File name:

ScreenConnect.Client.exe

Full analysis: https://app.any.run/tasks/6142cc8a-d352-4009-80bc-b4eb47860241
Verdict: Malicious activity
Analysis date: January 31, 2024, 10:32:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
screenconnect
remote
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

7150093049516F02428DC44433255547

SHA1:

7C658B02232FE31598EB3831DC7B78D112D51B43

SHA256:

988B0D716F274049272F1F55F6DEEA2083BF2792E0FA920D04221609392AB6AA

SSDEEP:

3072:MjLHcVw8licpWQog5Ms+f+l6xPVfqRsmU:MfoocptD5QPVfqRU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • ScreenConnect.Client.exe (PID: 1264)
      • dfsvc.exe (PID: 1316)

    • SCREENCONNECT has been detected (SURICATA)

      • ScreenConnect.ClientService.exe (PID: 3584)

    • Connects to the CnC server

      • ScreenConnect.ClientService.exe (PID: 3584)

  • SUSPICIOUS

    • Reads the Internet Settings

      • dfsvc.exe (PID: 1316)
      • ScreenConnect.WindowsClient.exe (PID: 3264)
      • ScreenConnect.ClientService.exe (PID: 3432)
      • ScreenConnect.WindowsClient.exe (PID: 3644)

    • Checks Windows Trust Settings

      • dfsvc.exe (PID: 1316)

    • Reads settings of System Certificates

      • dfsvc.exe (PID: 1316)

    • Executable content was dropped or overwritten

      • dfsvc.exe (PID: 1316)

    • Reads Internet Explorer settings

      • dfsvc.exe (PID: 1316)

    • The process creates files with name similar to system file names

      • dfsvc.exe (PID: 1316)

    • Executes as Windows Service

      • ScreenConnect.ClientService.exe (PID: 3584)

    • Creates or modifies Windows services

      • ScreenConnect.ClientService.exe (PID: 3584)

  • INFO

    • Checks supported languages

      • dfsvc.exe (PID: 1316)
      • ScreenConnect.Client.exe (PID: 1264)
      • ScreenConnect.WindowsClient.exe (PID: 3264)
      • ScreenConnect.ClientService.exe (PID: 3432)
      • ScreenConnect.ClientService.exe (PID: 3584)
      • ScreenConnect.WindowsClient.exe (PID: 3644)

    • Reads the machine GUID from the registry

      • ScreenConnect.Client.exe (PID: 1264)
      • ScreenConnect.WindowsClient.exe (PID: 3264)
      • ScreenConnect.ClientService.exe (PID: 3432)
      • ScreenConnect.ClientService.exe (PID: 3584)
      • ScreenConnect.WindowsClient.exe (PID: 3644)
      • dfsvc.exe (PID: 1316)

    • Reads Environment values

      • dfsvc.exe (PID: 1316)

    • Create files in a temporary directory

      • dfsvc.exe (PID: 1316)

    • Process checks whether UAC notifications are on

      • dfsvc.exe (PID: 1316)

    • Reads the computer name

      • ScreenConnect.WindowsClient.exe (PID: 3264)
      • ScreenConnect.ClientService.exe (PID: 3432)
      • ScreenConnect.ClientService.exe (PID: 3584)
      • ScreenConnect.WindowsClient.exe (PID: 3644)
      • dfsvc.exe (PID: 1316)
      • ScreenConnect.Client.exe (PID: 1264)

    • Creates files or folders in the user directory

      • ScreenConnect.WindowsClient.exe (PID: 3264)
      • ScreenConnect.ClientService.exe (PID: 3584)
      • dfsvc.exe (PID: 1316)

    • Checks proxy server information

      • dfsvc.exe (PID: 1316)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:11:18 20:55:37+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.33
CodeSize: 40448
InitializedDataSize: 32768
UninitializedDataSize: -
EntryPoint: 0x14ba
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start screenconnect.client.exe no specs dfsvc.exe screenconnect.windowsclient.exe no specs screenconnect.clientservice.exe #SCREENCONNECT screenconnect.clientservice.exe screenconnect.windowsclient.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1264"C:\Users\admin\AppData\Local\Temp\ScreenConnect.Client.exe" C:\Users\admin\AppData\Local\Temp\ScreenConnect.Client.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\screenconnect.client.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\rpcrt4.dll
1316"C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
ScreenConnect.Client.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
ClickOnce
Exit code:
0
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\dfsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3264"C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\AK6KX289.K1P\scre..tion_25b0fbb6ef7eb094_0017.0008_ee6bfe2a31070370\ScreenConnect.WindowsClient.exe"C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\AK6KX289.K1P\scre..tion_25b0fbb6ef7eb094_0017.0008_ee6bfe2a31070370\ScreenConnect.WindowsClient.exe—dfsvc.exe
User:
admin
Company:
ScreenConnect Software
Integrity Level:
MEDIUM
Description:
ScreenConnect Client
Exit code:
0
Version:
23.8.5.8707
Modules
Images
c:\users\admin\appdata\local\apps\2.0\oqvlxtzk.4p5\ak6kx289.k1p\scre..tion_25b0fbb6ef7eb094_0017.0008_ee6bfe2a31070370\screenconnect.windowsclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3432"C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\AK6KX289.K1P\scre..tion_25b0fbb6ef7eb094_0017.0008_ee6bfe2a31070370\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=instance-bdrytd-relay.screenconnect.com&p=443&s=0b85d2eb-e041-4193-977c-a03d182a723e&k=BgIAAACkAABSU0ExAAgAAAEAAQDhnL1HzNft%2bzSPnKk7DUS25fGxBI0tNPA0ebXvxdSDZVjM%2be6zspppgBrAodbYzrEMZalCy0NOH7nKSnrdKOD7L%2bPab4%2b8Nud109ctPsfalL31%2ftzFjSfSuXtUjymtvcvvdbCNqEmoluqHStxJqAF2n22nU7adRgc8lJh4E6f8%2f%2f7zheeuDq51ljW%2fpjvNsTWd34eYfFErBU7%2fF00zcMI7t1Pg%2fCB%2fUO6rwjPWugmpwhLTKEEOja5iPvHUCscX2T19LFJ84Hu%2f7cZEnp27xq0sZmvoYTw2Fv8f2iieRsO9369fkn1vIRxgQbRYABH0wrFJJ9PVF3si96wNxaJIsurd&r=&i=" "1"C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\AK6KX289.K1P\scre..tion_25b0fbb6ef7eb094_0017.0008_ee6bfe2a31070370\ScreenConnect.ClientService.exe
ScreenConnect.WindowsClient.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
23.8.5.8707
Modules
Images
c:\users\admin\appdata\local\apps\2.0\oqvlxtzk.4p5\ak6kx289.k1p\scre..tion_25b0fbb6ef7eb094_0017.0008_ee6bfe2a31070370\screenconnect.clientservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3584"C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\AK6KX289.K1P\scre..tion_25b0fbb6ef7eb094_0017.0008_ee6bfe2a31070370\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=instance-bdrytd-relay.screenconnect.com&p=443&s=0b85d2eb-e041-4193-977c-a03d182a723e&k=BgIAAACkAABSU0ExAAgAAAEAAQDhnL1HzNft%2bzSPnKk7DUS25fGxBI0tNPA0ebXvxdSDZVjM%2be6zspppgBrAodbYzrEMZalCy0NOH7nKSnrdKOD7L%2bPab4%2b8Nud109ctPsfalL31%2ftzFjSfSuXtUjymtvcvvdbCNqEmoluqHStxJqAF2n22nU7adRgc8lJh4E6f8%2f%2f7zheeuDq51ljW%2fpjvNsTWd34eYfFErBU7%2fF00zcMI7t1Pg%2fCB%2fUO6rwjPWugmpwhLTKEEOja5iPvHUCscX2T19LFJ84Hu%2f7cZEnp27xq0sZmvoYTw2Fv8f2iieRsO9369fkn1vIRxgQbRYABH0wrFJJ9PVF3si96wNxaJIsurd&r=&i=" "1"C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\AK6KX289.K1P\scre..tion_25b0fbb6ef7eb094_0017.0008_ee6bfe2a31070370\ScreenConnect.ClientService.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Version:
23.8.5.8707
Modules
Images
c:\users\admin\appdata\local\apps\2.0\oqvlxtzk.4p5\ak6kx289.k1p\scre..tion_25b0fbb6ef7eb094_0017.0008_ee6bfe2a31070370\screenconnect.clientservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3644"C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\AK6KX289.K1P\scre..tion_25b0fbb6ef7eb094_0017.0008_ee6bfe2a31070370\ScreenConnect.WindowsClient.exe" "RunRole" "ae592f8a-353e-45ae-92e0-dbf56ad302a7" "User"C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\AK6KX289.K1P\scre..tion_25b0fbb6ef7eb094_0017.0008_ee6bfe2a31070370\ScreenConnect.WindowsClient.exe—ScreenConnect.ClientService.exe
User:
admin
Company:
ScreenConnect Software
Integrity Level:
MEDIUM
Description:
ScreenConnect Client
Exit code:
0
Version:
23.8.5.8707
Modules
Images
c:\users\admin\appdata\local\apps\2.0\oqvlxtzk.4p5\ak6kx289.k1p\scre..tion_25b0fbb6ef7eb094_0017.0008_ee6bfe2a31070370\screenconnect.windowsclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
6 285
Read events
6 185
Write events
74
Delete events
26

Modification events

(PID) Process:(1264) ScreenConnect.Client.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1316) dfsvc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1316) dfsvc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1316) dfsvc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1316) dfsvc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1316) dfsvc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1316) dfsvc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1316) dfsvc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1316) dfsvc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1316) dfsvc.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
14
Suspicious files
12
Text files
21
Unknown types
0

Dropped files

PID
Process
Filename
Type
1316dfsvc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1binary
MD5:EF0BB0B4955D2B1F3C7F8314BB90D0EC
SHA256:272934573D3977FD8DC3A511CC271B32946687A88DEE387B53DD3889C9BC59E3
1316dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\Z52N0P8Z.O6X\QE7YV0QC.9H7\ScreenConnect.ClientService.exeexecutable
MD5:89D3D099B6D8731BD1B7F5A68B5BF17C
SHA256:BCAA3D8DCBA6BA08BF20077EADD0B31F58A1334B7B9C629E475694C4EEAFD924
1316dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\554G0OLD.D0X\LVP73XPB.MQ5.applicationxml
MD5:91CDA0F600C8490A526496E5280517CD
SHA256:74D8A6062A729074AA84A1A749F548913DC76C76BC9422641CC1FCE68659556B
1316dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\Z52N0P8Z.O6X\QE7YV0QC.9H7\ScreenConnect.Windows.dllexecutable
MD5:44B736A074B7E0BBE0C6C5F7DEBE0F3D
SHA256:F8C648E09FB42F145B581ED80B2A0C88E9F18041EFD03AD3187A6229F17A14B8
1316dfsvc.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\932a2db58c237abd381d22df4c63a04a_90059c37-1320-41a4-b58d-2b75a9850d2fbinary
MD5:D2DED43CE07BFCE4D1C101DFCAA178C8
SHA256:8EEE9284E733B9D4F2E5C43F71B81E27966F5CD8900183EB3BB77A1F1160D050
1316dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\Z52N0P8Z.O6X\QE7YV0QC.9H7\ScreenConnect.WindowsClient.exe.manifestxml
MD5:B1376C175C8E9405782533E9965FFD7A
SHA256:F4D3D51A60563B7576AB06871BC7EBC0AECE4AB21C1732F92C66F8ED292CAD09
1316dfsvc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1binary
MD5:D91299E84355CD8D5A86795A0118B6E9
SHA256:46011EDE1C147EB2BC731A539B7C047B7EE93E48B9D3C3BA710CE132BBDFAC6B
1316dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\Z52N0P8Z.O6X\QE7YV0QC.9H7\ScreenConnect.WindowsBackstageShell.exeexecutable
MD5:8A33D1DF21EB0CE18135B6DFC81EFAF5
SHA256:0C24251EA5D08874813DDD046D4B8D45CD1A45830F4D948401123DF5BB372AD9
1316dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\Z52N0P8Z.O6X\QE7YV0QC.9H7\ScreenConnect.WindowsClient.exe.configxml
MD5:728175E20FFBCEB46760BB5E1112F38B
SHA256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
1316dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\Z52N0P8Z.O6X\QE7YV0QC.9H7\ScreenConnect.WindowsBackstageShell.exe.configxml
MD5:728175E20FFBCEB46760BB5E1112F38B
SHA256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
7
DNS requests
4
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1316
dfsvc.exe
GET
200
192.229.221.95:80
http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt
unknown
binary
1.68 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1316
dfsvc.exe
147.75.80.222:443
rantest.screenconnect.com
PACKET
NL
unknown
1316
dfsvc.exe
192.229.221.95:80
cacerts.digicert.com
EDGECAST
US
whitelisted
3584
ScreenConnect.ClientService.exe
147.75.80.220:443
instance-bdrytd-relay.screenconnect.com
PACKET
NL
unknown

DNS requests

Domain
IP
Reputation
rantest.screenconnect.com
  • 147.75.80.222
unknown
cacerts.digicert.com
  • 192.229.221.95
whitelisted
instance-bdrytd-relay.screenconnect.com
  • 147.75.80.220
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO Observed DNS Query to Known ScreenConnect/ConnectWise Remote Desktop Service Domain
1080
svchost.exe
Misc activity
ET INFO Observed DNS Query to Known ScreenConnect/ConnectWise Remote Desktop Service Domain
1080
svchost.exe
Misc activity
ET INFO Observed DNS Query to Known ScreenConnect/ConnectWise Remote Desktop Service Domain
3584
ScreenConnect.ClientService.exe
Misc activity
ET INFO ScreenConnect/ConnectWise Initial Checkin Packet M2
3584
ScreenConnect.ClientService.exe
Potential Corporate Privacy Violation
REMOTE [ANY.RUN] ScreenConnect Server Response
Process
Message
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status Originated: -1073741772 *** Source File: d:\iso_whid\x86fre\base\isolation\win32\isoreg_direct.cpp, line 1127
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status Originated: -1073741772 *** Source File: d:\iso_whid\x86fre\base\isolation\win32\isoreg_direct.cpp, line 1127
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ScreenConnect.Client.exe