Windows Analysis Report
ScreenConnect.Client.exe

Overview

General Information

Sample name:	ScreenConnect.Client.exe
Analysis ID:	1430690
MD5:	88a8d150f1a63302ddc2d5114cfa5df2
SHA1:	0bf2abb33b7fda9ea7a96b68f784684b975e6b92
SHA256:	37fcb2df95b2ba1bc601c6140b1d415ba362ea67834bc13d1eaebbb69a1e5f68
Tags:	exe
Infos:

Detection

ScreenConnect Tool

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	33
Range:	0 - 100

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

.NET source code references suspicious native API functions

Contains functionality to hide user accounts

Enables network access during safeboot for specific services

Machine Learning detection for sample

Reads the Security eventlog

Reads the System eventlog

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Detected potential crypto function

Drops PE files

Drops certificate files (DER)

EXE planting / hijacking vulnerabilities found

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

JA3 SSL client fingerprint seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

May use bcdedit to modify the Windows boot settings

Modifies existing windows services

PE file contains an invalid checksum

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Dfsvc.EXE Network Connection To Uncommon Ports

Stores large binary data to the registry

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected ScreenConnect Tool

Classification

Signatures

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6\ScreenConnect.WindowsClient.exe	Virustotal: Detection: 7%			Perma Link
Source: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.WindowsClient.exe	Virustotal: Detection: 7%			Perma Link

Multi AV Scanner detection for submitted file

Source: ScreenConnect.Client.exe	ReversingLabs: Detection: 23%
Source: ScreenConnect.Client.exe	Virustotal: Detection: 21%			Perma Link

Machine Learning detection for sample

Source: ScreenConnect.Client.exe

Joe Sandbox ML: detected

Cryptography

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\Desktop\ScreenConnect.Client.exe

Code function: 0_2_00091000 LoadLibraryA,GetProcAddress,LocalAlloc,LocalAlloc,GetModuleFileNameW,CreateFileW,SetFilePointer,SetFilePointer,ReadFile,ReadFile,LocalAlloc,SetFilePointer,ReadFile,CertOpenSystemStoreA,LocalFree,CryptQueryObject,CryptMsgGetParam,LocalAlloc,CryptMsgGetParam,CertCreateCertificateContext,CertAddCertificateContextToStore,CertFreeCertificateContext,LocalFree,LocalFree,CryptMsgClose,LoadLibraryA,GetProcAddress,Sleep,CertDeleteCertificateFromStore,CertDeleteCertificateFromStore,CertCloseStore,CloseHandle,LocalFree,LocalFree,

0_2_00091000

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6\ScreenConnect.WindowsClient.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\ScreenConnect.ClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\ScreenConnect.WindowsFileManager.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\ScreenConnect.WindowsBackstageShell.exe	Jump to behavior

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6\ScreenConnect.WindowsClient.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\ScreenConnect.ClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\ScreenConnect.WindowsFileManager.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\ScreenConnect.WindowsBackstageShell.exe	Jump to behavior

Uses 32bit PE files

Source: ScreenConnect.Client.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ScreenConnect.Client.exe

Static PE information: certificate valid

Source: unknown

HTTPS traffic detected: 147.28.128.254:443 -> 192.168.2.6:49714 version: TLS 1.2

Source: ScreenConnect.Client.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Misc\Bootstrapper\Release\ClickOnceRunner.pdb source: ScreenConnect.Client.exe
Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: dfsvc.exe, 00000002.00000002.3084038750.000002CD541D9000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3084038750.000002CD53E9F000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2444186300.00000000024F2000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.3345646904.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.3345293271.0000000001250000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.dll.2.dr, ScreenConnect.ClientService.dll0.2.dr
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000007.00000000.2428596297.0000000000BFD000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr
Source:	Binary string: mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000008.00000002.3343087930.000000000086E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: dfsvc.exe, 00000002.00000002.3084038750.000002CD541D9000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3084038750.000002CD540CF000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3084038750.000002CD54519000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000006.00000002.2447682763.000000001BFB2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Windows.dll0.2.dr, ScreenConnect.Windows.dll.2.dr
Source:	Binary string: ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.Client.pdb source: ScreenConnect.ClientService.exe, 00000008.00000002.3343087930.00000000008A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000006.00000000.2420711709.0000000000CA2000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsClient.exe.2.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: dfsvc.exe, 00000002.00000002.3084038750.000002CD541D9000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3084038750.000002CD53EA8000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000006.00000002.2445850817.00000000014F2000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.3343087930.000000000086E000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.Client.dll.2.dr, ScreenConnect.Client.dll0.2.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb] source: dfsvc.exe, 00000002.00000002.3084038750.000002CD541D9000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3084038750.000002CD53EA8000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000006.00000002.2445850817.00000000014F2000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.3343087930.000000000086E000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.Client.dll.2.dr, ScreenConnect.Client.dll0.2.dr
Source:	Binary string: b.pdb source: ScreenConnect.ClientService.exe, 00000008.00000002.3343087930.00000000007EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdbY/ source: dfsvc.exe, 00000002.00000002.3084038750.000002CD541D9000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3084038750.000002CD53EAC000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2444628670.0000000004B22000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.3343087930.000000000089A000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.Core.dll0.2.dr, ScreenConnect.Core.dll.2.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: dfsvc.exe, 00000002.00000002.3084038750.000002CD541D9000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3084038750.000002CD53EAC000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2444628670.0000000004B22000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.3343087930.000000000089A000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.Core.dll0.2.dr, ScreenConnect.Core.dll.2.dr

Spreading

Source: C:\Users\user\Desktop\ScreenConnect.Client.exe

Code function: 0_2_00094A8B FindFirstFileExA,

0_2_00094A8B

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File opened: C:\Users\user\AppData\Local\Apps\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Networking

Enables network access during safeboot for specific services

Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe

Registry value created: NULL Service

Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=instance-ci40ys-relay.screenconnect.com&p=443&s=f5fa31ab-3d6b-4ee5-bfb2-5ad29218d79d&k=BgIAAACkAABSU0ExAAgAAAEAAQD9W8zoNnWPJoC76yT2IsLormUE81mBMnaWjFNs3fZDUt%2fuPrvind%2f8vwd0BQl3L0KToJz0OEFRb9JGHP3C35cRcpSBwPza6Nz%2fkAsAH0ilFSAm8EWT2EeRPlbvdxwcDAiKBZ83L%2buWfTmIYPnucJuK3Ilz9SL%2ffGZRWRlZKvsfRj3gKzbvZ1GMSafa1764zjIi6OZySfgjZVNBAxrg21rNeq4Q4RYmuEHkOyZ0quLNNoGAclMpQWUsVu3cBwsmOWEqC%2fG4l1BxM563kpsC1GTA3rjAUmyvvkBXzg9HU7hKY%2bllFed5jp%2fhAgzJv6mqZQpOpRNIzwXj41kCzYdVD%2bu0&r=&i=Untitled%20Session HTTP/1.1Host: marcile61.screenconnect.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: marcile61.screenconnect.comAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1Host: marcile61.screenconnect.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1Host: marcile61.screenconnect.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1Host: marcile61.screenconnect.comAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1Host: marcile61.screenconnect.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1Host: marcile61.screenconnect.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1Host: marcile61.screenconnect.comAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1Host: marcile61.screenconnect.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Windows.dll HTTP/1.1Host: marcile61.screenconnect.comAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Core.dll HTTP/1.1Host: marcile61.screenconnect.comAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.dll HTTP/1.1Host: marcile61.screenconnect.comAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.dll HTTP/1.1Host: marcile61.screenconnect.comAccept-Encoding: gzip

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4			Jump to dropped file

Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnect	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnect	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnect	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnect	Jump to behavior

Source: C:\Users\user\Desktop\ScreenConnect.Client.exe	Code function: 0_2_0009A4D5	0_2_0009A4D5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348CD510	2_2_00007FFD348CD510
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348E2531	2_2_00007FFD348E2531
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348D2590	2_2_00007FFD348D2590
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348C2758	2_2_00007FFD348C2758
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348ED77D	2_2_00007FFD348ED77D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348E3229	2_2_00007FFD348E3229
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348CF188	2_2_00007FFD348CF188
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348CA1BF	2_2_00007FFD348CA1BF
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348C327D	2_2_00007FFD348C327D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348E3C9E	2_2_00007FFD348E3C9E
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348BAEF5	2_2_00007FFD348BAEF5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348C97B8	2_2_00007FFD348C97B8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348C2110	2_2_00007FFD348C2110
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348D3101	2_2_00007FFD348D3101
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348B1211	2_2_00007FFD348B1211
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348BD1D9	2_2_00007FFD348BD1D9
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348BF441	2_2_00007FFD348BF441
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348D3A70	2_2_00007FFD348D3A70
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 6_2_00007FFD348DA005	6_2_00007FFD348DA005
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 6_2_00007FFD348C7294	6_2_00007FFD348C7294
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 6_2_00007FFD348CBFB8	6_2_00007FFD348CBFB8
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 6_2_00007FFD348CDFA9	6_2_00007FFD348CDFA9
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 6_2_00007FFD348C112F	6_2_00007FFD348C112F
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 6_2_00007FFD348C91FA	6_2_00007FFD348C91FA
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 6_2_00007FFD348C11FA	6_2_00007FFD348C11FA
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 6_2_00007FFD348C9218	6_2_00007FFD348C9218
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 6_2_00007FFD348C1175	6_2_00007FFD348C1175
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 6_2_00007FFD348C1450	6_2_00007FFD348C1450
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 6_2_00007FFD348C1445	6_2_00007FFD348C1445
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 6_2_00007FFD348C0C40	6_2_00007FFD348C0C40
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Code function: 8_2_04A64F00	8_2_04A64F00
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Code function: 8_2_04A64F00	8_2_04A64F00
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD348A04F4	9_2_00007FFD348A04F4
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD34899EF3	9_2_00007FFD34899EF3
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD3489FED3	9_2_00007FFD3489FED3
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD34896FF2	9_2_00007FFD34896FF2
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD348C7AB0	9_2_00007FFD348C7AB0
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD34899CBD	9_2_00007FFD34899CBD
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD3489D5F8	9_2_00007FFD3489D5F8
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD34898DFA	9_2_00007FFD34898DFA
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD3489D5CF	9_2_00007FFD3489D5CF
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD3489FF1F	9_2_00007FFD3489FF1F
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD3489A771	9_2_00007FFD3489A771
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD3489E9F2	9_2_00007FFD3489E9F2
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD3489E998	9_2_00007FFD3489E998
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD348919CF	9_2_00007FFD348919CF
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD34BA34CF	9_2_00007FFD34BA34CF
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD34BA21F3	9_2_00007FFD34BA21F3
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD34BA4BFC	9_2_00007FFD34BA4BFC
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD34BA6AC5	9_2_00007FFD34BA6AC5

Source: ScreenConnect.WindowsBackstageShell.exe.2.dr, PopoutPanelTaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.2.dr, ProgramTaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.2.dr, TaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'

Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Mutant created: \BaseNamedObjects\Global\netfxeventlog.1.0

Source: C:\Users\user\Desktop\ScreenConnect.Client.exe	Command line argument: kernel32	0_2_00091000
Source: C:\Users\user\Desktop\ScreenConnect.Client.exe	Command line argument: dfsh	0_2_00091000
Source: C:\Users\user\Desktop\ScreenConnect.Client.exe	Command line argument: atio	0_2_00091000
Source: C:\Users\user\Desktop\ScreenConnect.Client.exe	Command line argument: @1#v	0_2_00091000
Source: C:\Users\user\Desktop\ScreenConnect.Client.exe	Command line argument: dfshim	0_2_00091000
Source: C:\Users\user\Desktop\ScreenConnect.Client.exe	Command line argument: dfshim	0_2_00091000

Source: unknown	Process created: C:\Users\user\Desktop\ScreenConnect.Client.exe "C:\Users\user\Desktop\ScreenConnect.Client.exe"
Source: C:\Users\user\Desktop\ScreenConnect.Client.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe"
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=instance-ci40ys-relay.screenconnect.com&p=443&s=f5fa31ab-3d6b-4ee5-bfb2-5ad29218d79d&k=BgIAAACkAABSU0ExAAgAAAEAAQD9W8zoNnWPJoC76yT2IsLormUE81mBMnaWjFNs3fZDUt%2fuPrvind%2f8vwd0BQl3L0KToJz0OEFRb9JGHP3C35cRcpSBwPza6Nz%2fkAsAH0ilFSAm8EWT2EeRPlbvdxwcDAiKBZ83L%2buWfTmIYPnucJuK3Ilz9SL%2ffGZRWRlZKvsfRj3gKzbvZ1GMSafa1764zjIi6OZySfgjZVNBAxrg21rNeq4Q4RYmuEHkOyZ0quLNNoGAclMpQWUsVu3cBwsmOWEqC%2fG4l1BxM563kpsC1GTA3rjAUmyvvkBXzg9HU7hKY%2bllFed5jp%2fhAgzJv6mqZQpOpRNIzwXj41kCzYdVD%2bu0&r=&i=Untitled%20Session" "1"
Source: unknown	Process created: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=instance-ci40ys-relay.screenconnect.com&p=443&s=f5fa31ab-3d6b-4ee5-bfb2-5ad29218d79d&k=BgIAAACkAABSU0ExAAgAAAEAAQD9W8zoNnWPJoC76yT2IsLormUE81mBMnaWjFNs3fZDUt%2fuPrvind%2f8vwd0BQl3L0KToJz0OEFRb9JGHP3C35cRcpSBwPza6Nz%2fkAsAH0ilFSAm8EWT2EeRPlbvdxwcDAiKBZ83L%2buWfTmIYPnucJuK3Ilz9SL%2ffGZRWRlZKvsfRj3gKzbvZ1GMSafa1764zjIi6OZySfgjZVNBAxrg21rNeq4Q4RYmuEHkOyZ0quLNNoGAclMpQWUsVu3cBwsmOWEqC%2fG4l1BxM563kpsC1GTA3rjAUmyvvkBXzg9HU7hKY%2bllFed5jp%2fhAgzJv6mqZQpOpRNIzwXj41kCzYdVD%2bu0&r=&i=Untitled%20Session" "1"
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe" "RunRole" "00bf8db2-e7be-4b91-a934-0cef64fa5596" "User"
Source: C:\Users\user\Desktop\ScreenConnect.Client.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=instance-ci40ys-relay.screenconnect.com&p=443&s=f5fa31ab-3d6b-4ee5-bfb2-5ad29218d79d&k=BgIAAACkAABSU0ExAAgAAAEAAQD9W8zoNnWPJoC76yT2IsLormUE81mBMnaWjFNs3fZDUt%2fuPrvind%2f8vwd0BQl3L0KToJz0OEFRb9JGHP3C35cRcpSBwPza6Nz%2fkAsAH0ilFSAm8EWT2EeRPlbvdxwcDAiKBZ83L%2buWfTmIYPnucJuK3Ilz9SL%2ffGZRWRlZKvsfRj3gKzbvZ1GMSafa1764zjIi6OZySfgjZVNBAxrg21rNeq4Q4RYmuEHkOyZ0quLNNoGAclMpQWUsVu3cBwsmOWEqC%2fG4l1BxM563kpsC1GTA3rjAUmyvvkBXzg9HU7hKY%2bllFed5jp%2fhAgzJv6mqZQpOpRNIzwXj41kCzYdVD%2bu0&r=&i=Untitled%20Session" "1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe" "RunRole" "00bf8db2-e7be-4b91-a934-0cef64fa5596" "User"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Automated click: Run
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Automated click: Run

Source: ScreenConnect.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ScreenConnect.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ScreenConnect.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ScreenConnect.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ScreenConnect.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ScreenConnect.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: ScreenConnect.Client.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: ScreenConnect.Client.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: ScreenConnect.Client.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: ScreenConnect.Client.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: ScreenConnect.Client.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\ScreenConnect.Client.exe	Code function: 0_2_00091C00 push ecx; ret	0_2_00091C13
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD3479D2A5 pushad ; iretd	2_2_00007FFD3479D2A6
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348B845E push eax; ret	2_2_00007FFD348B846D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348C97B8 push esp; iretd	2_2_00007FFD348E56C9
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348B00BD pushad ; iretd	2_2_00007FFD348B00C1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348B842E pushad ; ret	2_2_00007FFD348B845D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348E536D push esp; iretd	2_2_00007FFD348E56C9
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348B7D00 push eax; retf	2_2_00007FFD348B7D1D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FFD348D4B86 push ss; ret	2_2_00007FFD348D4B87
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 6_2_00007FFD348C8615 push es; retf	6_2_00007FFD348C8746
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 6_2_00007FFD348C8942 push eax; iretd	6_2_00007FFD348C89CB
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 6_2_00007FFD348C89CC push eax; iretd	6_2_00007FFD348C89CB
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Code function: 8_2_011BF290 push eax; iretd	8_2_011BF291
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Code function: 8_2_04A672F0 push eax; mov dword ptr [esp], ecx	8_2_04A672F1
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Code function: 8_2_04A6CDE0 pushfd ; ret	8_2_04A6CDE1
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Code function: 8_2_04A64EE0 push eax; mov dword ptr [esp], ecx	8_2_04A64EE1
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD3489845E push eax; ret	9_2_00007FFD3489846D
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD348A0685 pushad ; iretd	9_2_00007FFD348A0859
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD348A0820 pushad ; iretd	9_2_00007FFD348A0859
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD348983D3 pushad ; ret	9_2_00007FFD3489845D
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD34BA8CCC pushad ; iretd	9_2_00007FFD34BA8CCD
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD34BA8CDC push esp; iretd	9_2_00007FFD34BA8CDD
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFD34BA3FC4 push edx; iretd	9_2_00007FFD34BA3FC5

Source: ScreenConnect.ClientService.dll.2.dr	Binary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}
Source: ScreenConnect.ClientService.dll0.2.dr	Binary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}

Source: ScreenConnect.WindowsClient.exe, 00000006.00000002.2447682763.000000001BFB2000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.ClientService.exe, 00000007.00000002.2444186300.00000000024F2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.3345646904.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.3345293271.0000000001250000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.ClientService.dll.2.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.ClientService.dll0.2.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.Windows.dll0.2.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.Windows.dll.2.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Memory allocated: 2CD524C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Memory allocated: 2CD6BE20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Memory allocated: 1260000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Memory allocated: 1AEB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Memory allocated: B90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Memory allocated: 25B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Memory allocated: 45B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Memory allocated: 11B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Memory allocated: 1350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Memory allocated: 11D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Memory allocated: 1210000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Memory allocated: 1ABB0000 memory reserve \| memory write watch

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599663	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599433	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599209	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598858	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597327	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597108	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596452	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596214	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595880	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595530	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595419	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595311	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595200	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595092	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594974	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Window / User API: threadDelayed 2143			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Window / User API: threadDelayed 7537			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file

Windows Analysis Report ScreenConnect.Client.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Signatures

AV Detection

Cryptography

Privilege Escalation

Compliance

Spreading

Networking

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
ScreenConnect.Client.exe

Source: C:\Users\user\Desktop\ScreenConnect.Client.exe TID: 5004	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -30437127721620741s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -599663s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -599433s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -599209s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -599078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -598968s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -598858s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -598750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -598640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -598531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -598421s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -598312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -598093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -597984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -597875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -597765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -597656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -597546s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -597437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -597327s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -597218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -597108s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -597000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -596890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -596781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -596671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -596562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -596452s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -596343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -596214s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -596109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -595999s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -595880s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -595750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -595640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -595530s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -595419s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -595311s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -595200s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -595092s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -594974s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -594828s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -594718s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2448	Thread sleep time: -594609s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7060	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe TID: 5960	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe TID: 5724	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe TID: 5000	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\ScreenConnect.Client.exe	Thread delayed: delay time: 40000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599663	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599433	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599209	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598858	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597327	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597108	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596452	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596214	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595880	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595530	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595419	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595311	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595200	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595092	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594974	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: dfsvc.exe, 00000002.00000002.3094560702.000002CD6E14C000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.3091076826.000002CD6C650000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.3348050615.00000104F885C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ScreenConnect.ClientService.exe, 00000008.00000002.3343087930.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\System\v4.0_4J dn.
Source: dfsvc.exe, 00000002.00000002.3093536337.000002CD6E0A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}i_
Source: svchost.exe, 00000004.00000002.3344952016.00000104F322A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: ScreenConnect.ClientService.exe, 00000008.00000002.3343087930.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\ScreenConnect.Client.exe	Code function: 0_2_000914C4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_000914C4
Source: C:\Users\user\Desktop\ScreenConnect.Client.exe	Code function: 0_2_00091950 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00091950
Source: C:\Users\user\Desktop\ScreenConnect.Client.exe	Code function: 0_2_000945B3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000945B3
Source: C:\Users\user\Desktop\ScreenConnect.Client.exe	Code function: 0_2_00091AE3 SetUnhandledExceptionFilter,	0_2_00091AE3

Source: ScreenConnect.Windows.dll.2.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.VirtualAlloc(attemptImageBase, dwSize, WindowsNative.MEM.MEM_COMMIT \| WindowsNative.MEM.MEM_RESERVE, WindowsNative.PAGE.PAGE_READWRITE)
Source: ScreenConnect.Windows.dll.2.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.LoadLibrary(loadedImageBase + ptr[i].Name)
Source: ScreenConnect.Windows.dll.2.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.GetProcAddress(intPtr, ptr5)
Source: ScreenConnect.Windows.dll.2.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.VirtualProtect(loadedImageBase + sectionHeaders[i].VirtualAddress, (IntPtr)num, flNewProtect, &pAGE)
Source: ScreenConnect.Windows.dll.2.dr, WindowsExtensions.cs	Reference to suspicious API methods: HandleMinder.CreateWithFunc(WindowsNative.OpenProcess(processAccess, bInheritHandle: false, processID), WindowsNative.CloseHandle)

Source: ScreenConnect.WindowsClient.exe, 00000006.00000000.2420711709.0000000000CA2000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsClient.exe.2.dr	Binary or memory string: Progman
Source: ScreenConnect.WindowsClient.exe, 00000006.00000000.2420711709.0000000000CA2000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsClient.exe.2.dr	Binary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.ClientService.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.WindowsBackstageShell.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.WindowsFileManager.exe.config VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.WindowsClient.exe.config VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.WindowsBackstageShell.exe.config VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.WindowsFileManager.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\7MK1B1AL.8X2\77AVXK2Q.JNH\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.Client.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..tion_25b0fbb6ef7eb094_0017.0009_5f48168e1f3e9187\ScreenConnect.ClientService.dll VolumeInformation

Source: Yara match	File source: 6.0.ScreenConnect.WindowsClient.exe.ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.2420711709.0000000000CA2000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3084038750.000002CD540FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2446052274.0000000002F37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dfsvc.exe PID: 1048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ScreenConnect.ClientService.exe PID: 5112, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6\ScreenConnect.WindowsClient.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Apps\2.0\BOZA6RRY.O1R\27GOBDJK.3ZX\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6\ScreenConnect.WindowsClient.exe, type: DROPPED

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.28.128.252	server-nixeba81050-relay.screenconnect.com	United States		3130	RGNET-SEARGnetSeattleWestinEE	false
147.28.128.254	server-nixeba81050-web.screenconnect.com	United States		3130	RGNET-SEARGnetSeattleWestinEE	false