File name:

ScreenConnect.WindowsClient.zip

Full analysis: https://app.any.run/tasks/25dd3696-1845-457d-88fb-80762f125c77
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: June 12, 2025, 15:03:48
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
screenconnect
rmm-tool
remote
rat
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

4E9A2C98CF85C6DAADA6EC482D8A7F03

SHA1:

F34F17C6CDA093091B76A40DAD270E797A2018AA

SHA256:

D0039D625C31104A0F64ACE6C52591ED7864E5B36EACF1E2042DEE620FFBB26F

SSDEEP:

6144:xl+fgc7H+MhpSf3ow4HABWSEFHgoqVdKwBKnMQq7XM:mfgcr+YS7wAsSEfqVdzKnMQ28

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 2044)

    • SCREENCONNECT has been detected (SURICATA)

      • ScreenConnect.ClientService.exe (PID: 5232)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 2044)
      • dfsvc.exe (PID: 4816)
      • ScreenConnect.WindowsClient.exe (PID: 6704)
      • ScreenConnect.ClientService.exe (PID: 3584)
      • ScreenConnect.WindowsClient.exe (PID: 6172)
      • ScreenConnect.WindowsClient.exe (PID: 4692)
      • ScreenConnect.ClientService.exe (PID: 5232)

    • Adds/modifies Windows certificates

      • ScreenConnect.Client.exe (PID: 5876)
      • dfsvc.exe (PID: 4816)

    • Reads Internet Explorer settings

      • dfsvc.exe (PID: 4816)

    • Executable content was dropped or overwritten

      • dfsvc.exe (PID: 4816)

    • Reads the date of Windows installation

      • ScreenConnect.WindowsClient.exe (PID: 6704)
      • dfsvc.exe (PID: 4816)

    • Executes as Windows Service

      • ScreenConnect.ClientService.exe (PID: 5232)

    • SCREENCONNECT mutex has been found

      • ScreenConnect.ClientService.exe (PID: 5232)

    • Creates or modifies Windows services

      • ScreenConnect.ClientService.exe (PID: 5232)

    • Screenconnect has been detected

      • ScreenConnect.ClientService.exe (PID: 5232)

    • Potential Corporate Privacy Violation

      • ScreenConnect.ClientService.exe (PID: 5232)

    • There is functionality for taking screenshot (YARA)

      • ScreenConnect.ClientService.exe (PID: 5232)
      • ScreenConnect.WindowsClient.exe (PID: 6172)

    • Detects ScreenConnect RAT (YARA)

      • ScreenConnect.ClientService.exe (PID: 5232)
      • ScreenConnect.WindowsClient.exe (PID: 6172)

    • The process creates files with name similar to system file names

      • dfsvc.exe (PID: 4816)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2044)

    • Checks supported languages

      • ScreenConnect.Client.exe (PID: 5876)
      • dfsvc.exe (PID: 4816)
      • ScreenConnect.WindowsClient.exe (PID: 6704)
      • ScreenConnect.ClientService.exe (PID: 3584)
      • ScreenConnect.ClientService.exe (PID: 5232)

    • Reads the machine GUID from the registry

      • dfsvc.exe (PID: 4816)
      • ScreenConnect.Client.exe (PID: 5876)
      • ScreenConnect.ClientService.exe (PID: 3584)
      • ScreenConnect.WindowsClient.exe (PID: 6704)
      • ScreenConnect.ClientService.exe (PID: 5232)
      • ScreenConnect.WindowsClient.exe (PID: 6172)
      • ScreenConnect.WindowsClient.exe (PID: 4692)

    • Reads the computer name

      • ScreenConnect.Client.exe (PID: 5876)
      • dfsvc.exe (PID: 4816)
      • ScreenConnect.WindowsClient.exe (PID: 6704)
      • ScreenConnect.ClientService.exe (PID: 3584)
      • ScreenConnect.ClientService.exe (PID: 5232)
      • ScreenConnect.WindowsClient.exe (PID: 4692)

    • Disables trace logs

      • dfsvc.exe (PID: 4816)

    • Reads Environment values

      • dfsvc.exe (PID: 4816)

    • Checks proxy server information

      • dfsvc.exe (PID: 4816)
      • slui.exe (PID: 1036)

    • Create files in a temporary directory

      • dfsvc.exe (PID: 4816)

    • Process checks whether UAC notifications are on

      • dfsvc.exe (PID: 4816)

    • Reads the software policy settings

      • dfsvc.exe (PID: 4816)
      • slui.exe (PID: 1036)

    • Creates files or folders in the user directory

      • ScreenConnect.WindowsClient.exe (PID: 6704)
      • ScreenConnect.ClientService.exe (PID: 5232)
      • dfsvc.exe (PID: 4816)

    • Process checks computer location settings

      • ScreenConnect.WindowsClient.exe (PID: 6704)
      • dfsvc.exe (PID: 4816)

    • SCREENCONNECT has been detected

      • ScreenConnect.ClientService.exe (PID: 5232)

    • Reads CPU info

      • ScreenConnect.WindowsClient.exe (PID: 4692)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 1980:00:00 00:00:00
ZipCRC: 0x2884b533
ZipCompressedSize: 138594
ZipUncompressedSize: 311376
ZipFileName: ScreenConnect.Client.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
9
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe screenconnect.client.exe no specs dfsvc.exe screenconnect.windowsclient.exe no specs screenconnect.clientservice.exe #SCREENCONNECT screenconnect.clientservice.exe #SCREENCONNECT screenconnect.windowsclient.exe no specs slui.exe screenconnect.windowsclient.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1036C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2044"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\ScreenConnect.WindowsClient.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3584"C:\Users\admin\AppData\Local\Apps\2.0\Q89GZ7EA.N1L\828BD210.NGP\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=instance-zkt3lw-relay.screenconnect.com&p=443&s=ded44076-4a17-48b4-b38e-56255216ae56&k=BgIAAACkAABSU0ExAAgAAAEAAQApCIs%2b9wll18Q4sfn%2fDve8Y58pIWRIsi89UIBP6tw%2foUsvk9v5UQuS%2fnOOgqKczhGqj%2bLi18Sjxe2boWK5K7sDnWybhxGGSBuJMFO2v3tdB744GU5FbrrfaagzwxBwuOhoQSCO4evKle19pdMtC2mNL1lT5NTFk0VCwPCZLTean5AwWEH4bLQIdgC%2fzeBW0B1vbbUM2fnPed5MVI8bc15NstUSX%2fwZqKPO4klD6tCY6VaUIoEDURbFCvOyipNoBqgoDTn2T62CFFErCwlPHCT2cf7bi3JL6ty4rHOWwNK8HYYXUgs5AT7RVdIDJD0UOmqSF3eyLmaog6DB8TopH%2fy%2f&r=&i=Untitled%20Session" "1"C:\Users\admin\AppData\Local\Apps\2.0\Q89GZ7EA.N1L\828BD210.NGP\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\ScreenConnect.ClientService.exe
ScreenConnect.WindowsClient.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
25.4.16.9293
Modules
Images
c:\users\admin\appdata\local\apps\2.0\q89gz7ea.n1l\828bd210.ngp\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\screenconnect.clientservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
4692"C:\Users\admin\AppData\Local\Apps\2.0\Q89GZ7EA.N1L\828BD210.NGP\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\ScreenConnect.WindowsClient.exe" "RunRole" "cdff2f64-7124-4326-89cd-935d321fe5ee" "System"C:\Users\admin\AppData\Local\Apps\2.0\Q89GZ7EA.N1L\828BD210.NGP\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\ScreenConnect.WindowsClient.exe—ScreenConnect.ClientService.exe
User:
SYSTEM
Company:
ScreenConnect Software
Integrity Level:
SYSTEM
Description:
ScreenConnect Client
Exit code:
0
Version:
25.4.16.9293
Modules
Images
c:\users\admin\appdata\local\apps\2.0\q89gz7ea.n1l\828bd210.ngp\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\screenconnect.windowsclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4816"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
ScreenConnect.Client.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
ClickOnce
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\dfsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5232"C:\Users\admin\AppData\Local\Apps\2.0\Q89GZ7EA.N1L\828BD210.NGP\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=instance-zkt3lw-relay.screenconnect.com&p=443&s=ded44076-4a17-48b4-b38e-56255216ae56&k=BgIAAACkAABSU0ExAAgAAAEAAQApCIs%2b9wll18Q4sfn%2fDve8Y58pIWRIsi89UIBP6tw%2foUsvk9v5UQuS%2fnOOgqKczhGqj%2bLi18Sjxe2boWK5K7sDnWybhxGGSBuJMFO2v3tdB744GU5FbrrfaagzwxBwuOhoQSCO4evKle19pdMtC2mNL1lT5NTFk0VCwPCZLTean5AwWEH4bLQIdgC%2fzeBW0B1vbbUM2fnPed5MVI8bc15NstUSX%2fwZqKPO4klD6tCY6VaUIoEDURbFCvOyipNoBqgoDTn2T62CFFErCwlPHCT2cf7bi3JL6ty4rHOWwNK8HYYXUgs5AT7RVdIDJD0UOmqSF3eyLmaog6DB8TopH%2fy%2f&r=&i=Untitled%20Session" "1"C:\Users\admin\AppData\Local\Apps\2.0\Q89GZ7EA.N1L\828BD210.NGP\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\ScreenConnect.ClientService.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Version:
25.4.16.9293
Modules
Images
c:\users\admin\appdata\local\apps\2.0\q89gz7ea.n1l\828bd210.ngp\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\screenconnect.clientservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shlwapi.dll
c:\windows\syswow64\msvcrt.dll
5876"C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.45412\ScreenConnect.Client.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.45412\ScreenConnect.Client.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2044.45412\screenconnect.client.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\crypt32.dll
6172"C:\Users\admin\AppData\Local\Apps\2.0\Q89GZ7EA.N1L\828BD210.NGP\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\ScreenConnect.WindowsClient.exe" "RunRole" "146a3a41-c470-4482-ba78-2b89079ba736" "User"C:\Users\admin\AppData\Local\Apps\2.0\Q89GZ7EA.N1L\828BD210.NGP\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\ScreenConnect.WindowsClient.exe
ScreenConnect.ClientService.exe
User:
admin
Company:
ScreenConnect Software
Integrity Level:
MEDIUM
Description:
ScreenConnect Client
Version:
25.4.16.9293
Modules
Images
c:\users\admin\appdata\local\apps\2.0\q89gz7ea.n1l\828bd210.ngp\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\screenconnect.windowsclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6704"C:\Users\admin\AppData\Local\Apps\2.0\Q89GZ7EA.N1L\828BD210.NGP\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\ScreenConnect.WindowsClient.exe" C:\Users\admin\AppData\Local\Apps\2.0\Q89GZ7EA.N1L\828BD210.NGP\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\ScreenConnect.WindowsClient.exe—dfsvc.exe
User:
admin
Company:
ScreenConnect Software
Integrity Level:
MEDIUM
Description:
ScreenConnect Client
Exit code:
0
Version:
25.4.16.9293
Modules
Images
c:\users\admin\appdata\local\apps\2.0\q89gz7ea.n1l\828bd210.ngp\scre..tion_8fbb309794d2792f_0019.0004_0969d3be69b82908\screenconnect.windowsclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
11 205
Read events
10 987
Write events
186
Delete events
32

Modification events

(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\ScreenConnect.WindowsClient.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4816) dfsvc.exeKey:HKEY_CLASSES_ROOT\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0
Operation:writeName:ComponentStore_RandomString
Value:
6BP21KKY0L6P2M6MOO4TA1YB
(PID) Process:(4816) dfsvc.exeKey:HKEY_CLASSES_ROOT\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0
Operation:delete valueName:ComponentStore_RandomString
Value:
6BP21KKY0L6P2M6MOO4TA1YB
Executable files
17
Suspicious files
23
Text files
31
Unknown types
5

Dropped files

PID
Process
Filename
Type
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.45412\app.configtext
MD5:1799E338DD38B5FEC4FCB63901F081A6
SHA256:898D92A5DB38E6994BB7660B48211EC38D9ECF5497405612925ADDB0BA4948CC
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.45412\ApplicationURL.txtbinary
MD5:15159B608C3531EFF6B0749CF4C531EF
SHA256:2C96D9DE6E5B9FB82908F687C2CA6D99AC7B1DD7EF44088598240826E912E34C
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.45412\ScreenConnect.Client.exeexecutable
MD5:BAE2933497C5E6E754F902DE82A43E77
SHA256:2ACFAEEF1A3378264B2EE4C3EBD88E146F67D9B42F11AEC6F0ADF025B6B76462
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.45412\Client.Override.resourcesbinary
MD5:ACD885FEAEFA19AA029DA01D3AB3AAAD
SHA256:D936E1C2625076BC61697C94830E8AFAF550063FF9F607520D6EBD25AC3D8CFD
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.45412\Client.resourcesbinary
MD5:AF3340A5BCFE20E75ED0211DA310D83B
SHA256:E0D0E5D951EF955F22D110B65B3FEDFB8B1710491563D7C541F5E3D9FD4CCEE8
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.45412\Icon16.pngimage
MD5:391859500741FD08F899EB133DD9A6C1
SHA256:AB6E20F61314FFE25F857ECF5EE08827A98BAC843516E1DFBF3B287D3A59E736
4816dfsvc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBder
MD5:19070200750EB9492B2C5FB16E22C480
SHA256:0065435491DC07CEE3B3313D8C068647AAEF404FCFD99B8A2FCBB85B0179C642
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.45412\Icon32.pngimage
MD5:675D24450479450267197E1A31C04B83
SHA256:D997F12E2BE8CD581879F44263040C9816ABC650CCF0E941D74CAF3CBDE9892F
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.45412\Client.Override.en-US.resourcesbinary
MD5:B097FC68ED629CDE4235006640AA1D2B
SHA256:C5126E61BBA75E9641F858170CACAE88FDD9407BEA6D5906E26DD7ACEF9E4C38
4816dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\6EVZ4L2B.27W\QJZ0W6GP.Z69.applicationxml
MD5:9AA1140E1D673F42C93BB7C21DCC0C87
SHA256:29DAD264F2CDB9708E45E9CE894E3642B1369AFE669EF48C1D76064AE972705B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
30
DNS requests
20
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4816
dfsvc.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEA3HrFcF%2FyGZLkBDIgw6SYY%3D
unknown
—
—
whitelisted
4816
dfsvc.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
4816
dfsvc.exe
GET
200
2.23.77.188:80
http://crl3.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crl
unknown
—
—
whitelisted
4816
dfsvc.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRbuhDibVrw1t5r3WYz1C9Jl6I%2FtwQU729TSunkBnx6yuKQVvYv1Ensy04CEAqA7xhLjfEFgtHEdqeVdGg%3D
unknown
—
—
whitelisted
4816
dfsvc.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
4816
dfsvc.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRbuhDibVrw1t5r3WYz1C9Jl6I%2FtwQU729TSunkBnx6yuKQVvYv1Ensy04CEAqA7xhLjfEFgtHEdqeVdGg%3D
unknown
—
—
whitelisted
6336
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4816
dfsvc.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEANYKLWC2MChk8S6PF3PEBE%3D
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
2.16.252.233:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6012
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7020
svchost.exe
40.126.32.76:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7020
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2336
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
1268
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
login.live.com
  • 40.126.32.76
  • 40.126.32.74
  • 40.126.32.140
  • 40.126.32.136
  • 20.190.160.130
  • 20.190.160.2
  • 20.190.160.20
  • 20.190.160.67
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.249
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 2.23.181.156
  • 2.16.253.202
whitelisted
techvormm.screenconnect.com
  • 147.28.147.238
whitelisted
crl3.digicert.com
  • 2.23.77.188
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.29
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Misc activity
ET REMOTE_ACCESS Observed DNS Query to Known ScreenConnect/ConnectWise Remote Desktop Service Domain
2200
svchost.exe
Misc activity
ET REMOTE_ACCESS Observed DNS Query to Known ScreenConnect/ConnectWise Remote Desktop Service Domain
5232
ScreenConnect.ClientService.exe
Potential Corporate Privacy Violation
REMOTE [ANY.RUN] ScreenConnect Server Response
Process
Message
dfsvc.exe
*** Status originated: -1073741811 *** Source File: onecore\com\netfx\windowsbuilt\iso_legacy\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: onecore\com\netfx\windowsbuilt\iso_legacy\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: onecore\com\netfx\windowsbuilt\iso_legacy\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: onecore\com\netfx\windowsbuilt\iso_legacy\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741772 *** Source File: onecore\com\netfx\windowsbuilt\iso_legacy\base\isolation\win32\isoreg_direct.cpp, line 1127
dfsvc.exe
*** Status originated: -1073741772 *** Source File: onecore\com\netfx\windowsbuilt\iso_legacy\base\isolation\win32\isoreg_direct.cpp, line 1127
dfsvc.exe
*** Status originated: -1073741811 *** Source File: onecore\com\netfx\windowsbuilt\iso_legacy\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: onecore\com\netfx\windowsbuilt\iso_legacy\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741772 *** Source File: onecore\com\netfx\windowsbuilt\iso_legacy\base\isolation\win32\isoreg_direct.cpp, line 1127
dfsvc.exe
*** Status originated: -1073741811 *** Source File: onecore\com\netfx\windowsbuilt\iso_legacy\base\isolation\hier_hierarchy.cpp, line 230
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ScreenConnect.WindowsClient.zip