Event ID 201 — Transferred files with action 'Transfer'.

{
  "system": {
    "provider": "ScreenConnect",
    "guid": "",
    "event_source_name": "",
    "event_id": 201,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-02-12T18:19:32.932554+00:00",
    "event_record_id": 1468,
    "correlation": {},
    "execution": {
      "process_id": 12712,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "Transferred files with action 'RunSilentElevated':\r\nScreenConnect.ClientSetup.exe\r\n\r\nVersion: 24.2.10.8991\r\nExecutable Path: C:\\Program Files (x86)\\ScreenConnect Client (207d3896f8faaf5e)\\ScreenConnect.ClientService.exe\r\n",
    "Binary": ""
  },
  "message": ""
}