File name:

ScreenConnect.WindowsClient.zip

Full analysis: https://app.any.run/tasks/25dd3696-1845-457d-88fb-80762f125c77
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: June 12, 2025, 15:03:48
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
screenconnect
rmm-tool
remote
rat
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

4E9A2C98CF85C6DAADA6EC482D8A7F03

SHA1:

F34F17C6CDA093091B76A40DAD270E797A2018AA

SHA256:

D0039D625C31104A0F64ACE6C52591ED7864E5B36EACF1E2042DEE620FFBB26F

SSDEEP:

6144:xl+fgc7H+MhpSf3ow4HABWSEFHgoqVdKwBKnMQq7XM:mfgcr+YS7wAsSEfqVdzKnMQ28

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 2044)

    • SCREENCONNECT has been detected (SURICATA)

      • ScreenConnect.ClientService.exe (PID: 5232)

  • SUSPICIOUS

    • Adds/modifies Windows certificates

      • ScreenConnect.Client.exe (PID: 5876)
      • dfsvc.exe (PID: 4816)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 2044)
      • dfsvc.exe (PID: 4816)
      • ScreenConnect.WindowsClient.exe (PID: 6704)
      • ScreenConnect.ClientService.exe (PID: 3584)
      • ScreenConnect.ClientService.exe (PID: 5232)
      • ScreenConnect.WindowsClient.exe (PID: 6172)
      • ScreenConnect.WindowsClient.exe (PID: 4692)

    • The process creates files with name similar to system file names

      • dfsvc.exe (PID: 4816)

    • Executable content was dropped or overwritten

      • dfsvc.exe (PID: 4816)

    • Reads the date of Windows installation

      • dfsvc.exe (PID: 4816)
      • ScreenConnect.WindowsClient.exe (PID: 6704)

    • Executes as Windows Service

      • ScreenConnect.ClientService.exe (PID: 5232)

    • SCREENCONNECT mutex has been found

      • ScreenConnect.ClientService.exe (PID: 5232)

    • Creates or modifies Windows services

      • ScreenConnect.ClientService.exe (PID: 5232)

    • Potential Corporate Privacy Violation

      • ScreenConnect.ClientService.exe (PID: 5232)

    • Detects ScreenConnect RAT (YARA)

      • ScreenConnect.ClientService.exe (PID: 5232)
      • ScreenConnect.WindowsClient.exe (PID: 6172)

    • There is functionality for taking screenshot (YARA)

      • ScreenConnect.ClientService.exe (PID: 5232)
      • ScreenConnect.WindowsClient.exe (PID: 6172)

    • Screenconnect has been detected

      • ScreenConnect.ClientService.exe (PID: 5232)

    • Reads Internet Explorer settings

      • dfsvc.exe (PID: 4816)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2044)

    • Disables trace logs

      • dfsvc.exe (PID: 4816)

    • Checks proxy server information

      • dfsvc.exe (PID: 4816)
      • slui.exe (PID: 1036)

    • Creates files or folders in the user directory

      • dfsvc.exe (PID: 4816)
      • ScreenConnect.WindowsClient.exe (PID: 6704)
      • ScreenConnect.ClientService.exe (PID: 5232)

    • Checks supported languages

      • ScreenConnect.Client.exe (PID: 5876)
      • dfsvc.exe (PID: 4816)
      • ScreenConnect.WindowsClient.exe (PID: 6704)
      • ScreenConnect.ClientService.exe (PID: 3584)
      • ScreenConnect.ClientService.exe (PID: 5232)

    • Reads the machine GUID from the registry

      • ScreenConnect.Client.exe (PID: 5876)
      • dfsvc.exe (PID: 4816)
      • ScreenConnect.WindowsClient.exe (PID: 6704)
      • ScreenConnect.ClientService.exe (PID: 3584)
      • ScreenConnect.WindowsClient.exe (PID: 6172)
      • ScreenConnect.WindowsClient.exe (PID: 4692)
      • ScreenConnect.ClientService.exe (PID: 5232)

    • Create files in a temporary directory

      • dfsvc.exe (PID: 4816)

    • Reads the computer name

      • dfsvc.exe (PID: 4816)
      • ScreenConnect.WindowsClient.exe (PID: 6704)
      • ScreenConnect.ClientService.exe (PID: 3584)
      • ScreenConnect.ClientService.exe (PID: 5232)
      • ScreenConnect.WindowsClient.exe (PID: 4692)
      • ScreenConnect.Client.exe (PID: 5876)

    • Process checks whether UAC notifications are on

      • dfsvc.exe (PID: 4816)

    • Reads the software policy settings

      • dfsvc.exe (PID: 4816)
      • slui.exe (PID: 1036)

    • Process checks computer location settings

      • dfsvc.exe (PID: 4816)
      • ScreenConnect.WindowsClient.exe (PID: 6704)

    • SCREENCONNECT has been detected

      • ScreenConnect.ClientService.exe (PID: 5232)

    • Reads CPU info

      • ScreenConnect.WindowsClient.exe (PID: 4692)

    • Reads Environment values

      • dfsvc.exe (PID: 4816)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 1980:00:00 00:00:00
ZipCRC: 0x2884b533
ZipCompressedSize: 138594
ZipUncompressedSize: 311376
ZipFileName: ScreenConnect.Client.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
9
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe screenconnect.client.exe no specs dfsvc.exe screenconnect.windowsclient.exe no specs screenconnect.clientservice.exe #SCREENCONNECT screenconnect.clientservice.exe #SCREENCONNECT screenconnect.windowsclient.exe no specs slui.exe screenconnect.windowsclient.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1036C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2044"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\ScreenConnect.WindowsClient.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3584"C:\Users\admin\AppData\Local\Apps\2.0\Q89GZ7EA.N1L\828BD210.NGP\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=instance-zkt3lw-relay.screenconnect.com&p=443&s=ded44076-4a17-48b4-b38e-56255216ae56&k=BgIAAACkAABSU0ExAAgAAAEAAQApCIs%2b9wll18Q4sfn%2fDve8Y58pIWRIsi89UIBP6tw%2foUsvk9v5UQuS%2fnOOgqKczhGqj%2bLi18Sjxe2boWK5K7sDnWybhxGGSBuJMFO2v3tdB744GU5FbrrfaagzwxBwuOhoQSCO4evKle19pdMtC2mNL1lT5NTFk0VCwPCZLTean5AwWEH4bLQIdgC%2fzeBW0B1vbbUM2fnPed5MVI8bc15NstUSX%2fwZqKPO4klD6tCY6VaUIoEDURbFCvOyipNoBqgoDTn2T62CFFErCwlPHCT2cf7bi3JL6ty4rHOWwNK8HYYXUgs5AT7RVdIDJD0UOmqSF3eyLmaog6DB8TopH%2fy%2f&r=&i=Untitled%20Session" "1"C:\Users\admin\AppData\Local\Apps\2.0\Q89GZ7EA.N1L\828BD210.NGP\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\ScreenConnect.ClientService.exe
ScreenConnect.WindowsClient.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
25.4.16.9293
Modules
Images
c:\users\admin\appdata\local\apps\2.0\q89gz7ea.n1l\828bd210.ngp\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\screenconnect.clientservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
4692"C:\Users\admin\AppData\Local\Apps\2.0\Q89GZ7EA.N1L\828BD210.NGP\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\ScreenConnect.WindowsClient.exe" "RunRole" "cdff2f64-7124-4326-89cd-935d321fe5ee" "System"C:\Users\admin\AppData\Local\Apps\2.0\Q89GZ7EA.N1L\828BD210.NGP\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\ScreenConnect.WindowsClient.exe—ScreenConnect.ClientService.exe
User:
SYSTEM
Company:
ScreenConnect Software
Integrity Level:
SYSTEM
Description:
ScreenConnect Client
Exit code:
0
Version:
25.4.16.9293
Modules
Images
c:\users\admin\appdata\local\apps\2.0\q89gz7ea.n1l\828bd210.ngp\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\screenconnect.windowsclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4816"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
ScreenConnect.Client.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
ClickOnce
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\dfsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5232"C:\Users\admin\AppData\Local\Apps\2.0\Q89GZ7EA.N1L\828BD210.NGP\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=instance-zkt3lw-relay.screenconnect.com&p=443&s=ded44076-4a17-48b4-b38e-56255216ae56&k=BgIAAACkAABSU0ExAAgAAAEAAQApCIs%2b9wll18Q4sfn%2fDve8Y58pIWRIsi89UIBP6tw%2foUsvk9v5UQuS%2fnOOgqKczhGqj%2bLi18Sjxe2boWK5K7sDnWybhxGGSBuJMFO2v3tdB744GU5FbrrfaagzwxBwuOhoQSCO4evKle19pdMtC2mNL1lT5NTFk0VCwPCZLTean5AwWEH4bLQIdgC%2fzeBW0B1vbbUM2fnPed5MVI8bc15NstUSX%2fwZqKPO4klD6tCY6VaUIoEDURbFCvOyipNoBqgoDTn2T62CFFErCwlPHCT2cf7bi3JL6ty4rHOWwNK8HYYXUgs5AT7RVdIDJD0UOmqSF3eyLmaog6DB8TopH%2fy%2f&r=&i=Untitled%20Session" "1"C:\Users\admin\AppData\Local\Apps\2.0\Q89GZ7EA.N1L\828BD210.NGP\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\ScreenConnect.ClientService.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Version:
25.4.16.9293
Modules
Images
c:\users\admin\appdata\local\apps\2.0\q89gz7ea.n1l\828bd210.ngp\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\screenconnect.clientservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shlwapi.dll
c:\windows\syswow64\msvcrt.dll
5876"C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.45412\ScreenConnect.Client.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.45412\ScreenConnect.Client.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2044.45412\screenconnect.client.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\crypt32.dll
6172"C:\Users\admin\AppData\Local\Apps\2.0\Q89GZ7EA.N1L\828BD210.NGP\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\ScreenConnect.WindowsClient.exe" "RunRole" "146a3a41-c470-4482-ba78-2b89079ba736" "User"C:\Users\admin\AppData\Local\Apps\2.0\Q89GZ7EA.N1L\828BD210.NGP\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\ScreenConnect.WindowsClient.exe
ScreenConnect.ClientService.exe
User:
admin
Company:
ScreenConnect Software
Integrity Level:
MEDIUM
Description:
ScreenConnect Client
Version:
25.4.16.9293
Modules
Images
c:\users\admin\appdata\local\apps\2.0\q89gz7ea.n1l\828bd210.ngp\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\screenconnect.windowsclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6704"C:\Users\admin\AppData\Local\Apps\2.0\Q89GZ7EA.N1L\828BD210.NGP\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\ScreenConnect.WindowsClient.exe" C:\Users\admin\AppData\Local\Apps\2.0\Q89GZ7EA.N1L\828BD210.NGP\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\ScreenConnect.WindowsClient.exe—dfsvc.exe
User:
admin
Company:
ScreenConnect Software
Integrity Level:
MEDIUM
Description:
ScreenConnect Client
Exit code:
0
Version:
25.4.16.9293
Modules
Images
c:\users\admin\appdata\local\apps\2.0\q89gz7ea.n1l\828bd210.ngp\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\screenconnect.windowsclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
11 205
Read events
10 987
Write events
186
Delete events
32

Modification events

(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\ScreenConnect.WindowsClient.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4816) dfsvc.exeKey:HKEY_CLASSES_ROOT\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0
Operation:writeName:ComponentStore_RandomString
Value:
6BP21KKY0L6P2M6MOO4TA1YB
(PID) Process:(4816) dfsvc.exeKey:HKEY_CLASSES_ROOT\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0
Operation:delete valueName:ComponentStore_RandomString
Value:
6BP21KKY0L6P2M6MOO4TA1YB
Executable files
17
Suspicious files
23
Text files
31
Unknown types
5

Dropped files

PID
Process
Filename
Type
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.45412\Icon32.pngimage
MD5:675D24450479450267197E1A31C04B83
SHA256:D997F12E2BE8CD581879F44263040C9816ABC650CCF0E941D74CAF3CBDE9892F
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.45412\Client.Override.en-US.resourcesbinary
MD5:B097FC68ED629CDE4235006640AA1D2B
SHA256:C5126E61BBA75E9641F858170CACAE88FDD9407BEA6D5906E26DD7ACEF9E4C38
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.45412\ApplicationURL.txtbinary
MD5:15159B608C3531EFF6B0749CF4C531EF
SHA256:2C96D9DE6E5B9FB82908F687C2CA6D99AC7B1DD7EF44088598240826E912E34C
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.45412\Client.Override.resourcesbinary
MD5:ACD885FEAEFA19AA029DA01D3AB3AAAD
SHA256:D936E1C2625076BC61697C94830E8AFAF550063FF9F607520D6EBD25AC3D8CFD
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.45412\Icon16.pngimage
MD5:391859500741FD08F899EB133DD9A6C1
SHA256:AB6E20F61314FFE25F857ECF5EE08827A98BAC843516E1DFBF3B287D3A59E736
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.45412\Client.resourcesbinary
MD5:AF3340A5BCFE20E75ED0211DA310D83B
SHA256:E0D0E5D951EF955F22D110B65B3FEDFB8B1710491563D7C541F5E3D9FD4CCEE8
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.45412\ScreenConnect.Client.exeexecutable
MD5:BAE2933497C5E6E754F902DE82A43E77
SHA256:2ACFAEEF1A3378264B2EE4C3EBD88E146F67D9B42F11AEC6F0ADF025B6B76462
4816dfsvc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBbinary
MD5:1A9056D061F62157CBD6833C50B76854
SHA256:B26D3370C5E83202F8E91D5CEBBD13ACF58BCC728FB89DDACCD306B418025632
4816dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\6EVZ4L2B.27W\QJZ0W6GP.Z69.applicationxml
MD5:9AA1140E1D673F42C93BB7C21DCC0C87
SHA256:29DAD264F2CDB9708E45E9CE894E3642B1369AFE669EF48C1D76064AE972705B
4816dfsvc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56Abinary
MD5:073B9440CFC3DBAD2EA4FC1A69DEAB53
SHA256:FBB6299243AAA67AF938DF08DDAF29D41F7D560418BD70E1642C096E01001E49
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
30
DNS requests
20
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4816
dfsvc.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRbuhDibVrw1t5r3WYz1C9Jl6I%2FtwQU729TSunkBnx6yuKQVvYv1Ensy04CEAqA7xhLjfEFgtHEdqeVdGg%3D
unknown
—
—
whitelisted
7020
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4816
dfsvc.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
4816
dfsvc.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRbuhDibVrw1t5r3WYz1C9Jl6I%2FtwQU729TSunkBnx6yuKQVvYv1Ensy04CEAqA7xhLjfEFgtHEdqeVdGg%3D
unknown
—
—
whitelisted
4816
dfsvc.exe
GET
200
2.23.77.188:80
http://crl3.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crl
unknown
—
—
whitelisted
4816
dfsvc.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
4816
dfsvc.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEANYKLWC2MChk8S6PF3PEBE%3D
unknown
—
—
whitelisted
6336
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6012
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7020
svchost.exe
40.126.32.76:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7020
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2336
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
1268
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
login.live.com
  • 40.126.32.76
  • 40.126.32.74
  • 40.126.32.140
  • 40.126.32.136
  • 20.190.160.130
  • 20.190.160.2
  • 20.190.160.20
  • 20.190.160.67
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.249
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 2.23.181.156
  • 2.16.253.202
whitelisted
techvormm.screenconnect.com
  • 147.28.147.238
whitelisted
crl3.digicert.com
  • 2.23.77.188
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.29
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Misc activity
ET REMOTE_ACCESS Observed DNS Query to Known ScreenConnect/ConnectWise Remote Desktop Service Domain
2200
svchost.exe
Misc activity
ET REMOTE_ACCESS Observed DNS Query to Known ScreenConnect/ConnectWise Remote Desktop Service Domain
5232
ScreenConnect.ClientService.exe
Potential Corporate Privacy Violation
REMOTE [ANY.RUN] ScreenConnect Server Response
Process
Message
dfsvc.exe
*** Status originated: -1073741811 *** Source File: onecore\com\netfx\windowsbuilt\iso_legacy\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: onecore\com\netfx\windowsbuilt\iso_legacy\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: onecore\com\netfx\windowsbuilt\iso_legacy\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: onecore\com\netfx\windowsbuilt\iso_legacy\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741772 *** Source File: onecore\com\netfx\windowsbuilt\iso_legacy\base\isolation\win32\isoreg_direct.cpp, line 1127
dfsvc.exe
*** Status originated: -1073741772 *** Source File: onecore\com\netfx\windowsbuilt\iso_legacy\base\isolation\win32\isoreg_direct.cpp, line 1127
dfsvc.exe
*** Status originated: -1073741811 *** Source File: onecore\com\netfx\windowsbuilt\iso_legacy\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: onecore\com\netfx\windowsbuilt\iso_legacy\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741772 *** Source File: onecore\com\netfx\windowsbuilt\iso_legacy\base\isolation\win32\isoreg_direct.cpp, line 1127
dfsvc.exe
*** Status originated: -1073741811 *** Source File: onecore\com\netfx\windowsbuilt\iso_legacy\base\isolation\hier_hierarchy.cpp, line 230
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ScreenConnect.WindowsClient.zip