="23.9.10.8817" />.. <file name="ScreenConnect.Windows.dll" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Core" publicKeyToken="4b14c015c87c1ad8" version="23.9.10.8817" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </depen

C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsBackstageShell.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61216
Entropy (8bit):	6.318400837211405
Encrypted:	false
SSDEEP:
MD5:	10DBA57F22A6AB4039330000570F39F8
SHA1:	B8B5C65A89256177DA802C4C9CBD11B013221730
SHA-256:	9BD8D15759F83D99EDD1F2617D59A94E1C2BB4BD7C4977958F5D5F22C5A7C469
SHA-512:	38230B63A4630145608F619D75CA3115C05AB0338FB57566E012DF1BD157123A670A37AE0FEA92351AB7352319A5AF29F9DB3F8BB14962F3F0DE3A4F5A5B754C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...."............"...0.............6.... ........@.. ....................... ............@.....................................O.......,............... )..........(...8............................................ ............... ..H............text...<.... ...................... ..`.rsrc...,...........................@..@.reloc..............................@..B........................H........S...............................................................(....^.(.......a...%...}....:.(......}....:.(......}....:.(......}........0..........(....(....(....(....r...p(....o....(....(....r...p..~....(....(....r9..p..~....(....(.....g~).....(....rY..p.(....&(.....(....s ...(!...s....(".....0...........(#.....($.....(%....s....%.o&...%.o'...%.o(...%s!...o)...%~....o*...}......(....o+...o,....(-.....@...%..(.....o.....s/...}.....{...........s0...o1....s...

C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsClient.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	587040
Entropy (8bit):	6.166636022526366
Encrypted:	false
SSDEEP:
MD5:	5DEC65C4047DE914C78816B8663E3602
SHA1:	8807695EE8345E37EFEC43CBC0874277ED9B0A66
SHA-256:	71602F6B0B27C8B7D8AD624248E6126970939EFFDE785EC913ACE19052E9960E
SHA-512:	27B5DCB5B0AEADF246B91A173D06E5E8D6CF2CD19D86CA358E0A85B84CD9D8F2B26372EF34C3D427F57803D90F2E97CF59692C80C268A71865F08FC0E7CE42D1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsClient.exe, Author: Joe Security Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsClient.exe, Author: Joe Security Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsClient.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...twP..........."...0.................. ........@.. .......................@.......a....@.....................................O....................... )... ..........8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H........7......................`.........................................{F.....{G...V.(H.....}F.....}G......0..A........u,.......4.,/(I....{F....{F...oJ...,.(K....{G....{G...oL...... }.o )UU.Z(I....{F...oM...X )UU.Z(K....{G...oN...X...0..b........r...p......%..{F......%q/..../...-.&.+.../...oO....%..{G......%q0....0...-.&.+...0...oO....(P.....{Q.....{R...V.(H.....}Q.....}R....0..A........u1.......4.,/(I....{Q....{Q...oJ...,.(K....{R....{R...oL...... 1.c. )UU.

C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsClient.exe.genman

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2573
Entropy (8bit):	5.02538862565643
Encrypted:	false
SSDEEP:
MD5:	EFA59A7F55AF829C3974A02F30EBE80C
SHA1:	0FABA6763D910D5EE104E3457045C63CCC5BF79B
SHA-256:	3E2D5CC7867AFA23663D5894127CE6E2880D3075773A249B37576EDA5088875A
SHA-512:	72262B09C21DC4A2B2701A5B32C149349FA3107035D5A115EAC4335E3961DCF12A7A867AEFF595C13AA618EA955B604538C0F4E529CB6A76FFF0CB75927CC74D
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.WindowsClient" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="23.9.10.8817" />.. <file name="ScreenConnect.WindowsClient.exe" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Core" publicKeyToken="4b14c015c87c1ad8" version="23.9.10.8817" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System.Drawing" publicKeyToken="b03f5f7f11d50a3a" version="2.0.

C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsClient.exe.manifest

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (10074), with CRLF line terminators
Category:	dropped
Size (bytes):	17866
Entropy (8bit):	5.957264907751996
Encrypted:	false
SSDEEP:
MD5:	F4B84E283123B025A90BBDE33E2080FD
SHA1:	CC57BFD02228BE76C6E08BDE16996FA992FF0E54
SHA-256:	93F9EB492B6952D8C7AA1EF1EE5A901234BA1FD2D5EF58D24E1FAEF597EA8E02
SHA-512:	ABC92965BF97C37A614B556D2219D06E63687777D79DF5FFB4B5D447DD138C160E5A45CAB76A2353D758AD62960F2E58745F0523881FF6C0EA4CCBCD7ED40002
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <asmv1:assemblyIdentity name="ScreenConnect.WindowsClient.exe" version="23.9.10.8817" publicKeyToken="25b0fbb6ef7eb094" language="neutral" processorArchitecture="msil" type="win32" />.. <application />.. <entryPoint>.. <assemblyIdentity name="ScreenConnect.WindowsClient" version="23.9.10.8817" publicKeyToken="4B14C015C87C1AD8" language="neutral" processorArchitecture="msil" />.. <commandLine file="ScreenConnect.WindowsClient.exe" paramet

C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsClient.exe:Zone.Identifier

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Reputation:	unknown
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Local\Temp\Deployment\7JVGGM9Y.9RB\KZWL13D3.XCX\ScreenConnect.WindowsFileManager.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	81696
Entropy (8bit):	5.850192336318162
Encrypted:	false
SSDEEP:
MD5:	C333D3A6EEB74E4D76C3B9E0F6BFD04C
SHA1:	A39E2643E8DBD2097829E0B08938726557CB8E36
SHA-256:	998D7A0CD6B1A837489E55E99CB992088B9FDE220A1025346A461849E1F50D22
SHA-512:	58CC7741EBE1AADA93FD82A3E0A571A9A1AA3E400C46E7CDDDEF876D74F4FBBCBAE4293AC556B3823E8DC977E7CE72337A16C2D48EAB0AA52B736412AE43C634
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0..@..........B^... ...`....@.. .......................`.......<....@..................................]..O....`.. ............... )...@......<]..8............................................ ............... ..H............text...H>... ...@.................. ..`.rsrc... ....`.......B..............@..@.reloc.......@......................@..B................#^......H...........1...................\........................................(....^.(.......;...%...}....:.(......}....:.(......}....:.(......}........0..........s>....(....(....(....(....(.....(....(......s....}C....s....}B...~@...%-.&~?.....<...s ...%.@.......?...s ........@...s!...}D......A...s"..........(#...&......(#...& .... ...........($...&s....t......r...prs..p(%...(&...~>...%-.&...'...s(...%.>.....A...().......(*........(+...o,...(-...t..........o$.......o%.......

C:\Users\user\AppData\Local\Temp\Deployment\OOG971H4.9P9\Y7E97099.YRX.application

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (63847), with CRLF line terminators
Category:	dropped
Size (bytes):	112936
Entropy (8bit):	5.578736140860222
Encrypted:	false
SSDEEP:
MD5:	75F072DB717ADF065F2D4DDD705A2D49
SHA1:	8165093DE1C610B4CD5B301A6237E923170618C2
SHA-256:	3C7DD342A48BDACB6CC05C422AE960D7BAF899593C7A14A075C70F478F17825C
SHA-512:	AE29ECD9CD13694075681790B909EDF50903AA3820CF278889574969D2D954E1001F0BD89DA6D4670BC08CBF0CDFCBD2CFC6FFC27E3BD16E0A6F1FC3F73C1517
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?><asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xrml="urn:mpeg:mpeg21:2003:01-REL-R-NS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <assemblyIdentity name="ScreenConnect.WindowsClient.application" version="23.9.10.8817" publicKeyToken="25b0fbb6ef7eb094" language="neutral" processorArchitecture="msil" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <description asmv2:publisher="ScreenConnect Software" asmv2:product="ScreenConnect Client" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <deployment install="false" trustURLParameters="tr

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\932a2db58c237abd381d22df4c63a04a_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	87
Entropy (8bit):	3.463057265798253
Encrypted:	false
SSDEEP:
MD5:	D2DED43CE07BFCE4D1C101DFCAA178C8
SHA1:	CE928A1293EA2ACA1AC01B61A344857786AFE509
SHA-256:	8EEE9284E733B9D4F2E5C43F71B81E27966F5CD8900183EB3BB77A1F1160D050
SHA-512:	A05486D523556C75FAAEEFE09BB2F8159A111B1B3560142E19048E6E3898A506EE4EA27DD6A4412EE56A7CE7C21E8152B1CDD92804BAF9FAC43973FABE006A2F
Malicious:	false
Reputation:	unknown
Preview:	......../...............................Microsoft Enhanced Cryptographic Provider v1.0.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 20:39:42 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.994061750988033
Encrypted:	false
SSDEEP:
MD5:	51B09F1BEBDF2F5D965001F5B1327DA4
SHA1:	8DE1DDC0344A216F7E2DBDC58CD3819CEF3B16AB
SHA-256:	B0B9891D6C7F109A6BAB7ED62ABCCDAA44A97B70DDDAC9F758D3A50CC81A84A9
SHA-512:	BE5AE291E344AD1815968A8513077888F4853BD2601CCE2A852618C547D697EE1A32EEB8023432E1A4211FF2624190A2A15CD9317ED31AE5F2BB89146BD2CF86
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......^qX.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\|X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|X......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\|X......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\|X.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V\|X.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........eL......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 20:39:41 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.007770307364548
Encrypted:	false
SSDEEP:
MD5:	67D073750B94AFB08049B8E115028692
SHA1:	F34CD2A3109547770C8E41297FB813E62193D89E
SHA-256:	FF40B7522C19BEA15556A67234F5E8EDD28019964D5605DCBB25B54F9C6025F8
SHA-512:	5FD059C2CE27D85FF60C8CD597AF772C246D2843A90D33028A410068BE5447559FAAD3AE11A5A47636431BCFD5C655344D5100DD4DBDA0E7B970C1E49243AE04
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....%.NqX.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\|X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|X......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\|X......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\|X.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V\|X.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........eL......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.017604899741946
Encrypted:	false
SSDEEP:
MD5:	113206411AC0254AA4CF0608A47065A0
SHA1:	AB2B2330AF247C949F5588199C6D341670F6FB8E
SHA-256:	2D3143D1EFE7FD2A72A5F49FA46563544235174B60ED64E21E0414B109A0EA0F
SHA-512:	C9B6855BDA9092ECEA2E7F740A8722D0837D2180DEE2BBEF5C5872646262A10EF64D4FC363DF0C6259124A7BA077720ED906AAE28658EA3D9D56AFEEA2D0F0C8
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\|X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|X......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\|X......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\|X.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........eL......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 20:39:41 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.008104043733329
Encrypted:	false
SSDEEP:
MD5:	AEA28CCDDB390A6A9BCDC28595705522
SHA1:	43192F1023A9886065DCBA1B5D42CB002969EFAC
SHA-256:	C980BAEB3811FE933DAAA44A0295A42F9023614C1540D5BD28F84B4A5453FB28
SHA-512:	FF54245BA6E9001844BE87F3F4F51AE753A25D22DCFB224B92E5D99B814815B19275125ABA5E66E07A59FE23FE6213E35875D889D8D271C06BF7DC319D15A278
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....HqX.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\|X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|X......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\|X......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\|X.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V\|X.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........eL......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 20:39:41 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9969784838504205
Encrypted:	false
SSDEEP:
MD5:	396F7CD839FC786F5767B37E110BC543
SHA1:	382FA12B258376A0F0D4365608458717FA1B29F8
SHA-256:	A6AFA029E0E171FAF3E3275FAB6672785A266E7A0B48E9DAEC2C2A4312DD3C0C
SHA-512:	CABA91133191705BAD54D1832EC95567F1440B29E48275CDDCAA13174AD48AAF2EBDB3656E91A5691FA77558F45F7993AFE501383E71CA5F5C3D8587992A5471
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....qTqX.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\|X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|X......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\|X......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\|X.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V\|X.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........eL......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 20:39:41 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.010112604309219
Encrypted:	false
SSDEEP:
MD5:	0FA028843954D797B7ADD3F2CF372EBF
SHA1:	98B43C1792697C23760DB16EDE1F938D1D51E428
SHA-256:	99687207C71E0E293920DFA85E6445440C46704079F4ACBEA33F72A6FF4DD921
SHA-512:	10F17003B39C8A62A1CBF32E9612AF9BA5A6A0FE416910596DA691F4F30682E1661C0CBC9144A6E7944F710303A903CFD0A24C71F323F73DF7E2EC782F3205FC
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....z.?qX.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\|X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|X......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\|X......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\|X.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V\|X.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........eL......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Downloads\ScreenConnect.Client.exe (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	8A12242557A55CBB4DA424325DF63911
SHA1:	832FF1786367220A4115DCEBAA579AAB914E7E0B
SHA-256:	17DD6D71E3AF5B3A3A4FE4B72886931411A904C5D0F01A4C40A5144A0FD1233E
SHA-512:	09B12893268CFFDAA00DC315428CB57FD937D0B79ABEF6051C149C69C7B24B4FD1DEBA40610F2F316E87AF12469A35045E8FE4FAA961DB8A9B72A0A02B2A642A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ll..-...-...-..Q...-..Q..-..Q...-..eV...-..eV...-..eV...-...U...-...-...-..kV...-..kV...-..kV...-..Rich.-..................PE..L...9.wc...............!..........................@..........................P.......w....@.....................................<....0.................. 9...@......@...p...............................@...............D............................text...8........................... ..`.rdata...].......^..................@..@.data...............................@....rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\Unconfirmed 748427.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	86304
Entropy (8bit):	6.369212533584497
Encrypted:	false
SSDEEP:
MD5:	8A12242557A55CBB4DA424325DF63911
SHA1:	832FF1786367220A4115DCEBAA579AAB914E7E0B
SHA-256:	17DD6D71E3AF5B3A3A4FE4B72886931411A904C5D0F01A4C40A5144A0FD1233E
SHA-512:	09B12893268CFFDAA00DC315428CB57FD937D0B79ABEF6051C149C69C7B24B4FD1DEBA40610F2F316E87AF12469A35045E8FE4FAA961DB8A9B72A0A02B2A642A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ll..-...-...-..Q...-..Q..-..Q...-..eV...-..eV...-..eV...-...U...-...-...-..kV...-..kV...-..kV...-..Rich.-..................PE..L...9.wc...............!..........................@..........................P.......w....@.....................................<....0.................. 9...@......@...p...............................@...............D............................text...8........................... ..`.rdata...].......^..................@..@.data...............................@....rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\a859b993-1a6c-433e-adfe-3c7effaf6efb.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32405
Entropy (8bit):	6.4961464832295714
Encrypted:	false
SSDEEP:
MD5:	5A7AAE83D93253D5E88BE4572039E8C7
SHA1:	BF4A3DC9978D059BC3A6859B2CE904AD51D7F3C2
SHA-256:	1F714241242956A84159972E356926A3D86E2B7B76362E0FF636711EE2B9767E
SHA-512:	9D4B2103AD759161E2239F016C4779A1DFB759123E2E70608F1CB471E1BA5E77386E99070CA68E802D0449296B8CF3FD329A2B0B49334B90DE030BA6085142BD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ll..-...-...-..Q...-..Q..-..Q...-..eV...-..eV...-..eV...-...U...-...-...-..kV...-..kV...-..kV...-..Rich.-..................PE..L...9.wc...............!..........................@..........................P.......w....@.....................................<....0.................. 9...@......@...p...............................@...............D............................text...8........................... ..`.rdata...].......^..................@..@.data...............................@....rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	2464
Entropy (8bit):	3.2457736875054466
Encrypted:	false
SSDEEP:
MD5:	757E97DD12422CC3A8C8AC1EF5FAB9A4
SHA1:	BCB23DAD51D43A9DFD4B52F5CDCBA8BF75F730BB
SHA-256:	D3E861329E2FAB29C7DEDC24B01AF2A17A0A3BF03DCDECE3A14BF15944C97E60
SHA-512:	9B49E0FD07CA3D4FE0F9A5EBC7D5D93270107982EEDD3E6838244E427029904638860571274803EC83D1FC6B3CDA7BF6005E7C56B33A06B8C9CEA9804608DD3F
Malicious:	false
Reputation:	unknown
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. M.a.r. .. 2.8. .. 2.0.2.4. .2.2.:.4.1.:.0.8.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

Static File Info

General

File type:	HTML document, ASCII text, with CRLF line terminators
Entropy (8bit):	4.612103521212723
TrID:	HyperText Markup Language (12001/1) 66.65% HyperText Markup Language (6006/1) 33.35%
File name:	Facture_160087511.html
File size:	1'522 bytes
MD5:	a357597ee910609541b96d20695b5f72
SHA1:	b8e29385c4cb7f8d38fbdb35fa942eceb6ee9882
SHA256:	a118598b60795591743786e6ca24d1f8aaf4060d01297a1994a4cef8589518c6
SHA512:	5f43d0aa2d0549834e56571549b5b537925f2ddc3892db47f3e13fbd1d1918b55b9ab14ca3b5f0dee43255f3f208be0da18788d5bfb759c8aeebe63d3e561cdd
SSDEEP:	24:2qhNKXxdLgAuAc1Z0wxadMzUaHxvxz6ALplYiduaUMXn0oiWA+xopK/:HqAAPY1sWzUaxvx+ALplHdRXnmJK/
TLSH:	8431AFDB7A1D54BD4473E1314E76E605EA19513320878812BEBD17912F727039C83FD5
File Content Preview:	<html>.. <meta http-equiv="Refresh" content="0; https://svacamp.com/wp-admin/css/css/a8" />.. <head>... </head><script enabled: true,....init: {.....portal: 'gmxfr',.....category: 'logout',.....categorytype: 'content',.....section: 'mail

File Icon


Icon Hash:	173149cccc490307

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Facture_160087511.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_BE4413523710330F97BEE5D4A544C42B

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_BE4413523710330F97BEE5D4A544C42B

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\manifests\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445.cdf-ms

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\manifests\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9.cdf-ms

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\manifests\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9.cdf-ms

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\manifests\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6.cdf-ms

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\manifests\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd.cdf-ms

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\manifests\scre..tion_25b0fbb6ef7eb094_0017.0009_none_4b563d129b766e28.cdf-ms

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\manifests\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924.cdf-ms

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\manifests\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924.manifest

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\ScreenConnect.WindowsClient.exe.config

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9\ScreenConnect.Core.dll

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd\ScreenConnect.Client.dll

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\5yliz2fi.newcfg

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\Client.en-US.resources

C:\Users\user\AppData\Local\Apps\2.0\NKN6D4GD.WE6\GTV6MLEW.9MM\scre..tion_25b0fbb6ef7eb094_0017.0009_0d1f4c192b0d921d\Client.resources

Windows Analysis Report
Facture_160087511.html