Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SSA-Statement283482.exe

Overview

General Information

Sample name:SSA-Statement283482.exe
Analysis ID:1510120
MD5:3947493098fa9f8ad99838b31b1718ca
SHA1:46c9b68d1a104a46d79025965cae26f44e768985
SHA256:aa1b77e4203f23734eee91f426b9167c579f3a075ddc45c42ac4714ddc56d03a
Tags:exe
Infos:

Detection

ScreenConnect Tool
Score:63
Range:0 - 100
Whitelisted:false
Confidence:100%

Compliance

Score:32
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
AI detected suspicious sample
Contains functionality to hide user accounts
Enables network access during safeboot for specific services
Modifies security policies related information
Reads the Security eventlog
Reads the System eventlog
Sigma detected: Remote Access Tool - ScreenConnect Suspicious Execution
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for available system drives (often done to infect USB drives)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
EXE planting / hijacking vulnerabilities found
Enables debug privileges
Found dropped PE file which has not been started or loaded
May sleep (evasive loops) to hinder dynamic analysis
May use bcdedit to modify the Windows boot settings
Modifies existing windows services
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected ScreenConnect Tool

Classification

Process Tree

  • System is w10x64
  • SSA-Statement283482.exe (PID: 5536 cmdline: "C:\Users\user\Desktop\SSA-Statement283482.exe" MD5: 3947493098FA9F8AD99838B31B1718CA)
    • msiexec.exe (PID: 5980 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\8139d6693ff11377\setup.msi" MD5: 9D09DC1EDA745A5F87553048E57620CF)
  • msiexec.exe (PID: 5164 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)
    • msiexec.exe (PID: 4132 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 1770C73D69AC358127C1D8A8340504F8 C MD5: 9D09DC1EDA745A5F87553048E57620CF)
      • rundll32.exe (PID: 3360 cmdline: rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI6666.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_4613843 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments MD5: 889B99C52A60DD49227C5E485A016679)
    • msiexec.exe (PID: 6600 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding DB207B6B05E5334A6A4617F086F0333F MD5: 9D09DC1EDA745A5F87553048E57620CF)
    • msiexec.exe (PID: 5952 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 6F459389FAB8D805B11F9DC9BBCEE18B E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)
  • ScreenConnect.ClientService.exe (PID: 2788 cmdline: "C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-uil9h2-relay.screenconnect.com&p=443&s=23922f34-f56d-42f0-ae76-f0d68b386765&k=BgIAAACkAABSU0ExAAgAAAEAAQBtiFOcCyZyZIYMRa7q%2fxlupwY5psgwtIrmaNtAqcPOS3wxM8KzGEILcWiAQrulPKqVk7Rqd6bB%2fHZh%2fmnGSw2CAH4apdeV45uG24aPv2cHFtSJ6RshGlIAVmQDpgDTZGV70NOKRVbQf4oTZhjBjedMNc4eQan%2fjh9itC%2bqr9sxraG6l1Z%2boKOxbfHBJ6Wfpk7eUPM6olxgYqoAmaN4Rv%2bfdTlaueMe6P2zoVUESpDoHb1G6UbMs3FmBJCA%2f9AZwydk%2f143G89rCDbAyabHRD4c4l%2fHfxv8RMfl8ImXlPMvnbcvlou8OpEAIEdGjx8c%2bAEWMGqksgH4Y5DFBuR2ZkLk&c=QuadChomes&c=QuadChomes.com&c=&c=Host&c=&c=&c=&c=" MD5: 361BCC2CB78C75DD6F583AF81834E447)
    • ScreenConnect.WindowsClient.exe (PID: 6196 cmdline: "C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exe" "RunRole" "db1808b5-e647-4ee6-81c0-2c66f5bc4c39" "User" MD5: 20AB8141D958A58AADE5E78671A719BF)
  • svchost.exe (PID: 2896 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
SSA-Statement283482.exeJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\Config.Msi\4669b3.rbsJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
      C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
        C:\Windows\Installer\MSI6E36.tmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security

          Memory Dumps

          SourceRuleDescriptionAuthorStrings
          00000009.00000000.2248986769.0000000000292000.00000002.00000001.01000000.00000011.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
            00000001.00000002.2215345900.0000000005430000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
              00000009.00000002.4047653278.0000000002541000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                00000001.00000000.2176864852.0000000000D86000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                  Process Memory Space: SSA-Statement283482.exe PID: 5536JoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                    Click to see the 2 entries

                    Unpacked PEs

                    SourceRuleDescriptionAuthorStrings
                    1.2.SSA-Statement283482.exe.5430000.12.raw.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                      9.0.ScreenConnect.WindowsClient.exe.290000.0.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                        9.2.ScreenConnect.WindowsClient.exe.25bfa28.4.raw.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                          1.2.SSA-Statement283482.exe.5430000.12.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                            1.0.SSA-Statement283482.exe.e35db8.4.raw.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                              Click to see the 3 entries

                              Sigma Signatures

                              System Summary

                              barindex
                              Sigma detected: Remote Access Tool - ScreenConnect Suspicious Execution
                              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-uil9h2-relay.screenconnect.com&p=443&s=23922f34-f56d-42f0-ae76-f0d68b386765&k=BgIAAACkAABSU0ExAAgAAAEAAQBtiFOcCyZyZIYMRa7q%2fxlupwY5psgwtIrmaNtAqcPOS3wxM8KzGEILcWiAQrulPKqVk7Rqd6bB%2fHZh%2fmnGSw2CAH4apdeV45uG24aPv2cHFtSJ6RshGlIAVmQDpgDTZGV70NOKRVbQf4oTZhjBjedMNc4eQan%2fjh9itC%2bqr9sxraG6l1Z%2boKOxbfHBJ6Wfpk7eUPM6olxgYqoAmaN4Rv%2bfdTlaueMe6P2zoVUESpDoHb1G6UbMs3FmBJCA%2f9AZwydk%2f143G89rCDbAyabHRD4c4l%2fHfxv8RMfl8ImXlPMvnbcvlou8OpEAIEdGjx8c%2bAEWMGqksgH4Y5DFBuR2ZkLk&c=QuadChomes&c=QuadChomes.com&c=&c=Host&c=&c=&c=&c=", CommandLine: "C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-uil9h2-relay.screenconnect.com&p=443&s=23922f34-f56d-42f0-ae76-f0d68b386765&k=BgIAAACkAABSU0ExAAgAAAEAAQBtiFOcCyZyZIYMRa7q%2fxlupwY5psgwtIrmaNtAqcPOS3wxM8KzGEILcWiAQrulPKqVk7Rqd6bB%2fHZh%2fmnGSw2CAH4apdeV45uG24aPv2cHFtSJ6RshGlIAVmQDpgDTZGV70NOKRVbQf4oTZhjBjedMNc4eQan%2fjh9itC%2bqr9sxraG6l1Z%2boKOxbfHBJ6Wfpk7eUPM6olxgYqoAmaN4Rv%2bfdTlaueMe6P2zoVUESpDoHb1G6UbMs3FmBJCA%2f9AZwydk%2f143G89rCDbAyabHRD4c4l%2fHfxv8RMfl8ImXlPMvnbcvlou8OpEAIEdGjx8c%2bAEWMGqksgH4Y5DFBuR2ZkLk&c=QuadChomes&c=QuadChomes.com&c=&c=Host&c=&c=&c=&c=", CommandLine|base64offset|contains: )^, Image: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe, NewProcessName: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe, OriginalFileName: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: "C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-uil9h2-relay.screenconnect.com&p=443&s=23922f34-f56d-42f0-ae76-f0d68b386765&k=BgIAAACkAABSU0ExAAgAAAEAAQBtiFOcCyZyZIYMRa7q%2fxlupwY5psgwtIrmaNtAqcPOS3wxM8KzGEILcWiAQrulPKqVk7Rqd6bB%2fHZh%2fmnGSw2CAH4apdeV45uG24aPv2cHFtSJ6RshGlIAVmQDpgDTZGV70NOKRVbQf4oTZhjBjedMNc4eQan%2fjh9itC%2bqr9sxraG6l1Z%2boKOxbfHBJ6Wfpk7eUPM6olxgYqoAmaN4Rv%2bfdTlaueMe6P2zoVUESpDoHb1G6UbMs3FmBJCA%2f9AZwydk%2f143G89rCDbAyabHRD4c4l%2fHfxv8RMfl8ImXlPMvnbcvlou8OpEAIEdGjx8c%2bAEWMGqksgH4Y5DFBuR2ZkLk&c=QuadChomes&c=QuadChomes.com&c=&c=Host&c=&c=&c=&c=", ProcessId: 2788, ProcessName: ScreenConnect.ClientService.exe
                              Sigma detected: CurrentVersion Autorun Keys Modification
                              Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: ScreenConnect Client (8139d6693ff11377) Credential Provider, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\msiexec.exe, ProcessId: 5164, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{6FF59A85-BC37-4CD4-4356-7CAA186E3759}\(Default)
                              Sigma detected: Windows Processes Suspicious Parent Directory
                              Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2896, ProcessName: svchost.exe

                              Suricata Signatures

                              ⊘No Suricata rule has matched

                              Joe Sandbox Signatures

                              Click to jump to signature section

                              Show All Signature Results

                              AV Detection

                              barindex
                              Multi AV Scanner detection for submitted file
                              Source: SSA-Statement283482.exeReversingLabs: Detection: 23%
                              AI detected suspicious sample
                              Source: Submited SampleIntegrated Neural Analysis Model: Matched 95.8% probability
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeCode function: 8_2_03BA0F48 CryptProtectData,8_2_03BA0F48
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeCode function: 8_2_03BA1730 CryptProtectData,8_2_03BA1730
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeEXE: msiexec.exeJump to behavior

                              Compliance

                              barindex
                              EXE planting / hijacking vulnerabilities found
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeEXE: msiexec.exeJump to behavior
                              Uses 32bit PE files
                              Source: SSA-Statement283482.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                              PE / OLE file has a valid certificate
                              Source: SSA-Statement283482.exeStatic PE information: certificate valid
                              Contains modern PE file flags such as dynamic base (ASLR) or NX
                              Source: SSA-Statement283482.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                              Binary contains paths to debug symbols
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbU source: ScreenConnect.ClientService.exe, 00000008.00000002.4071554806.00000000043E0000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.4047305581.00000000024B2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbe source: ScreenConnect.WindowsClient.exe, 00000009.00000000.2248986769.0000000000292000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientInstallerRunner\obj\Release\ScreenConnect.ClientInstallerRunner.pdb source: SSA-Statement283482.exe
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdbM source: SSA-Statement283482.exe
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdb source: SSA-Statement283482.exe
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbT source: Microsoft.Deployment.WindowsInstaller.dll.5.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.3.dr
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller.Package\Microsoft.Deployment.WindowsInstaller.Package.pdb source: Microsoft.Deployment.WindowsInstaller.Package.dll.5.dr
                              Source: Binary string: C:\Compile\screenconnect\Product\WindowsAuthenticationPackage\bin\Release\ScreenConnect.WindowsAuthenticationPackage.pdb source: ScreenConnect.ClientService.exe, 00000008.00000002.4064871685.00000000026F7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.4056869577.0000000012550000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: SSA-Statement283482.exe, ScreenConnect.Core.dll.5.dr, ScreenConnect.Core.dll.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: ScreenConnect.WindowsClient.exe, 00000009.00000002.4047653278.0000000002541000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.4046728899.0000000000B90000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.4046967916.0000000000BE2000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.ClientService.dll.3.dr
                              Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\DotNetResolver\obj\Debug\DotNetResolver.pdb source: SSA-Statement283482.exe
                              Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000008.00000000.2236238627.0000000000FED000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.ClientService.exe.3.dr
                              Source: Binary string: mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000008.00000002.4071554806.00000000043E0000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: SSA-Statement283482.exe, ScreenConnect.Windows.dll.5.dr, ScreenConnect.Windows.dll.3.dr
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression.Cab\Microsoft.Deployment.Compression.Cab.pdb source: rundll32.exe, 00000005.00000003.2215581601.00000000049C0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2213591540.0000000004B39000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.5.dr
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: Microsoft.Deployment.WindowsInstaller.dll.5.dr
                              Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb;izt source: ScreenConnect.ClientService.exe, 00000008.00000002.4044920337.0000000000BE5000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\ship\x86\wixca.pdb source: SSA-Statement283482.exe, MSI706A.tmp.3.dr, MSI6E95.tmp.3.dr, setup.msi.1.dr, 4669b4.msi.3.dr, 4669b2.msi.3.dr, 4669b3.rbs.3.dr, MSI6E36.tmp.3.dr
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression\Microsoft.Deployment.Compression.pdb source: rundll32.exe, 00000005.00000003.2213591540.0000000004ACA000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.dll.5.dr
                              Source: Binary string: screenconnect_windows_credential_provider.pdb source: ScreenConnect.ClientService.exe, 00000008.00000002.4064871685.00000000026F7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.4056869577.0000000012550000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000009.00000000.2248986769.0000000000292000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\InstallerActions\obj\Release\ScreenConnect.InstallerActions.pdb source: ScreenConnect.InstallerActions.dll.5.dr
                              Source: Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\SfxCA.pdb source: SSA-Statement283482.exe, setup.msi.1.dr, 4669b4.msi.3.dr, 4669b2.msi.3.dr, MSI6666.tmp.2.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbW] source: SSA-Statement283482.exe, ScreenConnect.Windows.dll.5.dr, ScreenConnect.Windows.dll.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: ScreenConnect.ClientService.exe, 00000008.00000002.4071554806.00000000043E0000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.4047305581.00000000024B2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.3.dr
                              Source: Binary string: \??\C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.Client.pdb source: ScreenConnect.ClientService.exe, 00000008.00000002.4044920337.0000000000BE5000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: screenconnect_windows_credential_provider.pdb' source: ScreenConnect.ClientService.exe, 00000008.00000002.4064871685.00000000026F7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.4056869577.0000000012550000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.3.dr
                              Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb source: SSA-Statement283482.exe
                              Source: C:\Windows\System32\msiexec.exeFile opened: z:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: x:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: v:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: t:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: r:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: p:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: n:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: l:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: j:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: h:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: f:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: b:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: y:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: w:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: u:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: s:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: q:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: o:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: m:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: k:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: i:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: g:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: e:Jump to behavior
                              Source: C:\Windows\System32\svchost.exeFile opened: c:
                              Source: C:\Windows\System32\msiexec.exeFile opened: a:Jump to behavior

                              Networking

                              barindex
                              Enables network access during safeboot for specific services
                              Source: C:\Windows\System32\msiexec.exeRegistry value created: NULL ServiceJump to behavior
                              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                              Source: global trafficDNS traffic detected: DNS query: instance-uil9h2-relay.screenconnect.com
                              Source: SSA-Statement283482.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
                              Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.4056869577.0000000012550000.00000004.00000800.00020000.00000000.sdmp, SSA-Statement283482.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
                              Source: SSA-Statement283482.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
                              Source: SSA-Statement283482.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
                              Source: svchost.exe, 0000000A.00000002.3898772274.000001C46A200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
                              Source: SSA-Statement283482.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
                              Source: SSA-Statement283482.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
                              Source: SSA-Statement283482.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
                              Source: ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
                              Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.4056869577.0000000012550000.00000004.00000800.00020000.00000000.sdmp, SSA-Statement283482.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
                              Source: qmgr.db.10.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
                              Source: qmgr.db.10.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
                              Source: qmgr.db.10.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
                              Source: qmgr.db.10.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
                              Source: qmgr.db.10.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
                              Source: qmgr.db.10.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
                              Source: qmgr.db.10.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
                              Source: qmgr.db.10.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
                              Source: ScreenConnect.ClientService.exe, 00000008.00000002.4044920337.0000000000C7D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://instance-uil9h2-relay.screenconnect.com:443/
                              Source: ScreenConnect.ClientService.exe, 00000008.00000002.4050207783.00000000018DD000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.4050207783.000000000181E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.4050207783.0000000001AE5000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.4050207783.000000000184B000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.4050207783.0000000001984000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.4050207783.0000000001AB8000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.4050207783.0000000001B61000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.4050207783.0000000001A16000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://instance-uil9h2-relay.screenconnect.com:443/d
                              Source: SSA-Statement283482.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://ocsp.digicert.com0
                              Source: SSA-Statement283482.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://ocsp.digicert.com0A
                              Source: SSA-Statement283482.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://ocsp.digicert.com0C
                              Source: SSA-Statement283482.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://ocsp.digicert.com0X
                              Source: SSA-Statement283482.exe, 00000001.00000002.2204019191.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.4050207783.0000000001752000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                              Source: rundll32.exe, 00000005.00000003.2213591540.0000000004ACA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2213591540.0000000004B39000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2213754572.00000000049C3000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.5.dr, Microsoft.Deployment.Compression.dll.5.dr, Microsoft.Deployment.WindowsInstaller.dll.5.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.5.drString found in binary or memory: http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v
                              Source: rundll32.exe, 00000005.00000003.2213591540.0000000004ACA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2213591540.0000000004B39000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2213754572.00000000049C3000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.5.dr, Microsoft.Deployment.Compression.dll.5.dr, Microsoft.Deployment.WindowsInstaller.dll.5.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.5.drString found in binary or memory: http://wixtoolset.org/news/
                              Source: rundll32.exe, 00000005.00000003.2213591540.0000000004ACA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2213591540.0000000004B39000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2213754572.00000000049C3000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.5.dr, Microsoft.Deployment.Compression.dll.5.dr, Microsoft.Deployment.WindowsInstaller.dll.5.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.5.drString found in binary or memory: http://wixtoolset.org/releases/
                              Source: SSA-Statement283482.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://www.digicert.com/CPS0
                              Source: ScreenConnect.WindowsCredentialProvider.dll.3.drString found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
                              Source: ScreenConnect.Core.dll.3.drString found in binary or memory: https://feedback.screenconnect.com/Feedback.axd
                              Source: qmgr.db.10.drString found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
                              Source: svchost.exe, 0000000A.00000003.2277833966.000001C46A110000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443

                              Spam, unwanted Advertisements and Ransom Demands

                              barindex
                              Reads the Security eventlog
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                              Reads the System eventlog
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\4669b2.msiJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\inprogressinstallinfo.ipiJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\SourceHash{36B75195-3778-3603-935A-9224F330994C}Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI6E36.tmpJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI6E95.tmpJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI706A.tmpJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\4669b4.msiJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\4669b4.msiJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\{36B75195-3778-3603-935A-9224F330994C}Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\{36B75195-3778-3603-935A-9224F330994C}\DefaultIconJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Windows\Installer\wix{36B75195-3778-3603-935A-9224F330994C}.SchedServiceConfig.rmiJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)Jump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\xnrld11y.tmpJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\xnrld11y.newcfgJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\shbuxrhm.tmpJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\shbuxrhm.newcfgJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\dy55a2rz.tmpJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\dy55a2rz.newcfgJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\10351va5.tmpJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\10351va5.newcfgJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\emjfhf4e.tmpJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\emjfhf4e.newcfgJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\ygssea3k.tmpJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\ygssea3k.newcfgJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\dvn1kfnd.tmpJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\dvn1kfnd.newcfgJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\fapszhfs.tmpJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\fapszhfs.newcfgJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\yczkoffm.tmpJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\yczkoffm.newcfgJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\hmjrvzyg.tmpJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\hmjrvzyg.newcfgJump to behavior
                              Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
                              Source: C:\Windows\System32\msiexec.exeFile deleted: C:\Windows\Installer\MSI6E95.tmpJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeCode function: 1_2_053EF0B01_2_053EF0B0
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeCode function: 1_2_053E6F001_2_053E6F00
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeCode function: 1_2_053E60C01_2_053E60C0
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeCode function: 1_2_053E6EF11_2_053E6EF1
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeCode function: 1_2_0540039B1_2_0540039B
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeCode function: 8_2_0112D5888_2_0112D588
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeCode function: 8_2_03BAF3628_2_03BAF362
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeCode function: 8_2_03BAF6688_2_03BAF668
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD3430052F9_2_00007FFD3430052F
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD342F71389_2_00007FFD342F7138
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD342FDCD39_2_00007FFD342FDCD3
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD342F2D889_2_00007FFD342F2D88
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD342FEE0D9_2_00007FFD342FEE0D
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD342FEEC09_2_00007FFD342FEEC0
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD343027559_2_00007FFD34302755
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD342F10D79_2_00007FFD342F10D7
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD342F10CF9_2_00007FFD342F10CF
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD343029D39_2_00007FFD343029D3
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD342FDB859_2_00007FFD342FDB85
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD342FDBD39_2_00007FFD342FDBD3
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD346069749_2_00007FFD34606974
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD346002809_2_00007FFD34600280
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD346067619_2_00007FFD34606761
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD3460B08D9_2_00007FFD3460B08D
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD3461189A9_2_00007FFD3461189A
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD346118F29_2_00007FFD346118F2
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD3460E8FA9_2_00007FFD3460E8FA
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD3460C8E89_2_00007FFD3460C8E8
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD346091BB9_2_00007FFD346091BB
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD34611DF29_2_00007FFD34611DF2
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD3460EDFA9_2_00007FFD3460EDFA
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD346129E09_2_00007FFD346129E0
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD3460EED39_2_00007FFD3460EED3
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD34600EBF9_2_00007FFD34600EBF
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD34600F209_2_00007FFD34600F20
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD34600F109_2_00007FFD34600F10
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD3460F6F29_2_00007FFD3460F6F2
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD34600EF29_2_00007FFD34600EF2
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD346113CF9_2_00007FFD346113CF
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD34612BD39_2_00007FFD34612BD3
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD3460738D9_2_00007FFD3460738D
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD346010309_2_00007FFD34601030
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD34600FFD9_2_00007FFD34600FFD
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD3460EFF29_2_00007FFD3460EFF2
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD34611BFB9_2_00007FFD34611BFB
                              Source: SSA-Statement283482.exeStatic PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                              Source: SSA-Statement283482.exeStatic PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                              Source: SSA-Statement283482.exeStatic PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                              Source: SSA-Statement283482.exeStatic PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                              Source: SSA-Statement283482.exeStatic PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                              Source: SSA-Statement283482.exe, 00000001.00000002.2212807137.0000000004FF0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.WindowsInstaller.dll< vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exe, 00000001.00000000.2176864852.00000000012AF000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameScreenConnect.ClientInstallerRunner.exe< vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exe, 00000001.00000000.2176864852.00000000012AF000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameDotNetResolver.exe4 vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exe, 00000001.00000002.2206103880.0000000003C83000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.Windows.dll< vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exe, 00000001.00000000.2176864852.0000000000D86000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameScreenConnect.Core.dll< vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exe, 00000001.00000000.2176864852.0000000000D86000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamelibwebp.dllB vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exe, 00000001.00000000.2176864852.0000000000D86000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamezlib.dll2 vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exe, 00000001.00000000.2176864852.0000000000D86000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameScreenConnect.Windows.dll< vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exe, 00000001.00000000.2176864852.0000000000D86000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameScreenConnect.WindowsInstaller.dll< vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exe, 00000001.00000002.2213014199.0000000005130000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.Core.dll< vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exe, 00000001.00000002.2215345900.00000000055EC000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.InstallerActions.dll< vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exe, 00000001.00000002.2215345900.00000000055EC000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameSfxCA.dllL vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exe, 00000001.00000002.2215345900.00000000055EC000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenamewixca.dll\ vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exe, 00000001.00000002.2215345900.00000000055EC000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.ClientInstallerRunner.exe< vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exe, 00000001.00000002.2203671752.0000000000D40000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameDotNetResolver.exe4 vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exe, 00000001.00000002.2213403819.00000000051C0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenamelibwebp.dllB vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exe, 00000001.00000002.2213403819.00000000051C0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenamezlib.dll2 vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exe, 00000001.00000002.2213403819.00000000051C0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.Windows.dll< vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exeBinary or memory string: OriginalFilenameScreenConnect.Core.dll< vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exeBinary or memory string: OriginalFilenamelibwebp.dllB vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exeBinary or memory string: OriginalFilenamezlib.dll2 vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exeBinary or memory string: OriginalFilenameScreenConnect.Windows.dll< vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exeBinary or memory string: OriginalFilenameScreenConnect.WindowsInstaller.dll< vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exeBinary or memory string: OriginalFilenameScreenConnect.InstallerActions.dll< vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exeBinary or memory string: OriginalFilenameSfxCA.dllL vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exeBinary or memory string: OriginalFilenamewixca.dll\ vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exeBinary or memory string: OriginalFilenameScreenConnect.ClientInstallerRunner.exe< vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exeBinary or memory string: OriginalFilenameDotNetResolver.exe4 vs SSA-Statement283482.exe
                              Source: SSA-Statement283482.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                              Source: 1.2.SSA-Statement283482.exe.5130000.5.raw.unpack, CursorBuffer.csCryptographic APIs: 'TransformBlock'
                              Source: 1.0.SSA-Statement283482.exe.d863d8.5.raw.unpack, CursorBuffer.csCryptographic APIs: 'TransformBlock'
                              Source: 1.0.SSA-Statement283482.exe.e0c3d8.3.raw.unpack, WindowsToolkit.csCryptographic APIs: 'CreateDecryptor'
                              Source: classification engineClassification label: mal63.evad.winEXE@16/66@4/2
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)Jump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SSA-Statement283482.exe.logJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeMutant created: NULL
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeMutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeFile created: C:\Users\user\AppData\Local\Temp\ScreenConnectJump to behavior
                              Source: SSA-Statement283482.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                              Source: SSA-Statement283482.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI6666.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_4613843 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                              Source: SSA-Statement283482.exeReversingLabs: Detection: 23%
                              Source: SSA-Statement283482.exeString found in binary or memory: $F294ACFC-3146-4483-A7BF-ADDCA7C260E2
                              Source: SSA-Statement283482.exeString found in binary or memory: $F294ACFC-3146-4483-A7BF-ADDCA7C260E2)
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeFile read: C:\Users\user\Desktop\SSA-Statement283482.exeJump to behavior
                              Source: unknownProcess created: C:\Users\user\Desktop\SSA-Statement283482.exe "C:\Users\user\Desktop\SSA-Statement283482.exe"
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\8139d6693ff11377\setup.msi"
                              Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
                              Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 1770C73D69AC358127C1D8A8340504F8 C
                              Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI6666.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_4613843 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                              Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding DB207B6B05E5334A6A4617F086F0333F
                              Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 6F459389FAB8D805B11F9DC9BBCEE18B E Global\MSI0000
                              Source: unknownProcess created: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe "C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-uil9h2-relay.screenconnect.com&p=443&s=23922f34-f56d-42f0-ae76-f0d68b386765&k=BgIAAACkAABSU0ExAAgAAAEAAQBtiFOcCyZyZIYMRa7q%2fxlupwY5psgwtIrmaNtAqcPOS3wxM8KzGEILcWiAQrulPKqVk7Rqd6bB%2fHZh%2fmnGSw2CAH4apdeV45uG24aPv2cHFtSJ6RshGlIAVmQDpgDTZGV70NOKRVbQf4oTZhjBjedMNc4eQan%2fjh9itC%2bqr9sxraG6l1Z%2boKOxbfHBJ6Wfpk7eUPM6olxgYqoAmaN4Rv%2bfdTlaueMe6P2zoVUESpDoHb1G6UbMs3FmBJCA%2f9AZwydk%2f143G89rCDbAyabHRD4c4l%2fHfxv8RMfl8ImXlPMvnbcvlou8OpEAIEdGjx8c%2bAEWMGqksgH4Y5DFBuR2ZkLk&c=QuadChomes&c=QuadChomes.com&c=&c=Host&c=&c=&c=&c="
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess created: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exe" "RunRole" "db1808b5-e647-4ee6-81c0-2c66f5bc4c39" "User"
                              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\8139d6693ff11377\setup.msi"Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 1770C73D69AC358127C1D8A8340504F8 CJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding DB207B6B05E5334A6A4617F086F0333FJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 6F459389FAB8D805B11F9DC9BBCEE18B E Global\MSI0000Jump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI6666.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_4613843 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArgumentsJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess created: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exe" "RunRole" "db1808b5-e647-4ee6-81c0-2c66f5bc4c39" "User"Jump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: mscoree.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: amsi.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: userenv.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: version.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: msasn1.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: gpapi.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: cryptsp.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: rsaenh.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: cryptbase.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: uxtheme.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: propsys.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: edputil.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: urlmon.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: iertutil.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: srvcli.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: wintypes.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: appresolver.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: bcp47langs.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: slc.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: sppc.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: srpapi.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: uxtheme.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: textinputframework.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: coreuicomponents.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: coremessaging.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: ntmarta.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: propsys.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: textshaping.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netapi32.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wkscli.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mscoree.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msihnd.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: pcacli.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: userenv.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: srclient.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: spp.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: powrprof.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: vssapi.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: vsstrace.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: umpdc.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: rstrtmgr.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: ncrypt.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: ntasn1.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: cabinet.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: cabinet.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: mscoree.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: cryptsp.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: rsaenh.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: cryptbase.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: urlmon.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: iertutil.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: srvcli.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: propsys.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: version.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: dpapi.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: amsi.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: userenv.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: msasn1.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: gpapi.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: wtsapi32.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: winsta.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: mswsock.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: dnsapi.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: iphlpapi.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: rasadhlp.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: netapi32.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: samcli.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: samlib.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: fwpuclnt.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: dhcpcsvc6.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: dhcpcsvc.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: winnsi.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: rasapi32.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: rasman.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: rtutils.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: winhttp.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: ntmarta.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: mscoree.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: version.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: uxtheme.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: cryptsp.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: rsaenh.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: cryptbase.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: amsi.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: userenv.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: urlmon.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: iertutil.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: srvcli.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: propsys.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: windowscodecs.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeSection loaded: dwrite.dllJump to behavior
                              Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: esent.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: mi.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: webio.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: es.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dll
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                              Source: Window RecorderWindow detected: More than 3 window changes detected
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                              Source: SSA-Statement283482.exeStatic PE information: certificate valid
                              Source: SSA-Statement283482.exeStatic file information: File size 5620224 > 1048576
                              Source: SSA-Statement283482.exeStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x533200
                              Source: SSA-Statement283482.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                              Source: SSA-Statement283482.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                              Source: SSA-Statement283482.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                              Source: SSA-Statement283482.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                              Source: SSA-Statement283482.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                              Source: SSA-Statement283482.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                              Source: SSA-Statement283482.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                              Source: SSA-Statement283482.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbU source: ScreenConnect.ClientService.exe, 00000008.00000002.4071554806.00000000043E0000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.4047305581.00000000024B2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbe source: ScreenConnect.WindowsClient.exe, 00000009.00000000.2248986769.0000000000292000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientInstallerRunner\obj\Release\ScreenConnect.ClientInstallerRunner.pdb source: SSA-Statement283482.exe
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdbM source: SSA-Statement283482.exe
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdb source: SSA-Statement283482.exe
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbT source: Microsoft.Deployment.WindowsInstaller.dll.5.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.3.dr
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller.Package\Microsoft.Deployment.WindowsInstaller.Package.pdb source: Microsoft.Deployment.WindowsInstaller.Package.dll.5.dr
                              Source: Binary string: C:\Compile\screenconnect\Product\WindowsAuthenticationPackage\bin\Release\ScreenConnect.WindowsAuthenticationPackage.pdb source: ScreenConnect.ClientService.exe, 00000008.00000002.4064871685.00000000026F7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.4056869577.0000000012550000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: SSA-Statement283482.exe, ScreenConnect.Core.dll.5.dr, ScreenConnect.Core.dll.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: ScreenConnect.WindowsClient.exe, 00000009.00000002.4047653278.0000000002541000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.4046728899.0000000000B90000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.4046967916.0000000000BE2000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.ClientService.dll.3.dr
                              Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\DotNetResolver\obj\Debug\DotNetResolver.pdb source: SSA-Statement283482.exe
                              Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000008.00000000.2236238627.0000000000FED000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.ClientService.exe.3.dr
                              Source: Binary string: mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000008.00000002.4071554806.00000000043E0000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: SSA-Statement283482.exe, ScreenConnect.Windows.dll.5.dr, ScreenConnect.Windows.dll.3.dr
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression.Cab\Microsoft.Deployment.Compression.Cab.pdb source: rundll32.exe, 00000005.00000003.2215581601.00000000049C0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2213591540.0000000004B39000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.5.dr
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: Microsoft.Deployment.WindowsInstaller.dll.5.dr
                              Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb;izt source: ScreenConnect.ClientService.exe, 00000008.00000002.4044920337.0000000000BE5000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\ship\x86\wixca.pdb source: SSA-Statement283482.exe, MSI706A.tmp.3.dr, MSI6E95.tmp.3.dr, setup.msi.1.dr, 4669b4.msi.3.dr, 4669b2.msi.3.dr, 4669b3.rbs.3.dr, MSI6E36.tmp.3.dr
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression\Microsoft.Deployment.Compression.pdb source: rundll32.exe, 00000005.00000003.2213591540.0000000004ACA000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.dll.5.dr
                              Source: Binary string: screenconnect_windows_credential_provider.pdb source: ScreenConnect.ClientService.exe, 00000008.00000002.4064871685.00000000026F7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.4056869577.0000000012550000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000009.00000000.2248986769.0000000000292000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\InstallerActions\obj\Release\ScreenConnect.InstallerActions.pdb source: ScreenConnect.InstallerActions.dll.5.dr
                              Source: Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\SfxCA.pdb source: SSA-Statement283482.exe, setup.msi.1.dr, 4669b4.msi.3.dr, 4669b2.msi.3.dr, MSI6666.tmp.2.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbW] source: SSA-Statement283482.exe, ScreenConnect.Windows.dll.5.dr, ScreenConnect.Windows.dll.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: ScreenConnect.ClientService.exe, 00000008.00000002.4071554806.00000000043E0000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.4047305581.00000000024B2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.3.dr
                              Source: Binary string: \??\C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.Client.pdb source: ScreenConnect.ClientService.exe, 00000008.00000002.4044920337.0000000000BE5000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: screenconnect_windows_credential_provider.pdb' source: ScreenConnect.ClientService.exe, 00000008.00000002.4064871685.00000000026F7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.4056869577.0000000012550000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.3.dr
                              Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb source: SSA-Statement283482.exe
                              Source: SSA-Statement283482.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                              Source: SSA-Statement283482.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                              Source: SSA-Statement283482.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                              Source: SSA-Statement283482.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                              Source: SSA-Statement283482.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

                              Data Obfuscation

                              barindex
                              .NET source code contains potential unpacker
                              Source: 1.2.SSA-Statement283482.exe.d40000.0.raw.unpack, Program.cs.Net Code: Main System.Reflection.Assembly.Load(byte[])
                              Source: 1.0.SSA-Statement283482.exe.12b78f8.2.raw.unpack, Program.cs.Net Code: Main System.Reflection.Assembly.Load(byte[])
                              Source: SSA-Statement283482.exeStatic PE information: real checksum: 0x54fd91 should be: 0x56a8dd
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeCode function: 1_2_00B76F00 push eax; mov dword ptr [esp], ecx1_2_00B76F11
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeCode function: 1_2_053E5502 push eax; retf 1_2_053E5529
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeCode function: 1_2_05402F58 push eax; mov dword ptr [esp], edx1_2_05402F6C
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeCode function: 1_2_05401A91 push eax; mov dword ptr [esp], ecx1_2_05401AA1
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeCode function: 8_2_01127732 push eax; iretd 8_2_01127739
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeCode function: 8_2_01127752 push 8403B4CFh; iretd 8_2_01127759
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeCode function: 8_2_05661100 pushad ; ret 8_2_05661113
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD34602F65 pushfd ; iretd 9_2_00007FFD34602F66
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsAuthenticationPackage.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsBackstageShell.exeJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\ScreenConnect.InstallerActions.dllJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsFileManager.exeJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI706A.tmpJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI6E95.tmpJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dllJump to dropped file
                              Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSI6666.tmpJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\ScreenConnect.Core.dllJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\Microsoft.Deployment.Compression.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.Core.dllJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\Microsoft.Deployment.Compression.Cab.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.Windows.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsCredentialProvider.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.Client.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.dllJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\ScreenConnect.Windows.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI706A.tmpJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI6E95.tmpJump to dropped file
                              Source: ScreenConnect.ClientService.dll.3.drBinary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\ApplicationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeRegistry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (8139d6693ff11377)Jump to behavior

                              Hooking and other Techniques for Hiding and Protection

                              barindex
                              Contains functionality to hide user accounts
                              Source: SSA-Statement283482.exe, 00000001.00000000.2176864852.0000000000D86000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                              Source: SSA-Statement283482.exe, 00000001.00000002.2213403819.00000000051C0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                              Source: rundll32.exe, 00000005.00000003.2213591540.0000000004B45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                              Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.4047653278.0000000002541000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                              Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.4046728899.0000000000B90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                              Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.4046967916.0000000000BE2000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                              Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.4062826100.000000001B432000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                              Source: SSA-Statement283482.exeString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                              Source: ScreenConnect.Windows.dll.5.drString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                              Source: ScreenConnect.Windows.dll.3.drString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                              Source: ScreenConnect.ClientService.dll.3.drString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeMemory allocated: B70000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeMemory allocated: 2AC0000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeMemory allocated: 28D0000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeMemory allocated: 6280000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeMemory allocated: 59A0000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeMemory allocated: 6280000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeMemory allocated: 7280000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeMemory allocated: 8280000 memory reserve | memory write watchJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeMemory allocated: 1080000 memory reserve | memory write watchJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeMemory allocated: 16F0000 memory reserve | memory write watchJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeMemory allocated: 1080000 memory reserve | memory write watchJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeMemory allocated: 770000 memory reserve | memory write watchJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeMemory allocated: 1A540000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsAuthenticationPackage.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsBackstageShell.exeJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\ScreenConnect.InstallerActions.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSI706A.tmpJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsFileManager.exeJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSI6E95.tmpJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dllJump to dropped file
                              Source: C:\Windows\SysWOW64\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI6666.tmpJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\ScreenConnect.Core.dllJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\Microsoft.Deployment.Compression.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.Core.dllJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\Microsoft.Deployment.Compression.Cab.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.Windows.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsCredentialProvider.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.Client.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.dllJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\ScreenConnect.Windows.dllJump to dropped file
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exe TID: 2052Thread sleep time: -922337203685477s >= -30000sJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe TID: 3700Thread sleep count: 45 > 30Jump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe TID: 2836Thread sleep time: -30000s >= -30000sJump to behavior
                              Source: C:\Windows\System32\svchost.exe TID: 5700Thread sleep time: -30000s >= -30000s
                              Source: C:\Windows\System32\svchost.exe TID: 5700Thread sleep time: -30000s >= -30000s
                              Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0
                              Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: 4669b2.msi.3.drBinary or memory string: VMCi-
                              Source: SSA-Statement283482.exe, 00000001.00000002.2202964130.0000000000894000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
                              Source: svchost.exe, 0000000A.00000002.3899331326.000001C46A257000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                              Source: svchost.exe, 0000000A.00000002.3898459162.000001C464C2B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW`
                              Source: ScreenConnect.ClientService.exe, 00000008.00000002.4071554806.00000000043E0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                              Source: C:\Windows\System32\msiexec.exeProcess information queried: ProcessInformationJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess token adjusted: DebugJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeProcess token adjusted: DebugJump to behavior
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeMemory allocated: page read and write | page guardJump to behavior

                              HIPS / PFW / Operating System Protection Evasion

                              barindex
                              .NET source code references suspicious native API functions
                              Source: 1.2.SSA-Statement283482.exe.5130000.5.raw.unpack, NativeLibrary.csReference to suspicious API methods: LoadLibrary(type, assemblyTypeHint)
                              Source: 1.2.SSA-Statement283482.exe.d40000.0.raw.unpack, Program.csReference to suspicious API methods: FindResource(moduleHandle, e.Name, "FILES")
                              Source: 1.0.SSA-Statement283482.exe.e0c3d8.3.raw.unpack, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.VirtualAlloc(attemptImageBase, dwSize, WindowsNative.MEM.MEM_COMMIT | WindowsNative.MEM.MEM_RESERVE, WindowsNative.PAGE.PAGE_READWRITE)
                              Source: 1.0.SSA-Statement283482.exe.e0c3d8.3.raw.unpack, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.GetProcAddress(intPtr, ptr5)
                              Source: 1.0.SSA-Statement283482.exe.e0c3d8.3.raw.unpack, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.VirtualProtect(loadedImageBase + sectionHeaders[i].VirtualAddress, (IntPtr)num, flNewProtect, &pAGE)
                              Source: 1.0.SSA-Statement283482.exe.e0c3d8.3.raw.unpack, WindowsExtensions.csReference to suspicious API methods: HandleMinder.CreateWithFunc(WindowsNative.OpenProcess(processAccess, bInheritHandle: false, processID), WindowsNative.CloseHandle)
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeProcess created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\8139d6693ff11377\setup.msi"Jump to behavior
                              Source: unknownProcess created: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe "c:\program files (x86)\screenconnect client (8139d6693ff11377)\screenconnect.clientservice.exe" "?e=access&y=guest&h=instance-uil9h2-relay.screenconnect.com&p=443&s=23922f34-f56d-42f0-ae76-f0d68b386765&k=bgiaaackaabsu0exaagaaaeaaqbtifoccyzyziymra7q%2fxlupwy5psgwtirmantaqcpos3wxm8kzgeilcwiaqrulpkqvk7rqd6bb%2fhzh%2fmngsw2cah4apdev45ug24apv2chftsj6rshgliavmqdpgdtzgv70nokrvbqf4otzhjbjedmnc4eqan%2fjh9itc%2bqr9sxrag6l1z%2bokoxbfhbj6wfpk7eupm6olxgyqoaman4rv%2bfdtlaueme6p2zovuespdohb1g6ubms3fmbjca%2f9azwydk%2f143g89rcdbayabhrd4c4l%2fhfxv8rmfl8imxlpmvnbcvlou8opeaiedgjx8c%2baewmgqksgh4y5dfbur2zklk&c=quadchomes&c=quadchomes.com&c=&c=host&c=&c=&c=&c="
                              Source: ScreenConnect.WindowsClient.exe, 00000009.00000000.2248986769.0000000000292000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.3.drBinary or memory string: Progman
                              Source: ScreenConnect.WindowsClient.exe, 00000009.00000000.2248986769.0000000000292000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.3.drBinary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
                              Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformationJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\ScreenConnect.InstallerActions.dll VolumeInformationJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\ScreenConnect.Core.dll VolumeInformationJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\ScreenConnect.Windows.dll VolumeInformationJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.Core.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.Windows.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.Client.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exe VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.Client.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.Core.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.Windows.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.dll VolumeInformationJump to behavior
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                              Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exeCode function: 8_2_01124D30 RtlGetVersion,8_2_01124D30
                              Source: C:\Users\user\Desktop\SSA-Statement283482.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                              Lowering of HIPS / PFW / Operating System Security Settings

                              barindex
                              Modifies security policies related information
                              Source: C:\Windows\System32\msiexec.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa Authentication PackagesJump to behavior
                              Source: Yara matchFile source: SSA-Statement283482.exe, type: SAMPLE
                              Source: Yara matchFile source: 1.2.SSA-Statement283482.exe.5430000.12.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 9.0.ScreenConnect.WindowsClient.exe.290000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 9.2.ScreenConnect.WindowsClient.exe.25bfa28.4.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 1.2.SSA-Statement283482.exe.5430000.12.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 1.0.SSA-Statement283482.exe.e35db8.4.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 1.0.SSA-Statement283482.exe.d863d8.5.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 1.0.SSA-Statement283482.exe.e0c3d8.3.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 1.0.SSA-Statement283482.exe.d70000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 00000009.00000000.2248986769.0000000000292000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000001.00000002.2215345900.0000000005430000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000009.00000002.4047653278.0000000002541000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000001.00000000.2176864852.0000000000D86000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                              Source: Yara matchFile source: Process Memory Space: SSA-Statement283482.exe PID: 5536, type: MEMORYSTR
                              Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 3360, type: MEMORYSTR
                              Source: Yara matchFile source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 6196, type: MEMORYSTR
                              Source: Yara matchFile source: C:\Config.Msi\4669b3.rbs, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Windows\Installer\MSI6E36.tmp, type: DROPPED

                              Mitre Att&ck Matrix

                              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                              Gather Victim Identity InformationAcquire Infrastructure1
                              Replication Through Removable Media                              		1
                              Native API                              		1
                              DLL Side-Loading                              		1
                              DLL Side-Loading                              		11
                              Disable or Modify Tools                              		OS Credential Dumping11
                              Peripheral Device Discovery                              		Remote Services11
                              Archive Collected Data                              		22
                              Encrypted Channel                              		Exfiltration Over Other Network MediumAbuse Accessibility Features
                              CredentialsDomainsDefault Accounts12
                              Command and Scripting Interpreter                              		1
                              DLL Search Order Hijacking                              		1
                              DLL Search Order Hijacking                              		1
                              Deobfuscate/Decode Files or Information                              		LSASS Memory1
                              File and Directory Discovery                              		Remote Desktop ProtocolData from Removable Media1
                              Non-Application Layer Protocol                              		Exfiltration Over BluetoothNetwork Denial of Service
                              Email AddressesDNS ServerDomain AccountsAt2
                              Windows Service                              		2
                              Windows Service                              		1
                              Obfuscated Files or Information                              		Security Account Manager24
                              System Information Discovery                              		SMB/Windows Admin SharesData from Network Shared Drive2
                              Application Layer Protocol                              		Automated ExfiltrationData Encrypted for Impact
                              Employee NamesVirtual Private ServerLocal AccountsCron1
                              Bootkit                              		12
                              Process Injection                              		1
                              Software Packing                              		NTDS11
                              Security Software Discovery                              		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
                              Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                              DLL Side-Loading                              		LSA Secrets2
                              Process Discovery                              		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                              DLL Search Order Hijacking                              		Cached Domain Credentials41
                              Virtualization/Sandbox Evasion                              		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                              File Deletion                              		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job22
                              Masquerading                              		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                              Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt41
                              Virtualization/Sandbox Evasion                              		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                              IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron12
                              Process Injection                              		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                              Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd1
                              Hidden Users                              		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
                              Gather Victim Org InformationDNS ServerCompromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task1
                              Bootkit                              		KeyloggingProcess DiscoveryTaint Shared ContentScreen CaptureDNSExfiltration Over Physical MediumResource Hijacking
                              Determine Physical LocationsVirtual Private ServerCompromise Hardware Supply ChainUnix ShellSystemd TimersSystemd Timers1
                              Rundll32                              		GUI Input CapturePermission Groups DiscoveryReplication Through Removable MediaEmail CollectionProxyExfiltration over USBNetwork Denial of Service

                              Behavior Graph

                              Hide Legend

                              Legend:

                              • Process
                              • Signature
                              • Created File
                              • DNS/IP Info
                              • Is Dropped
                              • Is Windows Process
                              • Number of created Registry Values
                              • Number of created Files
                              • Visual Basic
                              • Delphi
                              • Java
                              • .Net C# or VB.NET
                              • C, C++ or other language
                              • Is malicious
                              • Internet
                              behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1510120 Sample: SSA-Statement283482.exe Startdate: 12/09/2024 Architecture: WINDOWS Score: 63 55 instance-uil9h2-relay.screenconnect.com 2->55 57 server-nixd2d85b70-relay.screenconnect.com 2->57 65 Multi AV Scanner detection for submitted file 2->65 67 .NET source code contains potential unpacker 2->67 69 .NET source code references suspicious native API functions 2->69 71 3 other signatures 2->71 8 msiexec.exe 94 48 2->8         started        12 ScreenConnect.ClientService.exe 17 23 2->12         started        15 SSA-Statement283482.exe 5 2->15         started        17 svchost.exe 2->17         started        signatures3 process4 dnsIp5 35 C:\...\ScreenConnect.ClientService.exe, PE32 8->35 dropped 37 C:\Windows\Installer\MSI706A.tmp, PE32 8->37 dropped 39 C:\Windows\Installer\MSI6E95.tmp, PE32 8->39 dropped 43 9 other files (none is malicious) 8->43 dropped 73 Enables network access during safeboot for specific services 8->73 75 Modifies security policies related information 8->75 19 msiexec.exe 8->19         started        21 msiexec.exe 1 8->21         started        23 msiexec.exe 8->23         started        59 server-nixd2d85b70-relay.screenconnect.com 147.75.81.4, 443, 49713, 49716 PACKETUS Switzerland 12->59 77 Reads the Security eventlog 12->77 79 Reads the System eventlog 12->79 25 ScreenConnect.WindowsClient.exe 2 12->25         started        41 C:\Users\user\...\SSA-Statement283482.exe.log, ASCII 15->41 dropped 81 Contains functionality to hide user accounts 15->81 28 msiexec.exe 6 15->28         started        61 127.0.0.1 unknown unknown 17->61 file6 signatures7 process8 file9 31 rundll32.exe 11 19->31         started        83 Contains functionality to hide user accounts 25->83 45 C:\Users\user\AppData\Local\...\MSI6666.tmp, PE32 28->45 dropped signatures10 process11 file12 47 C:\Users\user\...\ScreenConnect.Windows.dll, PE32 31->47 dropped 49 C:\...\ScreenConnect.InstallerActions.dll, PE32 31->49 dropped 51 C:\Users\user\...\ScreenConnect.Core.dll, PE32 31->51 dropped 53 4 other files (none is malicious) 31->53 dropped 63 Contains functionality to hide user accounts 31->63 signatures13

                              Screenshots

                              Thumbnails

                              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                              windows-stand

                              Antivirus, Machine Learning and Genetic Malware Detection

                              Initial Sample

                              SourceDetectionScannerLabelLink
                              SSA-Statement283482.exe24%ReversingLabsWin32.Trojan.Generic

                              Dropped Files

                              SourceDetectionScannerLabelLink
                              C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.Client.dll0%ReversingLabs
                              C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.dll0%ReversingLabs
                              C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe0%ReversingLabs
                              C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.Core.dll0%ReversingLabs
                              C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.Windows.dll0%ReversingLabs
                              C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsAuthenticationPackage.dll0%ReversingLabs
                              C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsBackstageShell.exe0%ReversingLabs
                              C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exe0%ReversingLabs
                              C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsCredentialProvider.dll0%ReversingLabs
                              C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsFileManager.exe0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\MSI6666.tmp0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\Microsoft.Deployment.Compression.Cab.dll0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\Microsoft.Deployment.Compression.dll0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\Microsoft.Deployment.WindowsInstaller.dll0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\ScreenConnect.Core.dll0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\ScreenConnect.InstallerActions.dll0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\ScreenConnect.Windows.dll0%ReversingLabs
                              C:\Windows\Installer\MSI6E95.tmp0%ReversingLabs
                              C:\Windows\Installer\MSI706A.tmp0%ReversingLabs

                              Unpacked PE Files

                              ⊘No Antivirus matches

                              Domains

                              ⊘No Antivirus matches

                              URLs

                              SourceDetectionScannerLabelLink
                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
                              http://wixtoolset.org/releases/0%Avira URL Cloudsafe
                              http://crl.ver)0%Avira URL Cloudsafe
                              http://wixtoolset.org/news/0%Avira URL Cloudsafe
                              https://g.live.com/odclientsettings/ProdV21C:0%Avira URL Cloudsafe
                              http://instance-uil9h2-relay.screenconnect.com:443/d0%Avira URL Cloudsafe
                              http://instance-uil9h2-relay.screenconnect.com:443/0%Avira URL Cloudsafe
                              https://docs.rs/getrandom#nodejs-es-module-support0%Avira URL Cloudsafe
                              https://g.live.com/odclientsettings/Prod1C:0%Avira URL Cloudsafe
                              http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v0%Avira URL Cloudsafe
                              https://feedback.screenconnect.com/Feedback.axd0%Avira URL Cloudsafe

                              Domains and IPs

                              Contacted Domains

                              NameIPActiveMaliciousAntivirus DetectionReputation
                              server-nixd2d85b70-relay.screenconnect.com
                              		147.75.81.4
                              		truefalse
                                		unknown
                                instance-uil9h2-relay.screenconnect.com
                                		unknown
                                		unknowntrue
                                  		unknown

                                  URLs from Memory and Binaries

                                  NameSourceMaliciousAntivirus DetectionReputation
                                  https://g.live.com/odclientsettings/ProdV21C:svchost.exe, 0000000A.00000003.2277833966.000001C46A110000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.drfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://crl.ver)svchost.exe, 0000000A.00000002.3898772274.000001C46A200000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://wixtoolset.org/releases/rundll32.exe, 00000005.00000003.2213591540.0000000004ACA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2213591540.0000000004B39000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2213754572.00000000049C3000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.5.dr, Microsoft.Deployment.Compression.dll.5.dr, Microsoft.Deployment.WindowsInstaller.dll.5.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.5.drfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://g.live.com/odclientsettings/Prod1C:qmgr.db.10.drfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://instance-uil9h2-relay.screenconnect.com:443/dScreenConnect.ClientService.exe, 00000008.00000002.4050207783.00000000018DD000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.4050207783.000000000181E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.4050207783.0000000001AE5000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.4050207783.000000000184B000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.4050207783.0000000001984000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.4050207783.0000000001AB8000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.4050207783.0000000001B61000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.4050207783.0000000001A16000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://wixtoolset.org/news/rundll32.exe, 00000005.00000003.2213591540.0000000004ACA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2213591540.0000000004B39000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2213754572.00000000049C3000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.5.dr, Microsoft.Deployment.Compression.dll.5.dr, Microsoft.Deployment.WindowsInstaller.dll.5.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.5.drfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameSSA-Statement283482.exe, 00000001.00000002.2204019191.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.4050207783.0000000001752000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://instance-uil9h2-relay.screenconnect.com:443/ScreenConnect.ClientService.exe, 00000008.00000002.4044920337.0000000000C7D000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/vrundll32.exe, 00000005.00000003.2213591540.0000000004ACA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2213591540.0000000004B39000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2213754572.00000000049C3000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.5.dr, Microsoft.Deployment.Compression.dll.5.dr, Microsoft.Deployment.WindowsInstaller.dll.5.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.5.drfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://feedback.screenconnect.com/Feedback.axdScreenConnect.Core.dll.3.drfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://docs.rs/getrandom#nodejs-es-module-supportScreenConnect.WindowsCredentialProvider.dll.3.drfalse
                                  • Avira URL Cloud: safe
                                  		unknown

                                  World Map of Contacted IPs

                                  • No. of IPs < 25%
                                  • 25% < No. of IPs < 50%
                                  • 50% < No. of IPs < 75%
                                  • 75% < No. of IPs

                                  Public IPs

                                  IPDomainCountryFlagASNASN NameMalicious
                                  147.75.81.4
                                  		server-nixd2d85b70-relay.screenconnect.comSwitzerland
                                  		54825PACKETUSfalse

                                  Private

                                  IP
                                  127.0.0.1

                                  General Information

                                  Joe Sandbox version:40.0.0 Tourmaline
                                  Analysis ID:1510120
                                  Start date and time:2024-09-12 15:51:25 +02:00
                                  Joe Sandbox product:CloudBasic
                                  Overall analysis duration:0h 8m 43s
                                  Hypervisor based Inspection enabled:false
                                  Report type:full
                                  Cookbook file name:default.jbs
                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                  Run name:Run with higher sleep bypass
                                  Number of analysed new started processes analysed:15
                                  Number of new started drivers analysed:0
                                  Number of existing processes analysed:0
                                  Number of existing drivers analysed:0
                                  Number of injected processes analysed:0
                                  Technologies:
                                  • HCA enabled
                                  • EGA enabled
                                  • AMSI enabled
                                  Analysis Mode:default
                                  Analysis stop reason:Timeout
                                  Sample name:SSA-Statement283482.exe
                                  Detection:MAL
                                  Classification:mal63.evad.winEXE@16/66@4/2
                                  EGA Information:
                                  • Successful, ratio: 50%
                                  HCA Information:
                                  • Successful, ratio: 73%
                                  • Number of executed functions: 312
                                  • Number of non-executed functions: 4
                                  Cookbook Comments:
                                  • Found application associated with file extension: .exe
                                  • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                                  Warnings

                                  • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                  • Excluded IPs from analysis (whitelisted): 184.28.90.27
                                  • Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
                                  • Execution Graph export aborted for target SSA-Statement283482.exe, PID 5536 because it is empty
                                  • Execution Graph export aborted for target rundll32.exe, PID 3360 because it is empty
                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                  • Report size getting too big, too many NtEnumerateKey calls found.
                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                  • Report size getting too big, too many NtSetInformationFile calls found.
                                  • VT rate limit hit for: SSA-Statement283482.exe

                                  Simulations

                                  Behavior and APIs

                                  ⊘No simulations

                                  Joe Sandbox View / Context

                                  IPs

                                  ⊘No context

                                  Domains

                                  ⊘No context

                                  ASNs

                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  PACKETUSWM847duagm.exeGet hashmaliciousUnknownBrowse
                                  • 185.245.180.242
                                  firmware.x86_64.elfGet hashmaliciousUnknownBrowse
                                  • 61.14.224.54
                                  EfzTOF4PQ1.exeGet hashmaliciousFormBookBrowse
                                  • 160.202.78.123
                                  eBill.Client.exeGet hashmaliciousScreenConnect ToolBrowse
                                  • 139.178.89.98
                                  eBill.Client.exeGet hashmaliciousScreenConnect ToolBrowse
                                  • 139.178.89.96
                                  http://bestbuy.beautybyjoulexa.com.au/citrix/fxc/bWljaGFlbHNjb2ZpZWxkQGRpc25leS5jb20=Get hashmaliciousHTMLPhisherBrowse
                                  • 185.194.217.175
                                  BTC.exeGet hashmaliciousAsyncRAT, Rezlt, StormKitty, VenomRAT, Vermin Keylogger, WorldWind Stealer, XWormBrowse
                                  • 185.252.232.158
                                  mirai.ppc.elfGet hashmaliciousMiraiBrowse
                                  • 66.78.16.43
                                  http://eedqt.foruskw.com/4lAabg16572cnef1382rzkeufeqnp14569ZZZRNPUIWFYUECM7379HVKJ18607i18Get hashmaliciousUnknownBrowse
                                  • 147.75.81.235

                                  JA3 Fingerprints

                                  ⊘No context

                                  Dropped Files

                                  ⊘No context

                                  Created / dropped Files

                                  C:\Config.Msi\4669b3.rbs

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:data
                                  Category:modified
                                  Size (bytes):219385
                                  Entropy (8bit):6.582076240155519
                                  Encrypted:false
                                  SSDEEP:3072:rR9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGD:rRuH2aCGw1ST1wQLdqvD
                                  MD5:489E70AE0E2C5EFBCBBEBCA3C5CE8244
                                  SHA1:C56BBCFC838C06F34277ED7903E90C9B5357997B
                                  SHA-256:AE6F1A144E6B3B536D306F0B2129CB45AB91F4B52C54D75BADBD86CCA8C4DA32
                                  SHA-512:6183428170BB5F4D2FA5AB9CEBD9D1EBE6DD3FD342EF9831DB7B7D748109BDBA6EA1AD747CD99E04CCBC607C0513F07ABF0D4AB7A1104B1DAE6E66E174D92D0B
                                  Malicious:false
                                  Yara Hits:
                                  • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Config.Msi\4669b3.rbs, Author: Joe Security
                                  Reputation:low
                                  Preview:...@IXOS.@.....@.N,Y.@.....@.....@.....@.....@.....@......&.{36B75195-3778-3603-935A-9224F330994C}'.ScreenConnect Client (8139d6693ff11377)..setup.msi.@.....@.....@.....@......DefaultIcon..&.{36B75195-3778-3603-935A-9224F330994C}.....@.....@.....@.....@.......@.....@.....@.......@....'.ScreenConnect Client (8139d6693ff11377)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{40A64DDB-C3F2-1624-70DC-7181A1E29087}&.{36B75195-3778-3603-935A-9224F330994C}.@......&.{D3422459-9E74-C140-280B-22440A1685FB}&.{36B75195-3778-3603-935A-9224F330994C}.@......&.{F7B34A45-C5CD-8115-C4BF-BE030371C630}&.{36B75195-3778-3603-935A-9224F330994C}.@......&.{DC342F26-423E-5232-48B5-C761DAB85A3F}&.{36B75195-3778-3603-935A-9224F330994C}.@......&.{0FB784A3-ECC3-2548-D223-27AD6621B4AD}&.{36B75195-3778-3603-935A-9224F330994C}.@......&.{835B0EDF-F87D-F81D-B25B-93BF0C69479D}&.{36B75195-3778-3603-935A-9224F330994C}.@....

                                  C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\Client.en-US.resources

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):50133
                                  Entropy (8bit):4.759054454534641
                                  Encrypted:false
                                  SSDEEP:1536:p1+F+UTQd/3EUDv8vw+Dsj2jr0FJK97w/Leh/KR1exJKekmrg9:p1+F+UTQWUDv8vw+Dsj2jr0FJK97w/LR
                                  MD5:D524E8E6FD04B097F0401B2B668DB303
                                  SHA1:9486F89CE4968E03F6DCD082AA2E4C05AEF46FCC
                                  SHA-256:07D04E6D5376FFC8D81AFE8132E0AA6529CCCC5EE789BEA53D56C1A2DA062BE4
                                  SHA-512:E5BC6B876AFFEB252B198FEB8D213359ED3247E32C1F4BFC2C5419085CF74FE7571A51CAD4EAAAB8A44F1421F7CA87AF97C9B054BDB83F5A28FA9A880D4EFDE5
                                  Malicious:false
                                  Reputation:low
                                  Preview:...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.q...'..6....wp.......y....C|.)>..Ldt..... $...X..........1$.../...2.%%3./>>...L.y.0.C._.........1Y..Qj.o....<....=...R..;...C....&.......1p2.r.x.u?Y..R...c......X.....I.5.2q..R...>.E.pw .@ ).w.l.....S...X..'.C.I......-.Y........4.J..P<.E..=c!.@To..#.._.2.....K.!..h...z......t......^..4...D...f..Q...:..%.z.<......^.....;<...r..yC.....Q........4_.Sns..z.......=..]t...X..<....8.e`}..n....S.H[..S@?.~....,...j.2..*v.......B....A...a......D..c..w..K,..t...S.....*v....7.6|..&.....r....#....G......Y...i..'.............'.......Z.....#2e..........|....)..%....A.....4{..u;N......&q...}.tD..x.....4...J...L......5.Q..M....K..3U..M..............5...........t.>.......lYu....3TY.?...r...'.......3.m........=.H...#.o.........n.....,4.~...<h..u...i.H...V......V/...P.$%..z...

                                  C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\Client.resources

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):26722
                                  Entropy (8bit):7.7401940386372345
                                  Encrypted:false
                                  SSDEEP:384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
                                  MD5:5CD580B22DA0C33EC6730B10A6C74932
                                  SHA1:0B6BDED7936178D80841B289769C6FF0C8EEAD2D
                                  SHA-256:DE185EE5D433E6CFBB2E5FCC903DBD60CC833A3CA5299F2862B253A41E7AA08C
                                  SHA-512:C2494533B26128FBF8149F7D20257D78D258ABFFB30E4E595CB9C6A742F00F1BF31B1EE202D4184661B98793B9909038CF03C04B563CE4ECA1E2EE2DEC3BF787
                                  Malicious:false
                                  Preview:...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP)...s^.J.....E.....(....jF.C...1P)...H..../..72J..I.J.a.K8c._.ks`.k.`.kK..m.M6p............b...P...........'...!...............K...............w.......P.......1......."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.1.6.....$A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.2.5.6....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.3.2....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.4.8.....,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.B.l.a.n.k.1.6.;...(A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.M.a.c.2.2.....0A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.O.p.a.q.u.e.1.9.2.8...,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.T.i.t.l.e.1.6.....6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.C.o.l.o.r.4...6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.I.m.a.g.e.:...DB.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.I.m.a.g.e.V.i.s.i.b.l.e.xb..*B.l.a.n.k.M.o.n.i.t.o.r.T.e.x.t.C.o.l.o.r..b..*D.a.r.k.T.h.e.m.e.B.a.r.B.a.s.e.C.o.l.o.r..b..<D.a.r.k.T.h.

                                  C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.Client.dll

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Category:dropped
                                  Size (bytes):197120
                                  Entropy (8bit):6.58476728626163
                                  Encrypted:false
                                  SSDEEP:3072:CxGtNaldxI5KY9h12QMusqVFJRJcyzvJquFzDvJXYrR:BtNalc5fr12QbPJYaquFGr
                                  MD5:AE0E6EBA123683A59CAE340C894260E9
                                  SHA1:35A6F5EB87179EB7252131A881A8D5D4D9906013
                                  SHA-256:D37F58AAE6085C89EDD3420146EB86D5A108D27586CB4F24F9B580208C9B85F1
                                  SHA-512:1B6D4AD78C2643A861E46159D5463BA3EC5A23A2A3DE1575E22FDCCCD906EE4E9112D3478811AB391A130FA595306680B8608B245C1EECB11C5BCE098F601D6B
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Z<..........." ..0.................. ... ....... .......................`............@.................................-...O.... .......................@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................a.......H...........(............^................................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*:.(......}....*..{....*:.(......}....*.0..A........(....s....%.~(...%-.&~'.....y...s....%.(...(...+(...+o"...o....*....0..s.......~#.....2. ....+...j..... ......... ...............%.r...p.%.r...p............%.&...($....5..............s%....=...*..0...........~*...%-.&~).....|...s&...%.*...(...+..~+...%-.&~).....}...s(...%.+...(...+.r9..

                                  C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.dll

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Category:dropped
                                  Size (bytes):68096
                                  Entropy (8bit):6.068776675019683
                                  Encrypted:false
                                  SSDEEP:1536:tA0ZscQ5V6TsQqoSDKh6+39QFVIl1KJhb8gp:q0Zy3wUOQFVQKJp
                                  MD5:0402CF8AE8D04FCC3F695A7BB9548AA0
                                  SHA1:044227FA43B7654032524D6F530F5E9B608E5BE4
                                  SHA-256:C76F1F28C5289758B6BD01769C5EBFB519EE37D0FA8031A13BB37DE83D849E5E
                                  SHA-512:BE4CBC906EC3D189BEBD948D3D44FCF7617FFAE4CC3C6DC49BF4C0BD809A55CE5F8CD4580E409E5BCE7586262FBAF642085FA59FE55B60966DB48D81BA8C0D78
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0.T..........." ..0.............. ... ...@....... ..............................d.....@.................................e ..O....@.......................`..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................. ......H........n..@...................<.........................................(....*^.(...........%...}....*:.(......}....*:.(......}....*:.(......}....*.~,...%-.&~+.....i...s....%.,...(...+*vs....%.}P.........s....(....*....0...........s....}.....s....}...........}.......(&.....}.....(....&.()..........s....o.....()...~-...%-.&~+.....j...s....%.-...o ....s!...}.....s"...}.....s#...}...... .... 0u.........s....s=...}....... ..6........s....s=...}.....('...($............o%........

                                  C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                  Category:dropped
                                  Size (bytes):95520
                                  Entropy (8bit):6.505346220942731
                                  Encrypted:false
                                  SSDEEP:1536:rg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoT0HMM7CxM7:khbNDxZGXfdHrX7rAc6myJkgoT0HXN7
                                  MD5:361BCC2CB78C75DD6F583AF81834E447
                                  SHA1:1E2255EC312C519220A4700A079F02799CCD21D6
                                  SHA-256:512F9D035E6E88E231F082CC7F0FF661AFA9ACC221CF38F7BA3721FD996A05B7
                                  SHA-512:94BA891140E7DDB2EFA8183539490AC1B4E51E3D5BD0A4001692DD328040451E6F500A7FC3DA6C007D9A48DB3E6337B252CE8439E912D4FE7ADC762206D75F44
                                  Malicious:true
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..qF.qF.qF....qF.....qF....qF.<.B.qF.<.E.qF.<.C.qF....qF.#..qF.qG..qF.2.O.qF.2...qF.2.D.qF.Rich.qF.........................PE..L.....wc...............!.............!............@.......................................@.................................p...x....`..X............L.. )...p......`!..p............................ ..@............................................text...:........................... ..`.rdata...f.......h..................@..@.data........@.......,..............@....rsrc...X....`.......6..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................

                                  C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.Core.dll

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Category:dropped
                                  Size (bytes):548864
                                  Entropy (8bit):6.031251664661689
                                  Encrypted:false
                                  SSDEEP:6144:7+kYq9xDsxaUGEcANzZ1dkmn27qcO5noYKvKzDrzL9e7eOJsXziIYjVtkb+vbHq+:7SHtpnoVMlUbHbBaYLD
                                  MD5:16C4F1E36895A0FA2B4DA3852085547A
                                  SHA1:AB068A2F4FFD0509213455C79D311F169CD7CAB8
                                  SHA-256:4D4BF19AD99827F63DD74649D8F7244FC8E29330F4D80138C6B64660C8190A53
                                  SHA-512:AB4E67BE339BECA30CAB042C9EBEA599F106E1E0E2EE5A10641BEEF431A960A2E722A459534BDC7C82C54F523B21B4994C2E92AA421650EE4D7E0F6DB28B47BA
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z............." ..0..X...........r... ........... ...............................D....@..................................r..O....................................q..8............................................ ............... ..H............text....V... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................r......H........B......................xq........................................{:...*..{;...*V.(<.....}:.....};...*...0..A........u~.......4.,/(=....{:....{:...o>...,.(?....{;....{;...o@...*.*.*. ... )UU.Z(=....{:...oA...X )UU.Z(?....{;...oB...X*...0..b........r...p......%..{:......%q.........-.&.+.......oC....%..{;......%q.........-.&.+.......oC....(D...*..{E...*..{F...*V.(<.....}E.....}F...*.0..A........u........4.,/(=....{E....{E...o>...,.(?....{F....{F...o@...*.*.*. F.b# )UU.

                                  C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.Windows.dll

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Category:dropped
                                  Size (bytes):1721856
                                  Entropy (8bit):6.639136400085158
                                  Encrypted:false
                                  SSDEEP:24576:gx5x94kEFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:gx5xKkEJkGYYpT0+TFiH7efP
                                  MD5:9F823778701969823C5A01EF3ECE57B7
                                  SHA1:DA733F482825EC2D91F9F1186A3F934A2EA21FA1
                                  SHA-256:ABCA7CF12937DA14C9323C880EC490CC0E063D7A3EEF2EAC878CD25C84CF1660
                                  SHA-512:FFC40B16F5EA2124629D797DC3A431BEB929373BFA773C6CDDC21D0DC4105D7360A485EA502CE8EA3B12EE8DCA8275A0EC386EA179093AF3AA8B31B4DD3AE1CA
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l............" ..0..>...........]... ...`....... ..............................[.....@................................./]..O....`...............................\..8............................................ ............... ..H............text....=... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............D..............@..B................c]......H.......t...h..............0....\........................................()...*^.()..........%...}....*:.().....}....*:.().....}....*:.().....}....*..s*...*..s+...*:.(,.....(-...*..{....*"..}....*J.(/........(0...&*:.(,.....(1...*..{2...*"..}2...*.0..(........(3......+.............(0...&..X....i2.*v.(,....s4...}.....s5...}....*v.{.....r...p(...+.....o7....*.0...........o8....+..o9......(...+&.o....-....,..o......*..........."........{..........o:...&.......(.....*....0..L...

                                  C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsAuthenticationPackage.dll

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):260168
                                  Entropy (8bit):6.416438906122177
                                  Encrypted:false
                                  SSDEEP:3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
                                  MD5:5ADCB5AE1A1690BE69FD22BDF3C2DB60
                                  SHA1:09A802B06A4387B0F13BF2CDA84F53CA5BDC3785
                                  SHA-256:A5B8F0070201E4F26260AF6A25941EA38BD7042AEFD48CD68B9ACF951FA99EE5
                                  SHA-512:812BE742F26D0C42FDDE20AB4A02F1B47389F8D1ACAA6A5BB3409BA27C64BE444AC06D4129981B48FA02D4C06B526CB5006219541B0786F8F37CF2A183A18A73
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A........................T....................V.......V.......V......................=U......=U......=U$.....=U......Rich....................PE..d.....Qf.........." ...'.^...^.......................................................(....`..........................................e.......f..P................ ......HP..........P%..p............................$..@............p...............................text...t].......^.................. ..`.rdata.......p.......b..............@..@.data....+...........d..............@....pdata... ......."...x..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................

                                  C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsBackstageShell.exe

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Category:dropped
                                  Size (bytes):61216
                                  Entropy (8bit):6.31175789874945
                                  Encrypted:false
                                  SSDEEP:1536:SW/+lo6MOc8IoiKWjbNv8DtyQ4RE+TC6VAhVbIF7fIxp:SLlo6dccl9yQGVtFra
                                  MD5:6DF2DEF5E591E2481E42924B327A9F15
                                  SHA1:38EAB6E9D99B5CAEEC9703884D25BE8D811620A9
                                  SHA-256:B6A05985C4CF111B94A4EF83F6974A70BF623431187691F2D4BE0332F3899DA9
                                  SHA-512:5724A20095893B722E280DBF382C9BFBE75DD4707A98594862760CBBD5209C1E55EEAF70AD23FA555D62C7F5E54DE1407FB98FC552F42DCCBA5D60800965C6A5
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L............."...0.................. ........@.. ....................... ......3]....@.....................................O.......,............... )..............8............................................ ............... ..H............text........ ...................... ..`.rsrc...,...........................@..@.reloc..............................@..B........................H........S......................x.........................................(....*^.(.......a...%...}....*:.(......}....*:.(......}....*:.(......}....*....0..........(....(....(....(....r...p(....o....(....r...p..~....(....(....r9..p..~....(....(.....g~).....(....rY..p.(....&(.....(....s....( ...s....(!...*...0...........(".....(#.....($....s....%.o%...%.o&...%.o'...%s!...o(...%~....o)...}......(....o*...o+....(,.....@...%..(.....o-....s....}.....{...........s/...o0....s....}..

                                  C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsBackstageShell.exe.config

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):266
                                  Entropy (8bit):4.842791478883622
                                  Encrypted:false
                                  SSDEEP:6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
                                  MD5:728175E20FFBCEB46760BB5E1112F38B
                                  SHA1:2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
                                  SHA-256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
                                  SHA-512:FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
                                  Malicious:false
                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

                                  C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exe

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Category:dropped
                                  Size (bytes):601376
                                  Entropy (8bit):6.185921191564225
                                  Encrypted:false
                                  SSDEEP:6144:r+z3H0n063rDHWP5hLG/6XixJQm16Eod7ZeYai1FzJTZJ5BCEOG6y9QsZSc4F2/Q:qzEjrTWPMLBfWFaSdJ5BeG6xs6/yRod
                                  MD5:20AB8141D958A58AADE5E78671A719BF
                                  SHA1:F914925664AB348081DAFE63594A64597FB2FC43
                                  SHA-256:9CFD2C521D6D41C3A86B6B2C3D9B6A042B84F2F192F988F65062F0E1BFD99CAB
                                  SHA-512:C5DD5ED90C516948D3D8C6DFA3CA7A6C8207F062883BA442D982D8D05A7DB0707AFEC3A0CB211B612D04CCD0B8571184FC7E81B2E98AE129E44C5C0E592A5563
                                  Malicious:false
                                  Yara Hits:
                                  • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exe, Author: Joe Security
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{<............"...0.................. ... ....@.. .......................`.......x....@.................................=...O.... .................. )...@..........8............................................ ............... ..H............text...`.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................q.......H........H................................................................{D...*..{E...*V.(F.....}D.....}E...*...0..A........u1.......4.,/(G....{D....{D...oH...,.(I....{E....{E...oJ...*.*.*. }.o )UU.Z(G....{D...oK...X )UU.Z(I....{E...oL...X*...0..b........r...p......%..{D......%q4....4...-.&.+...4...oM....%..{E......%q5....5...-.&.+...5...oM....(N...*..{O...*..{P...*V.(F.....}O.....}P...*.0..A........u6.......4.,/(G....{O....{O...oH...,.(I....{P....{P...oJ...*.*.*. 1.c. )UU.

                                  C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exe.config

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):266
                                  Entropy (8bit):4.842791478883622
                                  Encrypted:false
                                  SSDEEP:6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
                                  MD5:728175E20FFBCEB46760BB5E1112F38B
                                  SHA1:2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
                                  SHA-256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
                                  SHA-512:FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
                                  Malicious:false
                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

                                  C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsCredentialProvider.dll

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):842248
                                  Entropy (8bit):6.268561504485627
                                  Encrypted:false
                                  SSDEEP:12288:q9vy8YABMuiAoPyEIrJs7jBjaau+EAaMVtw:P8Y4MuiAoPyZrJ8jrvDVtw
                                  MD5:BE74AB7A848A2450A06DE33D3026F59E
                                  SHA1:21568DCB44DF019F9FAF049D6676A829323C601E
                                  SHA-256:7A80E8F654B9DDB15DDA59AC404D83DBAF4F6EAFAFA7ECBEFC55506279DE553D
                                  SHA-512:2643D649A642220CEEE121038FE24EA0B86305ED8232A7E5440DFFC78270E2BDA578A619A76C5BB5A5A6FE3D9093E29817C5DF6C5DD7A8FBC2832F87AA21F0CC
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}....}H..}H..}H.d~I..}H.dxIG.}H.dyI..}H..xI..}H..yI..}H..~I..}H..|H8.}H..}H..}H2.}I..}H2..I..}HRich..}H........PE..d.....Gf.........." ...'.P...........H....................................... ......q.....`......................................... ...t....................P...y.......(......,4.....T.......................(.......@............`...............................text....O.......P.................. ..`.rdata...z...`...|...T..............@..@.data....d.......0..................@....pdata...y...P...z..................@..@_RDATA...............z..............@..@.reloc..,4.......6...|..............@..B................................................................................................................................................................................................................................................................

                                  C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsFileManager.exe

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Category:dropped
                                  Size (bytes):81696
                                  Entropy (8bit):5.862223562830496
                                  Encrypted:false
                                  SSDEEP:1536:/tytl44RzbwI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Yp7gxd:8/KukLdUpc
                                  MD5:B1799A5A5C0F64E9D61EE4BA465AFE75
                                  SHA1:7785DA04E98E77FEC7C9E36B8C68864449724D71
                                  SHA-256:7C39E98BEB59D903BC8D60794B1A3C4CE786F7A7AAE3274C69B507EBA94FAA80
                                  SHA-512:AD8C810D7CC3EA5198EE50F0CEB091A9F975276011B13B10A37306052697DC43E58A16C84FA97AB02D3927CD0431F62AEF27E500030607828B2129F305C27BE8
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P............"...0..@...........^... ...`....@.. .......................`......j.....@..................................^..O....`.. ............... )...@.......]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc... ....`.......B..............@..@.reloc.......@......................@..B.................^......H....... +..@2..................`]........................................(....*^.(.......;...%...}....*:.(......}....*:.(......}....*:.(......}....*....0..........s>....(....(....(....(....(.....(....(......s....}B....s....}C....~@...%-.&~?.....<...s ...%.@...o...+.....@...s ...o...+......A...s!...o...+}D.......B...s"...o...+.......(#...&......(#...& .... ...........($...&s....t......r...prs..p(%...(&...~>...%-.&...'...s(...%.>.....A...().......(*........(+...o,...(-...t....

                                  C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsFileManager.exe.config

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):266
                                  Entropy (8bit):4.842791478883622
                                  Encrypted:false
                                  SSDEEP:6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
                                  MD5:728175E20FFBCEB46760BB5E1112F38B
                                  SHA1:2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
                                  SHA-256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
                                  SHA-512:FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
                                  Malicious:false
                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

                                  C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\system.config

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:XML 1.0 document, ASCII text, with very long lines (476), with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):966
                                  Entropy (8bit):5.748455104655255
                                  Encrypted:false
                                  SSDEEP:24:2dL9hK6E4dl/5Hu1vGgDtSWB/Xer337ZWvH:chh7HH5O1egcq4H7ZWv
                                  MD5:5C93A94F5A550E43DA494153A79E8B6E
                                  SHA1:43CBF2DB1820EFFB5504B85FDE24F05605AE1ADD
                                  SHA-256:1B06BE6F425E258DA4E1A1736F45BF8ABFA90F0AD2C9A8139E28164510B63138
                                  SHA-512:EB98C628097E9EAAB89D518F5A415B1E8F810AF9A4047FC18ECDC66A5400E69D69F3D124C1506532AA8D4C80D9FB45F6A4830E0086D998A8B0C0E0CAA8C2B170
                                  Malicious:false
                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="ClientLaunchParametersConstraint" serializeAs="String">.. <value>?h=instance-uil9h2-relay.screenconnect.com&amp;p=443&amp;k=BgIAAACkAABSU0ExAAgAAAEAAQBtiFOcCyZyZIYMRa7q%2fxlupwY5psgwtIrmaNtAqcPOS3wxM8KzGEILcWiAQrulPKqVk7Rqd6bB%2fHZh%2fmnGSw2CAH4apdeV45uG24aPv2cHFtSJ6RshGlIAVmQDpgDTZGV70NOKRVbQf4oTZhjBjedMNc4eQan%2fjh9itC%2bqr9sxraG6l1Z%2boKOxbfHBJ6Wfpk7eUPM6olxgYqoAmaN4Rv%2bfdTlaueMe6P2zoVUESpDoHb1G6UbMs3FmBJCA%2f9AZwydk%2f143G89rCDbAyabHRD4c4l%2fHfxv8RMfl8ImXlPMvnbcvlou8OpEAIEdGjx8c%2bAEWMGqksgH4Y5DFBuR2ZkLk</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                  C:\ProgramData\Microsoft\Network\Downloader\edb.chk

                                  Download File
                                  Process:C:\Windows\System32\svchost.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):8192
                                  Entropy (8bit):0.35901589905449205
                                  Encrypted:false
                                  SSDEEP:6:6xKdoaaD0JOCEfMuaaD0JOCEfMKQmDCexKdoaaD0JOCEfMuaaD0JOCEfMKQmDC:6aaD0JcaaD0JwQQHaaD0JcaaD0JwQQ
                                  MD5:C788EDB928436D0CE10A5BF198837D8A
                                  SHA1:F104B6AB797E0B16362BFB69F5000407CE6EFFD8
                                  SHA-256:E309925E38D727B91C5B0AD9FC86A778ECD0EBE80261F55E870AD6685B0CC0BD
                                  SHA-512:61F750C97F2E1EAF623486147F55B4BF39C34DF28DD124FA378973965A2AE0AAA967D71C88BE0D02E1B2D2B22E20199B9E817BE793A10C0CC9D12FE703E18CF2
                                  Malicious:false
                                  Preview:*.>...........k.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................k.............................................................................................................................................................................................................................................................................................................................................................

                                  C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                  Download File
                                  Process:C:\Windows\System32\svchost.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):1310720
                                  Entropy (8bit):0.7304398986317644
                                  Encrypted:false
                                  SSDEEP:1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0D:9JZj5MiKNnNhoxuy
                                  MD5:6B63C03061F0147ACF20BB5F690B5573
                                  SHA1:AE5EF8BB08CF28937080A36C9C980E730D4D35AF
                                  SHA-256:3F1911140606F559B3B211D8CB3EE08375DD2AD6F16B907536F9713B3ACEE256
                                  SHA-512:CB4F2112500FD1994B24367FACE5D01EF81F6624CDEE5EDC7FECD9E3D2833FB2B108DBFEA0773A2DBCC5500A10DE81393037B8E26D637B8F4301CA925C336DEE
                                  Malicious:false
                                  Preview:...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

                                  C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                  Download File
                                  Process:C:\Windows\System32\svchost.exe
                                  File Type:Extensible storage user DataBase, version 0x620, checksum 0xd8ff5618, page size 16384, Windows version 10.0
                                  Category:dropped
                                  Size (bytes):1310720
                                  Entropy (8bit):0.6291428522037782
                                  Encrypted:false
                                  SSDEEP:1536:HSB2ESB2SSjlK/HZH03N9Jdt8gYkr3g16l2UPkLk+kDWyrufTRryrUOLUzCJ:Haza9iJa+2UtmOQOL
                                  MD5:F1DA12E65E7A9368BF9A01F851B4B198
                                  SHA1:04BFF15A6F141157E50865B0198CA2EAA385464D
                                  SHA-256:34D24B60A2F2A3AFD015854F69F3310A51A101F7E36A20452DDBD6162E13C8CD
                                  SHA-512:7FC4DFA0B3ED597F943B0265FABC532E960D35FD88AEAB1DF806DF225757622C6D638210B85462A2309D31DD15AC8C7EB33E227E58A0511B2E1F6C878C85A9EA
                                  Malicious:false
                                  Preview:..V.... .......P.......X\...;...{......................0.j.....+6...|...4...|..h.g.....+6...|..0.j.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{....................................++6...|....................+6...|...........................#......0.j.....................................................................................................................................................................................................................................................................................................................................................

                                  C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                  Download File
                                  Process:C:\Windows\System32\svchost.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):16384
                                  Entropy (8bit):0.08046348234763179
                                  Encrypted:false
                                  SSDEEP:3:Am/llUetYeNdqOTGn1Colnnnkaqn1Gnn1allHol///lZMPCyH:7lzNdqOTGncolnn3qnQnnQpo5
                                  MD5:94F72C903D8D74909AA5E22579629509
                                  SHA1:4AF674A5101306900B32CD41102CD73C670DE112
                                  SHA-256:2610226D7A961C510D6734148DAAC655CE9DEB73C557A000CE4A26B0C5B4A4B5
                                  SHA-512:9BAD60932010C9B7650EC510ADE7CB98C55C44F9C3A8A51820E2C4ACE95487849C7F0C42F410199FE0729F923C1CEEE9C5A18467C4684A0D8F80E9C83E0A27ED
                                  Malicious:false
                                  Preview:{........................................;...{...4...|..+6...|..........+6...|..+6...|..Z..+6...|....................+6...|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SSA-Statement283482.exe.log

                                  Download File
                                  Process:C:\Users\user\Desktop\SSA-Statement283482.exe
                                  File Type:ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):321
                                  Entropy (8bit):5.36509199858051
                                  Encrypted:false
                                  SSDEEP:6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTrM3RJoDLIP12MUAvvR+uCv:Q3La/KDLI4MWuPTArkvoDLI4MWuCv
                                  MD5:1CF2352B684EF57925D98E766BA897F2
                                  SHA1:6E8CB2C1143E9D9D1211BAA811FE4CAA49C08B55
                                  SHA-256:43C3FB3C0B72A899C5442DAC8748D019D800E0A9421D3677EB96E196ED285290
                                  SHA-512:9F2D6F89453C867386A65A04FF96067FC3B23A99A4BCE0ECD227E130F409069FE6DD202D4839CBF204C3F204EC058D6CDFDADA7DD212BC2356D74FEC97F22061
                                  Malicious:true
                                  Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

                                  C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log

                                  Download File
                                  Process:C:\Windows\SysWOW64\rundll32.exe
                                  File Type:ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):746
                                  Entropy (8bit):5.349174276064173
                                  Encrypted:false
                                  SSDEEP:12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhaOK9eDLI4MNJK9P/JNTK9yirkvoDLb:ML9E4KlKDE4KhKiKhPKIE4oKNzKogE4P
                                  MD5:ED994980CB1AABB953B2C8ECDC745E1F
                                  SHA1:9E9D3E00A69FC862F4D3C30F42BF26693A2D2A21
                                  SHA-256:D23B54CCF9F6327FE1158762D4E5846649699A7B78418D056A197835ED1EBE79
                                  SHA-512:61DFC93154BCD734B9836A6DECF93674499FF533E2B9A1188886E2CBD04DF35538368485AA7E775B641ADC120BAE1AC2551B28647951C592AA77F6747F0E9187
                                  Malicious:false
                                  Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

                                  C:\Users\user\AppData\Local\Temp\MSI6666.tmp

                                  Download File
                                  Process:C:\Windows\SysWOW64\msiexec.exe
                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
                                  Category:dropped
                                  Size (bytes):1086792
                                  Entropy (8bit):7.793516535218678
                                  Encrypted:false
                                  SSDEEP:24576:4UUGG/qSDceVjLHGeRdtRiypAxiK7cl72km/4aoczU:bG/XcW32gqkAfosU
                                  MD5:30CA21632F98D354A940903214AE4DE1
                                  SHA1:6C59A3A65FB8E7D4AD96A3E8D90E72B02091D3F4
                                  SHA-256:4BB0E9B5C70E3CAEB955397A4A3B228C0EA5836729202B8D4BA1BE531B60DAFC
                                  SHA-512:47509F092B089EB1FFC115643DCDFBFAC5F50F239DE63ECAD71963EC1D37FF72B89F5A2AEA137ED391BA9BA10947ABBE6103DB1C56032FD6B39A0855CB283509
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S.c.2.0.2.0.2.0..|0.2.0..H0.2.0.Jq0.2.0.2.0.2.0..I0.2.0..y0.2.0..x0.2.0...0.2.0Rich.2.0................PE..L...9..P...........!.........H.......i.......................................p............@..............................*..l...x....@.......................P..d.......................................@...............h............................text............................... ..`.rdata..............................@..@.data....-..........................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\CustomAction.config

                                  Download File
                                  Process:C:\Windows\SysWOW64\rundll32.exe
                                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):234
                                  Entropy (8bit):4.977464602412109
                                  Encrypted:false
                                  SSDEEP:6:JiMVBdTMkIffVymRMT4/0xC/C7VrfC7VNQpuAW4QIT:MMHd413VymhsS+Qg93xT
                                  MD5:6F52EBEA639FD7CEFCA18D9E5272463E
                                  SHA1:B5E8387C2EB20DD37DF8F4A3B9B0E875FA5415E3
                                  SHA-256:7027B69AB6EBC9F3F7D2F6C800793FDE2A057B76010D8CFD831CF440371B2B23
                                  SHA-512:B5960066430ED40383D39365EADB3688CADADFECA382404924024C908E32C670AFABD37AB41FF9E6AC97491A5EB8B55367D7199002BF8569CF545434AB2F271A
                                  Malicious:false
                                  Preview:.<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>..</configuration>

                                  C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\Microsoft.Deployment.Compression.Cab.dll

                                  Download File
                                  Process:C:\Windows\SysWOW64\rundll32.exe
                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Category:dropped
                                  Size (bytes):49152
                                  Entropy (8bit):4.62694170304723
                                  Encrypted:false
                                  SSDEEP:768:sqbC2wmdVdX9Y6BCH+C/FEQl2ifnxwr02Gy/G4Xux+bgHGvLw4:sAtXPC/Cifnxs02Gyu4Xu0MeR
                                  MD5:77BE59B3DDEF06F08CAA53F0911608A5
                                  SHA1:A3B20667C714E88CC11E845975CD6A3D6410E700
                                  SHA-256:9D32032109FFC217B7DC49390BD01A067A49883843459356EBFB4D29BA696BF8
                                  SHA-512:C718C1AFA95146B89FC5674574F41D994537AF21A388335A38606AEC24D6A222CBCE3E6D971DFE04D86398E607815DF63A54DA2BB96CCF80B4F52072347E1CE6
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ........... ........... ...............................$....@....................................O.................................................................................... ............... ..H............text... .... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\Microsoft.Deployment.Compression.dll

                                  Download File
                                  Process:C:\Windows\SysWOW64\rundll32.exe
                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Category:dropped
                                  Size (bytes):36864
                                  Entropy (8bit):4.340550904466943
                                  Encrypted:false
                                  SSDEEP:384:GqJxldkxhW9N5u8IALLU0X9Z1kTOPJlqE:GqJxl6xsPIA9COxlqE
                                  MD5:4717BCC62EB45D12FFBED3A35BA20E25
                                  SHA1:DA6324A2965C93B70FC9783A44F869A934A9CAF7
                                  SHA-256:E04DE7988A2A39931831977FA22D2A4C39CF3F70211B77B618CAE9243170F1A7
                                  SHA-512:BB0ABC59104435171E27830E094EAE6781D2826ED2FC9009C8779D2CA9399E38EDB1EC6A10C1676A5AF0F7CACFB3F39AC2B45E61BE2C6A8FE0EDB1AF63A739CA
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0..`... .......~... ........... ....................................@.................................X~..O................................... }............................................... ............... ..H............text....^... ...`.................. ..`.rsrc................p..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll

                                  Download File
                                  Process:C:\Windows\SysWOW64\rundll32.exe
                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Category:dropped
                                  Size (bytes):57344
                                  Entropy (8bit):4.657268358041957
                                  Encrypted:false
                                  SSDEEP:768:BLNru62y+VqB4N5SBcDhDxW7ZkCmX2Qv1Sf0AQdleSBRxf+xUI3:BJ2yUGmh2O11AsleyRxf+xt
                                  MD5:A921A2B83B98F02D003D9139FA6BA3D8
                                  SHA1:33D67E11AD96F148FD1BFD4497B4A764D6365867
                                  SHA-256:548C551F6EBC5D829158A1E9AD1948D301D7C921906C3D8D6B6D69925FC624A1
                                  SHA-512:E1D7556DAF571C009FE52D6FFE3D6B79923DAEEA39D754DDF6BEAFA85D7A61F3DB42DFC24D4667E35C4593F4ED6266F4099B393EFA426FA29A72108A0EAEDD3E
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ........... ........... ....................... .......t....@.....................................O...................................`................................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\Microsoft.Deployment.WindowsInstaller.dll

                                  Download File
                                  Process:C:\Windows\SysWOW64\rundll32.exe
                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Category:dropped
                                  Size (bytes):176128
                                  Entropy (8bit):5.775360792482692
                                  Encrypted:false
                                  SSDEEP:3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
                                  MD5:5EF88919012E4A3D8A1E2955DC8C8D81
                                  SHA1:C0CFB830B8F1D990E3836E0BCC786E7972C9ED62
                                  SHA-256:3E54286E348EBD3D70EAED8174CCA500455C3E098CDD1FCCB167BC43D93DB29D
                                  SHA-512:4544565B7D69761F9B4532CC85E7C654E591B2264EB8DA28E60A058151030B53A99D1B2833F11BFC8ACC837EECC44A7D0DBD8BC7AF97FC0E0F4938C43F9C2684
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ......~.... ........... ..............................!|....@.................................,...O.................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\ScreenConnect.Core.dll

                                  Download File
                                  Process:C:\Windows\SysWOW64\rundll32.exe
                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Category:dropped
                                  Size (bytes):548864
                                  Entropy (8bit):6.031251664661689
                                  Encrypted:false
                                  SSDEEP:6144:7+kYq9xDsxaUGEcANzZ1dkmn27qcO5noYKvKzDrzL9e7eOJsXziIYjVtkb+vbHq+:7SHtpnoVMlUbHbBaYLD
                                  MD5:16C4F1E36895A0FA2B4DA3852085547A
                                  SHA1:AB068A2F4FFD0509213455C79D311F169CD7CAB8
                                  SHA-256:4D4BF19AD99827F63DD74649D8F7244FC8E29330F4D80138C6B64660C8190A53
                                  SHA-512:AB4E67BE339BECA30CAB042C9EBEA599F106E1E0E2EE5A10641BEEF431A960A2E722A459534BDC7C82C54F523B21B4994C2E92AA421650EE4D7E0F6DB28B47BA
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z............." ..0..X...........r... ........... ...............................D....@..................................r..O....................................q..8............................................ ............... ..H............text....V... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................r......H........B......................xq........................................{:...*..{;...*V.(<.....}:.....};...*...0..A........u~.......4.,/(=....{:....{:...o>...,.(?....{;....{;...o@...*.*.*. ... )UU.Z(=....{:...oA...X )UU.Z(?....{;...oB...X*...0..b........r...p......%..{:......%q.........-.&.+.......oC....%..{;......%q.........-.&.+.......oC....(D...*..{E...*..{F...*V.(<.....}E.....}F...*.0..A........u........4.,/(=....{E....{E...o>...,.(?....{F....{F...o@...*.*.*. F.b# )UU.

                                  C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\ScreenConnect.InstallerActions.dll

                                  Download File
                                  Process:C:\Windows\SysWOW64\rundll32.exe
                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Category:dropped
                                  Size (bytes):11776
                                  Entropy (8bit):5.267782165666963
                                  Encrypted:false
                                  SSDEEP:192:TY8/Qp6lCJuV3jnXtyVNamVNG1YZfCrMmbfHJ7kjvLQbuLd9NEFbOhmX:Z/cBJaLXt2NaheUrMmb/FkjvLQbuZZmX
                                  MD5:5060FA094CE77A1DB1BEB4010F3C2306
                                  SHA1:93B017A300C14CEEBA12AFBC23573A42443D861D
                                  SHA-256:25C495FB28889E0C4D378309409E18C77F963337F790FEDFBB13E5CC54A23243
                                  SHA-512:2384A0A8FC158481E969F66958C4B7D370BE4219046AB7D77E93E90F7F1C3815F23B47E76EFD8129234CCCB3BCAC2AA8982831D8745E0B733315C1CCF3B1973D
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...m............." ..0..&..........&E... ...`....... ..............................t.....@..................................D..O....`..............................$D..8............................................ ............... ..H............text...,%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............,..............@..B.................E......H........'.......................C........................................(....*^.(.......&...%...}....*:.(......}....*:.(......}....*:.(......}....*....0..........s.......}.....s....}.....{....r...p(......,h.{....r...p......%...(.....rS..p.(....~....%-.&~..........s....%......(...+%-.&+.(...........s....(...+&.{....o....-!.{.....{.....{....rc..po....(.....{....o.........{.....{.....{....r}..po....(.....{....o....-..{....r...p......(.....*.{....s .....-..o!.......{....r}..p.o

                                  C:\Users\user\AppData\Local\Temp\MSI6666.tmp-\ScreenConnect.Windows.dll

                                  Download File
                                  Process:C:\Windows\SysWOW64\rundll32.exe
                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Category:dropped
                                  Size (bytes):1721856
                                  Entropy (8bit):6.639136400085158
                                  Encrypted:false
                                  SSDEEP:24576:gx5x94kEFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:gx5xKkEJkGYYpT0+TFiH7efP
                                  MD5:9F823778701969823C5A01EF3ECE57B7
                                  SHA1:DA733F482825EC2D91F9F1186A3F934A2EA21FA1
                                  SHA-256:ABCA7CF12937DA14C9323C880EC490CC0E063D7A3EEF2EAC878CD25C84CF1660
                                  SHA-512:FFC40B16F5EA2124629D797DC3A431BEB929373BFA773C6CDDC21D0DC4105D7360A485EA502CE8EA3B12EE8DCA8275A0EC386EA179093AF3AA8B31B4DD3AE1CA
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l............" ..0..>...........]... ...`....... ..............................[.....@................................./]..O....`...............................\..8............................................ ............... ..H............text....=... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............D..............@..B................c]......H.......t...h..............0....\........................................()...*^.()..........%...}....*:.().....}....*:.().....}....*:.().....}....*..s*...*..s+...*:.(,.....(-...*..{....*"..}....*J.(/........(0...&*:.(,.....(1...*..{2...*"..}2...*.0..(........(3......+.............(0...&..X....i2.*v.(,....s4...}.....s5...}....*v.{.....r...p(...+.....o7....*.0...........o8....+..o9......(...+&.o....-....,..o......*..........."........{..........o:...&.......(.....*....0..L...

                                  C:\Users\user\AppData\Local\Temp\ScreenConnect\8139d6693ff11377\setup.msi

                                  Download File
                                  Process:C:\Users\user\Desktop\SSA-Statement283482.exe
                                  File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {36B75195-3778-3603-935A-9224F330994C}, Create Time/Date: Tue Aug 13 23:22:20 2024, Last Saved Time/Date: Tue Aug 13 23:22:20 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
                                  Category:dropped
                                  Size (bytes):8237056
                                  Entropy (8bit):7.947702959091875
                                  Encrypted:false
                                  SSDEEP:196608:j53JLR3LGMLiW35953JLR3LGMLl53JLR3LGMLm53JLR3LGML:ZTiunT/TqT
                                  MD5:2AA4DC46E75B0A67EA4629169225E890
                                  SHA1:484B7A0CF43D099EF0E88D3A00326E38738E065E
                                  SHA-256:9EDE2A9B8D94D6D2AE58141DD6E06DA5BD84D0ECF09FA9678565543B07DE210D
                                  SHA-512:289E4AF2DEE5B81B85460A6F6D674AB8EA5B9515CD02BC17440B869B8780227769AA4DE817C1E15747755AB494A08C267628052A5D73B0F619611C0EDEC0414D
                                  Malicious:false
                                  Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Windows\Installer\4669b2.msi

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {36B75195-3778-3603-935A-9224F330994C}, Create Time/Date: Tue Aug 13 23:22:20 2024, Last Saved Time/Date: Tue Aug 13 23:22:20 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
                                  Category:dropped
                                  Size (bytes):8237056
                                  Entropy (8bit):7.947702959091875
                                  Encrypted:false
                                  SSDEEP:196608:j53JLR3LGMLiW35953JLR3LGMLl53JLR3LGMLm53JLR3LGML:ZTiunT/TqT
                                  MD5:2AA4DC46E75B0A67EA4629169225E890
                                  SHA1:484B7A0CF43D099EF0E88D3A00326E38738E065E
                                  SHA-256:9EDE2A9B8D94D6D2AE58141DD6E06DA5BD84D0ECF09FA9678565543B07DE210D
                                  SHA-512:289E4AF2DEE5B81B85460A6F6D674AB8EA5B9515CD02BC17440B869B8780227769AA4DE817C1E15747755AB494A08C267628052A5D73B0F619611C0EDEC0414D
                                  Malicious:false
                                  Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Windows\Installer\4669b4.msi

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {36B75195-3778-3603-935A-9224F330994C}, Create Time/Date: Tue Aug 13 23:22:20 2024, Last Saved Time/Date: Tue Aug 13 23:22:20 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
                                  Category:dropped
                                  Size (bytes):8237056
                                  Entropy (8bit):7.947702959091875
                                  Encrypted:false
                                  SSDEEP:196608:j53JLR3LGMLiW35953JLR3LGMLl53JLR3LGMLm53JLR3LGML:ZTiunT/TqT
                                  MD5:2AA4DC46E75B0A67EA4629169225E890
                                  SHA1:484B7A0CF43D099EF0E88D3A00326E38738E065E
                                  SHA-256:9EDE2A9B8D94D6D2AE58141DD6E06DA5BD84D0ECF09FA9678565543B07DE210D
                                  SHA-512:289E4AF2DEE5B81B85460A6F6D674AB8EA5B9515CD02BC17440B869B8780227769AA4DE817C1E15747755AB494A08C267628052A5D73B0F619611C0EDEC0414D
                                  Malicious:false
                                  Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Windows\Installer\MSI6E36.tmp

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):423513
                                  Entropy (8bit):6.577868573573477
                                  Encrypted:false
                                  SSDEEP:6144:JuH2aCGw1ST1wQLdqv5uH2aCGw1ST1wQLdqv5:JuH2anwohwQUv5uH2anwohwQUv5
                                  MD5:DE0960A1B0B4157059B68A2261284B5F
                                  SHA1:5FF8B2D25640454F574992D7D5D23327D91B7698
                                  SHA-256:543EC73D0DA52C67865DD8738AAC71EC5B33108715115646716AF1EED7B6E3D0
                                  SHA-512:34927C84A1683E32A709EB4AB73ED0161EEF97F48EAC14EE4A9BE5B971C91125F3B89B96DD5FF66393C116A675720EC8364D296338FD910B7FACB86737AE8B5D
                                  Malicious:false
                                  Yara Hits:
                                  • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Installer\MSI6E36.tmp, Author: Joe Security
                                  Preview:...@IXOS.@.....@.N,Y.@.....@.....@.....@.....@.....@......&.{36B75195-3778-3603-935A-9224F330994C}'.ScreenConnect Client (8139d6693ff11377)..setup.msi.@.....@.....@.....@......DefaultIcon..&.{36B75195-3778-3603-935A-9224F330994C}.....@.....@.....@.....@.......@.....@.....@.......@....'.ScreenConnect Client (8139d6693ff11377)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{40A64DDB-C3F2-1624-70DC-7181A1E29087}^.C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.dll.@.......@.....@.....@......&.{D3422459-9E74-C140-280B-22440A1685FB}f.C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsBackstageShell.exe.@.......@.....@.....@......&.{F7B34A45-C5CD-8115-C4BF-BE030371C630}c.C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsFileManager.exe.@.......@.

                                  C:\Windows\Installer\MSI6E95.tmp

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                  Category:dropped
                                  Size (bytes):207360
                                  Entropy (8bit):6.573348437503042
                                  Encrypted:false
                                  SSDEEP:3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
                                  MD5:BA84DD4E0C1408828CCC1DE09F585EDA
                                  SHA1:E8E10065D479F8F591B9885EA8487BC673301298
                                  SHA-256:3CFF4AC91288A0FF0C13278E73B282A64E83D089C5A61A45D483194AB336B852
                                  SHA-512:7A38418F6EE8DBC66FAB2CD5AD8E033E761912EFC465DAA484858D451DA4B8576079FE90FD3B6640410EDC8B3CAC31C57719898134F246F4000D60A252D88290
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........AF../.../.../.'D..../.'D..../.'D..../...,.../...+.../...*.../......./......./.....n./.*.*.../.*./.../.*...../....../.*.-.../.Rich../.........................PE..L...pG.Y...........!.........L......&.....................................................@.................................P........P..x....................`......P...T...............................@...............<............................text...+........................... ..`.rdata..*...........................@..@.data...."... ......................@....rsrc...x....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

                                  C:\Windows\Installer\MSI706A.tmp

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                  Category:dropped
                                  Size (bytes):207360
                                  Entropy (8bit):6.573348437503042
                                  Encrypted:false
                                  SSDEEP:3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
                                  MD5:BA84DD4E0C1408828CCC1DE09F585EDA
                                  SHA1:E8E10065D479F8F591B9885EA8487BC673301298
                                  SHA-256:3CFF4AC91288A0FF0C13278E73B282A64E83D089C5A61A45D483194AB336B852
                                  SHA-512:7A38418F6EE8DBC66FAB2CD5AD8E033E761912EFC465DAA484858D451DA4B8576079FE90FD3B6640410EDC8B3CAC31C57719898134F246F4000D60A252D88290
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........AF../.../.../.'D..../.'D..../.'D..../...,.../...+.../...*.../......./......./.....n./.*.*.../.*./.../.*...../....../.*.-.../.Rich../.........................PE..L...pG.Y...........!.........L......&.....................................................@.................................P........P..x....................`......P...T...............................@...............<............................text...+........................... ..`.rdata..*...........................@..@.data...."... ......................@....rsrc...x....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

                                  C:\Windows\Installer\SourceHash{36B75195-3778-3603-935A-9224F330994C}

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:Composite Document File V2 Document, Cannot read section info
                                  Category:dropped
                                  Size (bytes):20480
                                  Entropy (8bit):1.1612570529429043
                                  Encrypted:false
                                  SSDEEP:12:JSbX72FjKDAGiLIlHVRpMh/7777777777777777777777777vDHF+6bbulp3Xl0G:JkDQI5cQ6bab6F
                                  MD5:81E945811BDC7B94151EB05A4D8E4570
                                  SHA1:106985E1FD114017ADC39385BF6D80AACF894408
                                  SHA-256:D46EF1B29E7C7BCF8FCB0CEE80166FCA02482953CD2C34A082AA0BCBA6CE9D8A
                                  SHA-512:EF8E2D129357610D758255E6F8502F062A4031C134412767105E301691BF5B4DEE9D132B3A275A423AC6C73833EB95C52B4FDAE56337CEFE4B8258B09D4DB963
                                  Malicious:false
                                  Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Windows\Installer\inprogressinstallinfo.ipi

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:Composite Document File V2 Document, Cannot read section info
                                  Category:dropped
                                  Size (bytes):20480
                                  Entropy (8bit):1.8188648209368754
                                  Encrypted:false
                                  SSDEEP:48:e8Ph2uRc06WX4EFT5iVccdwqcq56AduOSiCzdb4YqyMi3D+kewitpiErmAduOSIV:Rh210FTud1pHfgdUGM8DZkpLhII
                                  MD5:C6C907BFE758C7926B019105ECAB7A7E
                                  SHA1:DEBBD4AB0197327D5E3701636C16EA8C0B5AFF15
                                  SHA-256:2C4F9E15453B01630A93818B88416144CCBE3D1941127E9D967EC1AE321C4878
                                  SHA-512:F800BEEE734926BB622B306FA6808A5292B72AB2B34DEB09D38044C88174F956FAC94610FBBFD0D8E7F988E4306FA3F9FFF62A202D678E2DA886D7B82C54F2CD
                                  Malicious:false
                                  Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Windows\Installer\{36B75195-3778-3603-935A-9224F330994C}\DefaultIcon

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:MS Windows icon resource - 3 icons, 16x16 with PNG image data, 16 x 16, 8-bit colormap, non-interlaced, 4 bits/pixel, 32x32 with PNG image data, 32 x 32, 1-bit colormap, non-interlaced, 4 bits/pixel
                                  Category:dropped
                                  Size (bytes):435
                                  Entropy (8bit):5.289734780210945
                                  Encrypted:false
                                  SSDEEP:12:Kvv/7tghWPjScQZ/Ev/739Jgh5TZYR/v/71XfghNeZ:QOZZq9JOz0dONeZ
                                  MD5:F34D51C3C14D1B4840AE9FF6B70B5D2F
                                  SHA1:C761D3EF26929F173CEB2F8E01C6748EE2249A8A
                                  SHA-256:0DD459D166F037BB8E531EB2ECEB2B79DE8DBBD7597B05A03C40B9E23E51357A
                                  SHA-512:D6EEB5345A5A049A87BFBFBBBEBFBD9FBAEC7014DA41DB1C706E8B16DDEC31561679AAE9E8A0847098807412BD1306B9616C8E6FCFED8683B4F33BD05ADE38D1
                                  Malicious:false
                                  Preview:..............z...6... ..............00..........0....PNG........IHDR.............(-.S....PLTE....22.u......tRNS.@..f..."IDATx.c` .0"...$.(......SC..Q8....9b.i.Xa.....IEND.B`..PNG........IHDR... ... .....I......PLTE....22.u......tRNS.@..f...(IDATx.c`...... ... D.......vb.....A`..(.-s...q....IEND.B`..PNG........IHDR...0...0.....m.k.....PLTE....22.u......tRNS.@..f...+IDATx.c` .......Q...S.@..DQu...4...(.}DQD...3x........IEND.B`.

                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):360001
                                  Entropy (8bit):5.362996578969812
                                  Encrypted:false
                                  SSDEEP:1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauK:zTtbmkExhMJCIpEL
                                  MD5:009BA57FA06D25541F4D2974B7F932F7
                                  SHA1:A91A5401E5D4560A58D8527E8A0BCC3EF1F856E6
                                  SHA-256:EA538CA651951F918017E9152DF54588119A193849947CF71D637FA0C00E7E94
                                  SHA-512:0F8800879DAE868E5EAEF5C0D5DD0A29AE621B75DD519DBFD265FD2BD6B9D29EC26197D00E6D87FEAD948EE7B844B1AB811C64CA5C64847D758403AC689E0E1D
                                  Malicious:false
                                  Preview:.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

                                  C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                  Download File
                                  Process:C:\Windows\System32\svchost.exe
                                  File Type:JSON data
                                  Category:dropped
                                  Size (bytes):55
                                  Entropy (8bit):4.306461250274409
                                  Encrypted:false
                                  SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                  MD5:DCA83F08D448911A14C22EBCACC5AD57
                                  SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                  SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                  SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                  Malicious:false
                                  Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                  C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\10351va5.newcfg

                                  Download File
                                  Process:C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe
                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):582
                                  Entropy (8bit):5.028719298475039
                                  Encrypted:false
                                  SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlb8AW2+HHe/vXbAa3xT:2dL9hK6E46YPRIHHEvH
                                  MD5:FD4A8E0BCC2CFF311919B9951075B899
                                  SHA1:B9A2F1D6572F9EE8AD17DFA225CDE56B0C5341AF
                                  SHA-256:F3B1921A587DFF110397F71F2CE5FF5E531997AD9BB2ED0F87FC443235CF4359
                                  SHA-512:FD86678A7BC9F77C9FD32BFA02346D43CE51DA7647271C1E4F9F465919DFBF19340D32E0706E07496C7932D309F61405DF46EF7A115670CCECEE292C2D0D021F
                                  Malicious:false
                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-uil9h2-relay.screenconnect.com=147.75.81.4-12%2f09%2f2024%2013%3a52%3a39</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                  C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\dvn1kfnd.newcfg

                                  Download File
                                  Process:C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe
                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):582
                                  Entropy (8bit):5.031174334569632
                                  Encrypted:false
                                  SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlb8AW2+r/vXbAa3xT:2dL9hK6E46YPRIzvH
                                  MD5:AB321D4589F7CBAD3CA5B40A52BE4D77
                                  SHA1:0A72355227F19C92F55765663129142A4AA862AE
                                  SHA-256:51869FE267520F5041CCFB2C5D89B4A62220BE21564F0705539FA8E44A0D2429
                                  SHA-512:2611BD4C49F1E251AAE6262E2C0774F4780BBC65376106FE2716815D2A763B2AE990C3F76B14DB52CC3F51E75FC4EEDDD6A8656A7EA01309606887C46FC672F3
                                  Malicious:false
                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-uil9h2-relay.screenconnect.com=147.75.81.4-12%2f09%2f2024%2013%3a53%3a06</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                  C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\dy55a2rz.newcfg

                                  Download File
                                  Process:C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe
                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):582
                                  Entropy (8bit):5.028719298475039
                                  Encrypted:false
                                  SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlb8AW2+HLBQv/vXbAa3xT:2dL9hK6E46YPRIHtQ3vH
                                  MD5:06EA399A537C1B0FCBCC86A628E53F3E
                                  SHA1:7F8259A6AF8A6AC12324B3DEB92342E2C5328F4E
                                  SHA-256:AB46A17B0F97C1E7E1F9D7AF2D91CCEB47585B5F5BC653A66D05681102A1E942
                                  SHA-512:5A9A11A32D72AD53DFCCF55F62E91ACACFBDA30D91AB0C6F24DF302D525399384FF27E4DF0DD00022AC24ADCE1F81EA0DB3CF42BE0962A5F014B4AEEDD558C92
                                  Malicious:false
                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-uil9h2-relay.screenconnect.com=147.75.81.4-12%2f09%2f2024%2013%3a52%3a35</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                  C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\emjfhf4e.newcfg

                                  Download File
                                  Process:C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe
                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):582
                                  Entropy (8bit):5.028220167795566
                                  Encrypted:false
                                  SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlb8AW2+Heev/vXbAa3xT:2dL9hK6E46YPRIHX3vH
                                  MD5:FABC127EBE461BD347AAC73CCC5648D4
                                  SHA1:B786D1B24A524600E6172DBA13F4ADBDCDE3CF64
                                  SHA-256:6532B5EF0BDB15490062BA4E00DF7103621A48C6C45FC46CA1523D2A96F49E65
                                  SHA-512:57E80E0FE90530515C4F381E7585CC965F1EDCC092E36093746FC961ECE34D4CD079BFB39AD8F55DC3C8594F79ECCE98F3712E70F995D1F8217E1753D85000D5
                                  Malicious:false
                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-uil9h2-relay.screenconnect.com=147.75.81.4-12%2f09%2f2024%2013%3a52%3a45</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                  C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\fapszhfs.newcfg

                                  Download File
                                  Process:C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe
                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):582
                                  Entropy (8bit):5.028220167795566
                                  Encrypted:false
                                  SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlb8AW2+X/vXbAa3xT:2dL9hK6E46YPRIvvH
                                  MD5:7A766879E35330F259345284DCCF4834
                                  SHA1:27A1EE39D4294C78045DF9406C190D97C6652C1E
                                  SHA-256:D76B89796E72B3D6DD6B38F53A5F57B4A8D59AEBDB42F8BD7FB288E35B2AAE0F
                                  SHA-512:52270D0A07A4B8D1FB33678E0FBA8284A3A1FD7B9BB1DFEDB0B1BF8A84913EEE89D30CD10CDB2FF1192C75207584710C29E108A26F4E3A875BF577D943468AE0
                                  Malicious:false
                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-uil9h2-relay.screenconnect.com=147.75.81.4-12%2f09%2f2024%2013%3a53%3a24</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                  C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\hmjrvzyg.newcfg

                                  Download File
                                  Process:C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe
                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                  Category:modified
                                  Size (bytes):582
                                  Entropy (8bit):5.030116049320927
                                  Encrypted:false
                                  SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlb8AW2+5/vXbAa3xT:2dL9hK6E46YPRIRvH
                                  MD5:C3B6883BD8FEF6E96BA7A54B06C00068
                                  SHA1:4ED2959ED34DFB4F18B6A2A7CCD180FB90CCDD13
                                  SHA-256:61829FEF88DBB2778FA41CFF9E021BB218AFA45D91E997C85EC98F7598B04788
                                  SHA-512:425FA0BAE030F67C4F3D2E2B2383FDD5242A8EF223FDEEF3624B2C59A9D2A2F6CF87F8D6814225B60DE2C90E28242B97149094E7A44CDE9C175F39C341C7C72F
                                  Malicious:false
                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-uil9h2-relay.screenconnect.com=147.75.81.4-12%2f09%2f2024%2013%3a54%3a38</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                  C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\shbuxrhm.newcfg

                                  Download File
                                  Process:C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe
                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):582
                                  Entropy (8bit):5.027139084491286
                                  Encrypted:false
                                  SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlb8AW2+H5/vXbAa3xT:2dL9hK6E46YPRIHRvH
                                  MD5:8D9601D9CDA20556F3BF03BF16263CF4
                                  SHA1:88BDCA055A57AAB3DA5EF14EA29C236123E377F0
                                  SHA-256:DC1BD7E68F8CE032BC131F9E4DD92E95724CA3319E7F624249B242C780C939A5
                                  SHA-512:9C48AB312C546832F731BBDF3BA52D20C018E32F4DD302FF446D215A020EF95A092E86CDCB9CDA2EAB8EAE347737D21E15CB76099B02BE8584948E922F5074AD
                                  Malicious:false
                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-uil9h2-relay.screenconnect.com=147.75.81.4-12%2f09%2f2024%2013%3a52%3a32</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                  C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\user.config (copy)

                                  Download File
                                  Process:C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe
                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):582
                                  Entropy (8bit):5.027139084491286
                                  Encrypted:false
                                  SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlb8AW2+HEw/vXbAa3xT:2dL9hK6E46YPRIHtvH
                                  MD5:1347945A54853CBB784CF49A1A13A068
                                  SHA1:BAC5A57823D5CAC0BD003FECCDB840397E25FB34
                                  SHA-256:34915E14DAE3F730246AFE6664CA69FF8D219523230B8872CE19755441D2FB84
                                  SHA-512:C5F66943C26694DF5FC7E3C5971E0DFFDD49BF7E4C765085F07A5E01DBE0E6CBD1A2EFA93C0264D1AEAEE6DE5E9646629C777DC419B78914E33177BAE5162788
                                  Malicious:false
                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-uil9h2-relay.screenconnect.com=147.75.81.4-12%2f09%2f2024%2013%3a52%3a29</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                  C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\xnrld11y.newcfg

                                  Download File
                                  Process:C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe
                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):582
                                  Entropy (8bit):5.027139084491286
                                  Encrypted:false
                                  SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlb8AW2+HEw/vXbAa3xT:2dL9hK6E46YPRIHtvH
                                  MD5:1347945A54853CBB784CF49A1A13A068
                                  SHA1:BAC5A57823D5CAC0BD003FECCDB840397E25FB34
                                  SHA-256:34915E14DAE3F730246AFE6664CA69FF8D219523230B8872CE19755441D2FB84
                                  SHA-512:C5F66943C26694DF5FC7E3C5971E0DFFDD49BF7E4C765085F07A5E01DBE0E6CBD1A2EFA93C0264D1AEAEE6DE5E9646629C777DC419B78914E33177BAE5162788
                                  Malicious:false
                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-uil9h2-relay.screenconnect.com=147.75.81.4-12%2f09%2f2024%2013%3a52%3a29</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                  C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\yczkoffm.newcfg

                                  Download File
                                  Process:C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe
                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):582
                                  Entropy (8bit):5.029074635408923
                                  Encrypted:false
                                  SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlb8AW2+ig/vXbAa3xT:2dL9hK6E46YPRIiGvH
                                  MD5:E25E915C7620F851E4B04A84C902A233
                                  SHA1:E2D4E0CB1FD9071D6326765563E70020F216D84D
                                  SHA-256:DD4AADB432E998E39D85C7C302F47271FC825AB70409F7080119D57FD1E3DCCC
                                  SHA-512:2D639167529C34D2D4AF030D0F73EB067990326B469591CA1899963A99DB218FE8F422BAD799FB0BE636ADBF14F416442CE67B146F7FC18ED0953DC2C0000CFB
                                  Malicious:false
                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-uil9h2-relay.screenconnect.com=147.75.81.4-12%2f09%2f2024%2013%3a53%3a51</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                  C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8139d6693ff11377)\ygssea3k.newcfg

                                  Download File
                                  Process:C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe
                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):582
                                  Entropy (8bit):5.028719298475039
                                  Encrypted:false
                                  SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlb8AW2+HXqt/vXbAa3xT:2dL9hK6E46YPRIHXEvH
                                  MD5:7FA270FD6877EB7A77FD8575D586D70A
                                  SHA1:9DC9E04470EA7E592C5A335B758B10CC3929C441
                                  SHA-256:1E75D6F780A74FA13124DF8A9C891555281A0C587140769E413A92A5165845C2
                                  SHA-512:29F775DBD4A689C3D43EAB99D793898615A5C369218DCA20224611A92705F8E40F8C178400FE3837BF13AC56D203F25BE5B07736D20D8D7D44816E8104987B38
                                  Malicious:false
                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-uil9h2-relay.screenconnect.com=147.75.81.4-12%2f09%2f2024%2013%3a52%3a53</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                  C:\Windows\Temp\~DF22FF4617C82E005F.TMP

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:Composite Document File V2 Document, Cannot read section info
                                  Category:dropped
                                  Size (bytes):32768
                                  Entropy (8bit):1.4334718068644083
                                  Encrypted:false
                                  SSDEEP:48:IpeusO+xFX45T5hUEVccdwqcq56AduOSiCzdb4YqyMi3D+kewitpiErmAduOSIDJ:YepaTXFd1pHfgdUGM8DZkpLhII
                                  MD5:188CE52E9CEBC491EEA576E2F5D7F063
                                  SHA1:1E4FAC4D4B19C1F7FF92D8F21DC5B15BB08FCEDC
                                  SHA-256:DB5674057B68D0A6EC3390C291FB4C845686E38AA5231616C1D3C183CBC0F5DC
                                  SHA-512:A73EF18B35BA21C48CD93066DD9D665748C8F550BA992C40CFA96CC77B737D7325B9FA0CFA071243E231A691479A5B858EF24842AAA84026CF9CE7CBC2EC5C21
                                  Malicious:false
                                  Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Windows\Temp\~DF467CA79FD80C4BDD.TMP

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:Composite Document File V2 Document, Cannot read section info
                                  Category:dropped
                                  Size (bytes):32768
                                  Entropy (8bit):1.4334718068644083
                                  Encrypted:false
                                  SSDEEP:48:IpeusO+xFX45T5hUEVccdwqcq56AduOSiCzdb4YqyMi3D+kewitpiErmAduOSIDJ:YepaTXFd1pHfgdUGM8DZkpLhII
                                  MD5:188CE52E9CEBC491EEA576E2F5D7F063
                                  SHA1:1E4FAC4D4B19C1F7FF92D8F21DC5B15BB08FCEDC
                                  SHA-256:DB5674057B68D0A6EC3390C291FB4C845686E38AA5231616C1D3C183CBC0F5DC
                                  SHA-512:A73EF18B35BA21C48CD93066DD9D665748C8F550BA992C40CFA96CC77B737D7325B9FA0CFA071243E231A691479A5B858EF24842AAA84026CF9CE7CBC2EC5C21
                                  Malicious:false
                                  Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Windows\Temp\~DF7AF474492AD909A4.TMP

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:Composite Document File V2 Document, Cannot read section info
                                  Category:dropped
                                  Size (bytes):20480
                                  Entropy (8bit):1.8188648209368754
                                  Encrypted:false
                                  SSDEEP:48:e8Ph2uRc06WX4EFT5iVccdwqcq56AduOSiCzdb4YqyMi3D+kewitpiErmAduOSIV:Rh210FTud1pHfgdUGM8DZkpLhII
                                  MD5:C6C907BFE758C7926B019105ECAB7A7E
                                  SHA1:DEBBD4AB0197327D5E3701636C16EA8C0B5AFF15
                                  SHA-256:2C4F9E15453B01630A93818B88416144CCBE3D1941127E9D967EC1AE321C4878
                                  SHA-512:F800BEEE734926BB622B306FA6808A5292B72AB2B34DEB09D38044C88174F956FAC94610FBBFD0D8E7F988E4306FA3F9FFF62A202D678E2DA886D7B82C54F2CD
                                  Malicious:false
                                  Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Windows\Temp\~DF833C515F57C2AFFB.TMP

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):512
                                  Entropy (8bit):0.0
                                  Encrypted:false
                                  SSDEEP:3::
                                  MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                  SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                  SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                  SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                  Malicious:false
                                  Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Windows\Temp\~DF8842D64B99E96CD0.TMP

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:Composite Document File V2 Document, Cannot read section info
                                  Category:dropped
                                  Size (bytes):20480
                                  Entropy (8bit):1.8188648209368754
                                  Encrypted:false
                                  SSDEEP:48:e8Ph2uRc06WX4EFT5iVccdwqcq56AduOSiCzdb4YqyMi3D+kewitpiErmAduOSIV:Rh210FTud1pHfgdUGM8DZkpLhII
                                  MD5:C6C907BFE758C7926B019105ECAB7A7E
                                  SHA1:DEBBD4AB0197327D5E3701636C16EA8C0B5AFF15
                                  SHA-256:2C4F9E15453B01630A93818B88416144CCBE3D1941127E9D967EC1AE321C4878
                                  SHA-512:F800BEEE734926BB622B306FA6808A5292B72AB2B34DEB09D38044C88174F956FAC94610FBBFD0D8E7F988E4306FA3F9FFF62A202D678E2DA886D7B82C54F2CD
                                  Malicious:false
                                  Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Windows\Temp\~DF90A92EE94EA9E50E.TMP

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):32768
                                  Entropy (8bit):0.06907654018647505
                                  Encrypted:false
                                  SSDEEP:6:2/9LG7iVCnLG7iVrKOzPLHKOL666CbfWGyVky6l3X:2F0i8n0itFzDHF+6bbuE3X
                                  MD5:5A88E8B39B3F8E639C3B064CDC3B2DB7
                                  SHA1:518D1532BF7F53F5B6B27899CE7ED61FEB814E44
                                  SHA-256:6E9FA1C4F8F154779142ED29029979C34F892909F5A0FD2AA193708BB6E3949C
                                  SHA-512:A7FF6208327F7A915FD615A8FADA8FF5A3C15C0B8A2B1F90CCE3A030096F08CF5956224C166B218AA31E8D51AC77C48FCD89B8C0526FE7C31CF16949E7001CCE
                                  Malicious:false
                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Windows\Temp\~DFA7F9797648A5EB9F.TMP

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):69632
                                  Entropy (8bit):0.24176782731859017
                                  Encrypted:false
                                  SSDEEP:48:pWIIGDBAduOS3qcq56AduOSiCzdb4YqyMi3D+kewitpiEreGcnV:4IIvxpHfgdUGM8DZkp4n
                                  MD5:BB7CF8C0BD4155BA0178855FBB2A713E
                                  SHA1:6A7BA90A6F9F7F43E7819FF352D63D425457C2BF
                                  SHA-256:1FECB2D05FEC2608F15C042280A0EECFD0A3F03D23018E5F9BA51CFAD650A0DB
                                  SHA-512:D220B9F46FB2CCE3F1CE81AF3489048B87CAE9BA477F159BDF1D5BC4A9C10DE21E01A222A528A509E52418252F2C7444A26F4C88F6618DAD6835BF706364AB37
                                  Malicious:false
                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Windows\Temp\~DFA9BB98F43C4E8BAF.TMP

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):512
                                  Entropy (8bit):0.0
                                  Encrypted:false
                                  SSDEEP:3::
                                  MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                  SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                  SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                  SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                  Malicious:false
                                  Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Windows\Temp\~DFB06B4E32E39DD023.TMP

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):512
                                  Entropy (8bit):0.0
                                  Encrypted:false
                                  SSDEEP:3::
                                  MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                  SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                  SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                  SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                  Malicious:false
                                  Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Windows\Temp\~DFC0D1C281BFFEA2A2.TMP

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):512
                                  Entropy (8bit):0.0
                                  Encrypted:false
                                  SSDEEP:3::
                                  MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                  SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                  SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                  SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                  Malicious:false
                                  Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Windows\Temp\~DFE2ADAC1BA9D315DE.TMP

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:Composite Document File V2 Document, Cannot read section info
                                  Category:dropped
                                  Size (bytes):32768
                                  Entropy (8bit):1.4334718068644083
                                  Encrypted:false
                                  SSDEEP:48:IpeusO+xFX45T5hUEVccdwqcq56AduOSiCzdb4YqyMi3D+kewitpiErmAduOSIDJ:YepaTXFd1pHfgdUGM8DZkpLhII
                                  MD5:188CE52E9CEBC491EEA576E2F5D7F063
                                  SHA1:1E4FAC4D4B19C1F7FF92D8F21DC5B15BB08FCEDC
                                  SHA-256:DB5674057B68D0A6EC3390C291FB4C845686E38AA5231616C1D3C183CBC0F5DC
                                  SHA-512:A73EF18B35BA21C48CD93066DD9D665748C8F550BA992C40CFA96CC77B737D7325B9FA0CFA071243E231A691479A5B858EF24842AAA84026CF9CE7CBC2EC5C21
                                  Malicious:false
                                  Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Windows\Temp\~DFE2BC7FB592CE0CF6.TMP

                                  Download File
                                  Process:C:\Windows\System32\msiexec.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):512
                                  Entropy (8bit):0.0
                                  Encrypted:false
                                  SSDEEP:3::
                                  MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                  SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                  SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                  SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                  Malicious:false
                                  Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  Static File Info

                                  General

                                  File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                  Entropy (8bit):7.425996531517683
                                  TrID:
                                  • Win32 Executable (generic) Net Framework (10011505/4) 50.01%
                                  • Win32 Executable (generic) a (10002005/4) 49.97%
                                  • Generic Win/DOS Executable (2004/3) 0.01%
                                  • DOS Executable Generic (2002/1) 0.01%
                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                  File name:SSA-Statement283482.exe
                                  File size:5'620'224 bytes
                                  MD5:3947493098fa9f8ad99838b31b1718ca
                                  SHA1:46c9b68d1a104a46d79025965cae26f44e768985
                                  SHA256:aa1b77e4203f23734eee91f426b9167c579f3a075ddc45c42ac4714ddc56d03a
                                  SHA512:97409a6c8f461c208e9995b2852b81b6f81bc3bc54d991822b36c66f5a800206de23b5517ee7e7ed59e9a12e173ecedca64430f98b47e898aa40e6ec44a04ad5
                                  SSDEEP:49152:3Dex5xKkEJkGYYpT0+TFiH7efP0x58IJL+md3rHgDNMKLo8SsxG/XcW32gqkAfoO:F4s6efPQ53JLbd3LINMLaGUW39f0
                                  TLSH:C746E011B3DA95B9D0BF053CD87A52699A74BC048722C7AF57D4BD292D32BC04E323B6
                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`.....O>`.....?>`.....]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF..A>`.[l..F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`........

                                  File Icon

                                  Icon Hash:00928e8e8686b000

                                  Static PE Info

                                  General

                                  Entrypoint:0x4014ad
                                  Entrypoint Section:.text
                                  Digitally signed:true
                                  Imagebase:0x400000
                                  Subsystem:windows gui
                                  Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                  DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                  Time Stamp:0x6377E6AC [Fri Nov 18 20:10:20 2022 UTC]
                                  TLS Callbacks:
                                  CLR (.Net) Version:
                                  OS Version Major:5
                                  OS Version Minor:1
                                  File Version Major:5
                                  File Version Minor:1
                                  Subsystem Version Major:5
                                  Subsystem Version Minor:1
                                  Import Hash:9771ee6344923fa220489ab01239bdfd

                                  Authenticode Signature

                                  Signature Valid:true
                                  Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
                                  Signature Validation Error:The operation completed successfully
                                  Error Number:0
                                  Not Before, Not After
                                  • 17/08/2022 02:00:00 16/08/2025 01:59:59
                                  Subject Chain
                                  • CN="Connectwise, LLC", O="Connectwise, LLC", L=Tampa, S=Florida, C=US
                                  Version:3
                                  Thumbprint MD5:AAE704EC2810686C3BF7704E660AFB5D
                                  Thumbprint SHA-1:4C2272FBA7A7380F55E2A424E9E624AEE1C14579
                                  Thumbprint SHA-256:82B4E7924D5BED84FB16DDF8391936EB301479CEC707DC14E23BC22B8CDEAE28
                                  Serial:0B9360051BCCF66642998998D5BA97CE

                                  Entrypoint Preview

                                  Instruction
                                  call 00007F975CD854EAh
                                  jmp 00007F975CD84F9Fh
                                  push ebp
                                  mov ebp, esp
                                  push 00000000h
                                  call dword ptr [0040D040h]
                                  push dword ptr [ebp+08h]
                                  call dword ptr [0040D03Ch]
                                  push C0000409h
                                  call dword ptr [0040D044h]
                                  push eax
                                  call dword ptr [0040D048h]
                                  pop ebp
                                  ret
                                  push ebp
                                  mov ebp, esp
                                  sub esp, 00000324h
                                  push 00000017h
                                  call dword ptr [0040D04Ch]
                                  test eax, eax
                                  je 00007F975CD85127h
                                  push 00000002h
                                  pop ecx
                                  int 29h
                                  mov dword ptr [004148D8h], eax
                                  mov dword ptr [004148D4h], ecx
                                  mov dword ptr [004148D0h], edx
                                  mov dword ptr [004148CCh], ebx
                                  mov dword ptr [004148C8h], esi
                                  mov dword ptr [004148C4h], edi
                                  mov word ptr [004148F0h], ss
                                  mov word ptr [004148E4h], cs
                                  mov word ptr [004148C0h], ds
                                  mov word ptr [004148BCh], es
                                  mov word ptr [004148B8h], fs
                                  mov word ptr [004148B4h], gs
                                  pushfd
                                  pop dword ptr [004148E8h]
                                  mov eax, dword ptr [ebp+00h]
                                  mov dword ptr [004148DCh], eax
                                  mov eax, dword ptr [ebp+04h]
                                  mov dword ptr [004148E0h], eax
                                  lea eax, dword ptr [ebp+08h]
                                  mov dword ptr [004148ECh], eax
                                  mov eax, dword ptr [ebp-00000324h]
                                  mov dword ptr [00414828h], 00010001h

                                  Rich Headers

                                  Programming Language:
                                  • [IMP] VS2008 SP1 build 30729
                                  • [IMP] VS2008 build 21022

                                  Data Directories

                                  NameVirtual AddressVirtual Size Is in Section
                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x129c40x50.rdata
                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x160000x533080.rsrc
                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x5462000x16000
                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x54a0000xea8.reloc
                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x11f200x70.rdata
                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x11e600x40.rdata
                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_IAT0xd0000x13c.rdata
                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                  Sections

                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                  .text0x10000xb1af0xb200d9fa6da0baf4b869720be833223490cbFalse0.6123156601123596data6.592039633797327IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                  .rdata0xd0000x60780x62008b45a1035c0de72f910a75db7749f735False0.41549744897959184data4.786621464556291IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                  .data0x140000x11e40x8001f4cc86b6735a74429c9d1feb93e2871False0.18310546875data2.265083745848167IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                  .rsrc0x160000x5330800x5332000cb59c276652808eb7200fdad38bae5bunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                  .reloc0x54a0000xea80x1000a93b0f39998e1e69e5944da8c5ff06b1False0.72265625data6.301490309336801IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                  Resources

                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                  FILES0x163d80x86000PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows0.39622565881529853
                                  FILES0x9c3d80x1a4600PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows0.5111637115478516
                                  FILES0x2409d80x1ac00PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows0.4415614047897196
                                  FILES0x25b5d80x2ec320PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows0.9812068939208984
                                  FILES0x5478f80x1600PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows0.3908025568181818
                                  RT_MANIFEST0x548ef80x188XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5892857142857143

                                  Imports

                                  DLLImport
                                  mscoree.dllCorBindToRuntimeEx
                                  KERNEL32.dllGetModuleFileNameA, DecodePointer, SizeofResource, LockResource, LoadLibraryW, LoadResource, FindResourceW, GetProcAddress, WriteConsoleW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, FlushFileBuffers, HeapReAlloc, HeapSize, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwind, GetLastError, SetLastError, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, RaiseException, GetStdHandle, WriteFile, CreateFileW, MultiByteToWideChar, WideCharToMultiByte, ExitProcess, GetModuleHandleExW, GetACP, CloseHandle, HeapAlloc, HeapFree, FindClose, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, LCMapStringW, SetStdHandle, GetFileType, GetStringTypeW, GetProcessHeap
                                  OLEAUT32.dllVariantInit, SafeArrayUnaccessData, SafeArrayCreateVector, SafeArrayDestroy, VariantClear, SafeArrayAccessData

                                  Possible Origin

                                  Language of compilation systemCountry where language is spokenMap
                                  EnglishUnited States

                                  Network Behavior

                                  Network Port Distribution

                                  TCP Packets

                                  TimestampSource PortDest PortSource IPDest IP
                                  Sep 12, 2024 15:52:30.031351089 CEST49713443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:52:30.031415939 CEST44349713147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:52:30.031490088 CEST49713443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:52:31.071840048 CEST49713443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:52:31.071873903 CEST44349713147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:52:31.071924925 CEST44349713147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:52:33.231682062 CEST49716443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:52:33.231739044 CEST44349716147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:52:33.231805086 CEST49716443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:52:33.235846043 CEST49716443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:52:33.235873938 CEST44349716147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:52:33.235917091 CEST44349716147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:52:36.041171074 CEST49719443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:52:36.041218996 CEST44349719147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:52:36.041312933 CEST49719443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:52:36.043627024 CEST49719443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:52:36.043652058 CEST44349719147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:52:36.043695927 CEST44349719147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:52:40.300133944 CEST49727443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:52:40.300204039 CEST44349727147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:52:40.300270081 CEST49727443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:52:40.302491903 CEST49727443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:52:40.302510977 CEST44349727147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:52:40.302643061 CEST44349727147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:52:45.911499977 CEST49728443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:52:45.911552906 CEST44349728147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:52:45.911634922 CEST49728443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:52:45.914540052 CEST49728443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:52:45.914556980 CEST44349728147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:52:45.914601088 CEST44349728147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:52:54.260649920 CEST49729443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:52:54.260699034 CEST44349729147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:52:54.260776997 CEST49729443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:52:54.263024092 CEST49729443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:52:54.263039112 CEST44349729147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:52:54.263079882 CEST44349729147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:53:07.296188116 CEST49731443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:53:07.296226025 CEST44349731147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:53:07.296304941 CEST49731443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:53:07.298613071 CEST49731443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:53:07.298624039 CEST44349731147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:53:07.299011946 CEST44349731147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:53:25.445238113 CEST49734443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:53:25.445286989 CEST44349734147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:53:25.445363998 CEST49734443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:53:25.447443008 CEST49734443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:53:25.447458982 CEST44349734147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:53:25.447514057 CEST44349734147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:53:52.489862919 CEST49738443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:53:52.489928961 CEST44349738147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:53:52.490022898 CEST49738443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:53:52.492921114 CEST49738443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:53:52.492940903 CEST44349738147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:53:52.492995024 CEST44349738147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:54:39.164541006 CEST49740443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:54:39.164597034 CEST44349740147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:54:39.164690018 CEST49740443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:54:39.167071104 CEST49740443192.168.2.6147.75.81.4
                                  Sep 12, 2024 15:54:39.167092085 CEST44349740147.75.81.4192.168.2.6
                                  Sep 12, 2024 15:54:39.167140961 CEST44349740147.75.81.4192.168.2.6

                                  UDP Packets

                                  TimestampSource PortDest PortSource IPDest IP
                                  Sep 12, 2024 15:52:29.006005049 CEST5774253192.168.2.61.1.1.1
                                  Sep 12, 2024 15:52:29.844820023 CEST53577421.1.1.1192.168.2.6
                                  Sep 12, 2024 15:53:07.264247894 CEST5511153192.168.2.61.1.1.1
                                  Sep 12, 2024 15:53:07.285885096 CEST53551111.1.1.1192.168.2.6
                                  Sep 12, 2024 15:53:52.452527046 CEST5248353192.168.2.61.1.1.1
                                  Sep 12, 2024 15:53:52.478959084 CEST53524831.1.1.1192.168.2.6
                                  Sep 12, 2024 15:54:39.122692108 CEST5068953192.168.2.61.1.1.1
                                  Sep 12, 2024 15:54:39.152667999 CEST53506891.1.1.1192.168.2.6

                                  DNS Queries

                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                  Sep 12, 2024 15:52:29.006005049 CEST192.168.2.61.1.1.10x7743Standard query (0)instance-uil9h2-relay.screenconnect.comA (IP address)IN (0x0001)false
                                  Sep 12, 2024 15:53:07.264247894 CEST192.168.2.61.1.1.10xd57bStandard query (0)instance-uil9h2-relay.screenconnect.comA (IP address)IN (0x0001)false
                                  Sep 12, 2024 15:53:52.452527046 CEST192.168.2.61.1.1.10x2ef3Standard query (0)instance-uil9h2-relay.screenconnect.comA (IP address)IN (0x0001)false
                                  Sep 12, 2024 15:54:39.122692108 CEST192.168.2.61.1.1.10x1324Standard query (0)instance-uil9h2-relay.screenconnect.comA (IP address)IN (0x0001)false

                                  DNS Answers

                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                  Sep 12, 2024 15:52:29.844820023 CEST1.1.1.1192.168.2.60x7743No error (0)instance-uil9h2-relay.screenconnect.comserver-nixd2d85b70-relay.screenconnect.comCNAME (Canonical name)IN (0x0001)false
                                  Sep 12, 2024 15:52:29.844820023 CEST1.1.1.1192.168.2.60x7743No error (0)server-nixd2d85b70-relay.screenconnect.com147.75.81.4A (IP address)IN (0x0001)false
                                  Sep 12, 2024 15:53:07.285885096 CEST1.1.1.1192.168.2.60xd57bNo error (0)instance-uil9h2-relay.screenconnect.comserver-nixd2d85b70-relay.screenconnect.comCNAME (Canonical name)IN (0x0001)false
                                  Sep 12, 2024 15:53:07.285885096 CEST1.1.1.1192.168.2.60xd57bNo error (0)server-nixd2d85b70-relay.screenconnect.com147.75.81.4A (IP address)IN (0x0001)false
                                  Sep 12, 2024 15:53:52.478959084 CEST1.1.1.1192.168.2.60x2ef3No error (0)instance-uil9h2-relay.screenconnect.comserver-nixd2d85b70-relay.screenconnect.comCNAME (Canonical name)IN (0x0001)false
                                  Sep 12, 2024 15:53:52.478959084 CEST1.1.1.1192.168.2.60x2ef3No error (0)server-nixd2d85b70-relay.screenconnect.com147.75.81.4A (IP address)IN (0x0001)false
                                  Sep 12, 2024 15:54:39.152667999 CEST1.1.1.1192.168.2.60x1324No error (0)instance-uil9h2-relay.screenconnect.comserver-nixd2d85b70-relay.screenconnect.comCNAME (Canonical name)IN (0x0001)false
                                  Sep 12, 2024 15:54:39.152667999 CEST1.1.1.1192.168.2.60x1324No error (0)server-nixd2d85b70-relay.screenconnect.com147.75.81.4A (IP address)IN (0x0001)false

                                  Statistics

                                  CPU Usage

                                  Click to jump to process

                                  Memory Usage

                                  Click to jump to process

                                  High Level Behavior Distribution

                                  Click to dive into process behavior distribution

                                  Behavior

                                  Click to jump to process

                                  System Behavior

                                  General

                                  Target ID:1
                                  Start time:09:52:21
                                  Start date:12/09/2024
                                  Path:C:\Users\user\Desktop\SSA-Statement283482.exe
                                  Wow64 process (32bit):true
                                  Commandline:"C:\Users\user\Desktop\SSA-Statement283482.exe"
                                  Imagebase:0xd70000
                                  File size:5'620'224 bytes
                                  MD5 hash:3947493098FA9F8AD99838B31B1718CA
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Yara matches:
                                  • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000001.00000002.2215345900.0000000005430000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000001.00000000.2176864852.0000000000D86000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                  Reputation:low
                                  Has exited:true

                                  General

                                  Target ID:2
                                  Start time:09:52:23
                                  Start date:12/09/2024
                                  Path:C:\Windows\SysWOW64\msiexec.exe
                                  Wow64 process (32bit):true
                                  Commandline:"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\8139d6693ff11377\setup.msi"
                                  Imagebase:0x2d0000
                                  File size:59'904 bytes
                                  MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:high
                                  Has exited:true

                                  General

                                  Target ID:3
                                  Start time:09:52:24
                                  Start date:12/09/2024
                                  Path:C:\Windows\System32\msiexec.exe
                                  Wow64 process (32bit):false
                                  Commandline:C:\Windows\system32\msiexec.exe /V
                                  Imagebase:0x7ff69bcc0000
                                  File size:69'632 bytes
                                  MD5 hash:E5DA170027542E25EDE42FC54C929077
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:high
                                  Has exited:false

                                  General

                                  Target ID:4
                                  Start time:09:52:24
                                  Start date:12/09/2024
                                  Path:C:\Windows\SysWOW64\msiexec.exe
                                  Wow64 process (32bit):true
                                  Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding 1770C73D69AC358127C1D8A8340504F8 C
                                  Imagebase:0x2d0000
                                  File size:59'904 bytes
                                  MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:high
                                  Has exited:true

                                  General

                                  Target ID:5
                                  Start time:09:52:24
                                  Start date:12/09/2024
                                  Path:C:\Windows\SysWOW64\rundll32.exe
                                  Wow64 process (32bit):true
                                  Commandline:rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI6666.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_4613843 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                  Imagebase:0x730000
                                  File size:61'440 bytes
                                  MD5 hash:889B99C52A60DD49227C5E485A016679
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:high
                                  Has exited:true

                                  General

                                  Target ID:6
                                  Start time:09:52:26
                                  Start date:12/09/2024
                                  Path:C:\Windows\SysWOW64\msiexec.exe
                                  Wow64 process (32bit):true
                                  Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding DB207B6B05E5334A6A4617F086F0333F
                                  Imagebase:0x2d0000
                                  File size:59'904 bytes
                                  MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:high
                                  Has exited:true

                                  General

                                  Target ID:7
                                  Start time:09:52:27
                                  Start date:12/09/2024
                                  Path:C:\Windows\SysWOW64\msiexec.exe
                                  Wow64 process (32bit):true
                                  Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding 6F459389FAB8D805B11F9DC9BBCEE18B E Global\MSI0000
                                  Imagebase:0x2d0000
                                  File size:59'904 bytes
                                  MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:high
                                  Has exited:true

                                  General

                                  Target ID:8
                                  Start time:09:52:27
                                  Start date:12/09/2024
                                  Path:C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe
                                  Wow64 process (32bit):true
                                  Commandline:"C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-uil9h2-relay.screenconnect.com&p=443&s=23922f34-f56d-42f0-ae76-f0d68b386765&k=BgIAAACkAABSU0ExAAgAAAEAAQBtiFOcCyZyZIYMRa7q%2fxlupwY5psgwtIrmaNtAqcPOS3wxM8KzGEILcWiAQrulPKqVk7Rqd6bB%2fHZh%2fmnGSw2CAH4apdeV45uG24aPv2cHFtSJ6RshGlIAVmQDpgDTZGV70NOKRVbQf4oTZhjBjedMNc4eQan%2fjh9itC%2bqr9sxraG6l1Z%2boKOxbfHBJ6Wfpk7eUPM6olxgYqoAmaN4Rv%2bfdTlaueMe6P2zoVUESpDoHb1G6UbMs3FmBJCA%2f9AZwydk%2f143G89rCDbAyabHRD4c4l%2fHfxv8RMfl8ImXlPMvnbcvlou8OpEAIEdGjx8c%2bAEWMGqksgH4Y5DFBuR2ZkLk&c=QuadChomes&c=QuadChomes.com&c=&c=Host&c=&c=&c=&c="
                                  Imagebase:0xfe0000
                                  File size:95'520 bytes
                                  MD5 hash:361BCC2CB78C75DD6F583AF81834E447
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Antivirus matches:
                                  • Detection: 0%, ReversingLabs
                                  Reputation:low
                                  Has exited:false

                                  General

                                  Target ID:9
                                  Start time:09:52:28
                                  Start date:12/09/2024
                                  Path:C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exe
                                  Wow64 process (32bit):false
                                  Commandline:"C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exe" "RunRole" "db1808b5-e647-4ee6-81c0-2c66f5bc4c39" "User"
                                  Imagebase:0x290000
                                  File size:601'376 bytes
                                  MD5 hash:20AB8141D958A58AADE5E78671A719BF
                                  Has elevated privileges:false
                                  Has administrator privileges:false
                                  Programmed in:C, C++ or other language
                                  Yara matches:
                                  • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000009.00000000.2248986769.0000000000292000.00000002.00000001.01000000.00000011.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000009.00000002.4047653278.0000000002541000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Program Files (x86)\ScreenConnect Client (8139d6693ff11377)\ScreenConnect.WindowsClient.exe, Author: Joe Security
                                  Antivirus matches:
                                  • Detection: 0%, ReversingLabs
                                  Reputation:low
                                  Has exited:false

                                  General

                                  Target ID:10
                                  Start time:09:52:31
                                  Start date:12/09/2024
                                  Path:C:\Windows\System32\svchost.exe
                                  Wow64 process (32bit):false
                                  Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                  Imagebase:0x7ff7403e0000
                                  File size:55'320 bytes
                                  MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:high
                                  Has exited:true

                                  Disassembly

                                  Reset < >

                                    Executed Functions

                                    Function 053E6F00 Relevance: 1.9, Strings: 1, Instructions: 675COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID: 0-3916222277
                                    • Opcode ID: 465c765a0ff058a3edb520914c46b5250623a58829806572df0f0930faddec10
                                    • Instruction ID: 4bd5ae06a53653968de6362533b8f1f54f31d82275948400a85a94700ef10144
                                    • Opcode Fuzzy Hash: 465c765a0ff058a3edb520914c46b5250623a58829806572df0f0930faddec10
                                    • Instruction Fuzzy Hash: 42526B34A10219CFDB15DF64D844B9DBBB6FF89300F1085AAE909AB355CB75AD82CF90
                                    Function 053E6EF1 Relevance: 1.9, Strings: 1, Instructions: 615COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID: 0-3916222277
                                    • Opcode ID: 0831be40e4e1195e2713b8f1d3a7c305614a1cbf3dd0074b56c0e2899ce4bd28
                                    • Instruction ID: 3c29b697496fdeae2aadefe164440a6dbdde738f02906a43bd00ae592de3fe14
                                    • Opcode Fuzzy Hash: 0831be40e4e1195e2713b8f1d3a7c305614a1cbf3dd0074b56c0e2899ce4bd28
                                    • Instruction Fuzzy Hash: 35428C38A10219CFDB15DF64D844B9DBBB6FF89300F108599E909AB395CB75AD82CF90
                                    Function 053EF0B0 Relevance: 1.3, Instructions: 1304COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a13ed4d9053cc2cdcfa58a6525eea775d00c40e5b14503a41697d02301be6aa8
                                    • Instruction ID: be1656aa05c3eee3ffbf20eb697f1a0ecdcaf63ec02938415ef4ab110431cdad
                                    • Opcode Fuzzy Hash: a13ed4d9053cc2cdcfa58a6525eea775d00c40e5b14503a41697d02301be6aa8
                                    • Instruction Fuzzy Hash: 8EB20B35A00214DFDB14DFA8C884AADBBF2FF88310F158559E959AB3A5DB70AD41CF50
                                    Function 00B77878 Relevance: 2.7, Strings: 2, Instructions: 188COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: C8${/
                                    • API String ID: 0-4231431693
                                    • Opcode ID: 66bbaff197868b5e211437b135b2164b1f9b35f1c9deed20c6811c33e7964bb8
                                    • Instruction ID: 39427577a09022f6362298852f9aac7744bf972287097fc7c4ee8feb3f52ab11
                                    • Opcode Fuzzy Hash: 66bbaff197868b5e211437b135b2164b1f9b35f1c9deed20c6811c33e7964bb8
                                    • Instruction Fuzzy Hash: 2551A4313106029FE702AB39D89565E77E7EBCA310740C229E62ACB744EFB0DD428785
                                    Function 053EB751 Relevance: 1.4, Strings: 1, Instructions: 116COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: s+
                                    • API String ID: 0-1285507049
                                    • Opcode ID: 407dcb5a8d48bc17ea2fee3c794f4cdd156482e7d40ae20c8eb1a7ed59da4815
                                    • Instruction ID: 7a7f9eb19458386ebafca10e58cee6bf1554546add5e35cd42a7034dad6aff8c
                                    • Opcode Fuzzy Hash: 407dcb5a8d48bc17ea2fee3c794f4cdd156482e7d40ae20c8eb1a7ed59da4815
                                    • Instruction Fuzzy Hash: 7C419035A00256DFDB06DFA4D8946DEFBB2EF85300F14852AE905AB381DB70AD46CB94
                                    Function 00B7879F Relevance: 1.4, Strings: 1, Instructions: 115COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: K]
                                    • API String ID: 0-3798347547
                                    • Opcode ID: 232e6dead7b444fe0ddeb82a2bd4c2fca0b8e99d47cb1b28a9d5066884a9e48c
                                    • Instruction ID: 38fbd247fc8747f0578190896ef3afa0e5729a8fdd5052ea56acdea53a0fc8b9
                                    • Opcode Fuzzy Hash: 232e6dead7b444fe0ddeb82a2bd4c2fca0b8e99d47cb1b28a9d5066884a9e48c
                                    • Instruction Fuzzy Hash: CE41CE31A043018FCB00DF29D89968EBBF5EF81350F1485AAE959CF352EB30DC4687A6
                                    Function 053E33D0 Relevance: 1.4, Strings: 1, Instructions: 108COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: <
                                    • API String ID: 0-4251816714
                                    • Opcode ID: 00940dd0575f4006a704d9caec0685f7b63a6692b8d7d8ab9c722312d9f32ff7
                                    • Instruction ID: 6abc922b957f89dbb98a26d5c8ce9ae7c2010141d855973fe3accedec47c43f6
                                    • Opcode Fuzzy Hash: 00940dd0575f4006a704d9caec0685f7b63a6692b8d7d8ab9c722312d9f32ff7
                                    • Instruction Fuzzy Hash: A3418530B00219EFEB189BA9D455BADBAB7FF88300F20442DE505B73D1CE769D068B55
                                    Function 00B782FF Relevance: 1.3, Strings: 1, Instructions: 63COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: K]
                                    • API String ID: 0-3798347547
                                    • Opcode ID: 32488fad2c5d7645f4ad8e4f3bbfb3869d2847ae1c9939bc4f7af45864044146
                                    • Instruction ID: 0b19627a8398ed060dd945c31e5d1547bebab91d0127f327d4866d99a6c837c3
                                    • Opcode Fuzzy Hash: 32488fad2c5d7645f4ad8e4f3bbfb3869d2847ae1c9939bc4f7af45864044146
                                    • Instruction Fuzzy Hash: 19216A357002008BCB00DF69D48995EFBE6EF88350755C56AED1ECF355EA30DD048BA2
                                    Function 00B70839 Relevance: 1.3, Strings: 1, Instructions: 55COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: DF~
                                    • API String ID: 0-2571913398
                                    • Opcode ID: 717d0fc4e13a54eed2a3afddc0f93cd92de7778772fcc39c0c2930001abc6200
                                    • Instruction ID: 8f1dfe999801d598e2bd43fe601f63037ab2e9418a9da09aa68900d12777fde1
                                    • Opcode Fuzzy Hash: 717d0fc4e13a54eed2a3afddc0f93cd92de7778772fcc39c0c2930001abc6200
                                    • Instruction Fuzzy Hash: 0C113AB4E012499FCB04DFA9D4459AEBBB1FF89300F0184AAD519A7351C734AE01CB51
                                    Function 00B70848 Relevance: 1.3, Strings: 1, Instructions: 50COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: DF~
                                    • API String ID: 0-2571913398
                                    • Opcode ID: 802be64df5a434814ed5e4d7b4d30257d60c55b5b72c596346166dd2f8b73881
                                    • Instruction ID: 05dd4c803a5a6640c18b9edd961841048ee13d5415c28bb8c96f7d48c8ef7638
                                    • Opcode Fuzzy Hash: 802be64df5a434814ed5e4d7b4d30257d60c55b5b72c596346166dd2f8b73881
                                    • Instruction Fuzzy Hash: 6F11D6B4E0020ADFCB04EFA9D5559AEBBF1FF89300F10C4AAD519A7351DB34AA018B95
                                    Function 05401190 Relevance: .3, Instructions: 344COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 785849cd80f5b28e1f4f81dcde10ecad63f3af76af7e30d7bdbef9ad8995e23e
                                    • Instruction ID: bedb08359ac2f876b33e54ec50c9316418d4cb450836f69d27210f3826f8d0eb
                                    • Opcode Fuzzy Hash: 785849cd80f5b28e1f4f81dcde10ecad63f3af76af7e30d7bdbef9ad8995e23e
                                    • Instruction Fuzzy Hash: 6AC15331A001199FDB14DFA9C984AEEB7B6FF88310F25906AE415E7391DB34AD41CBA1
                                    Function 05404DF8 Relevance: .3, Instructions: 338COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: dd31dae23425d90b61998cba1efb927c6ca99b762df7599d586091bfd1e7627e
                                    • Instruction ID: 04cfbc60961fcecb90b9c6dc8ad5e0ac73be0ffc456b499dc4887417d2ee315d
                                    • Opcode Fuzzy Hash: dd31dae23425d90b61998cba1efb927c6ca99b762df7599d586091bfd1e7627e
                                    • Instruction Fuzzy Hash: 83E13C34A00615CFCB05DF68C5849EABBF2FF88310B65856AE905DB3A5EB30ED45CB94
                                    Function 05405AD8 Relevance: .3, Instructions: 300COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: f63b8eac20e15f6a9e9426b5c5ab1c8664050c2e640e398ff76593cd079f0e8a
                                    • Instruction ID: 9efd8f9abc3884dea1e0075b448340313c0cd7e23d4d6e59105d3194c24e5e1d
                                    • Opcode Fuzzy Hash: f63b8eac20e15f6a9e9426b5c5ab1c8664050c2e640e398ff76593cd079f0e8a
                                    • Instruction Fuzzy Hash: 4AB16335B002048BCB18EBA5D4986EEB7F3EFC8301B64846AD506A7395DF35AC42CF95
                                    Function 00B7DA79 Relevance: .3, Instructions: 300COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 8ddef14734af69e179aa09bc530b566da5ff3836ab1eac3d3bfa4e70dce64a65
                                    • Instruction ID: 942397dab34a473d83339e3710e63011f2ac00619267adf7003fffa6f2f3c4ee
                                    • Opcode Fuzzy Hash: 8ddef14734af69e179aa09bc530b566da5ff3836ab1eac3d3bfa4e70dce64a65
                                    • Instruction Fuzzy Hash: A8C1E735A0120ADFCF01CFA8C9808AEBBF6FF49350B248499E959A7351D731ED55CB90
                                    Function 053EF928 Relevance: .3, Instructions: 297COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b457aba3ea1bd76ccd4ab0117a852639fe3db1722375612eabec5c8063cf663e
                                    • Instruction ID: 70d0316a1587313de033348e457e30ca4854cb55f17495aa8a5d90316ce525b1
                                    • Opcode Fuzzy Hash: b457aba3ea1bd76ccd4ab0117a852639fe3db1722375612eabec5c8063cf663e
                                    • Instruction Fuzzy Hash: 26C1D174A002159FCB44DFA8C884EAAB7F2FF88310F558559E915AB3A2DB75EC41CF60
                                    Function 05403B68 Relevance: .3, Instructions: 292COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 3752ebe20d7f773ac8a4516ff2d266c6755f6662dc5ea006bc2a8d9d9aa76629
                                    • Instruction ID: e756a69b9d7421e33343d81aaa5e76fa621f65392cba2ab59bbdac75c4f6a92c
                                    • Opcode Fuzzy Hash: 3752ebe20d7f773ac8a4516ff2d266c6755f6662dc5ea006bc2a8d9d9aa76629
                                    • Instruction Fuzzy Hash: 3BD13934600615CFCB05DF58C584DAABBF2FF84304B5689AAE4469B3A6DB30FD46CB94
                                    Function 053EBD00 Relevance: .3, Instructions: 288COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 67354c87d7afb37b96522ccabc174b7f34c6f187e44407b9d7e8191a7e2d7ee1
                                    • Instruction ID: fc1c16f9d39f0f12d68f3f297ec4391359daad1543d29e554686d6bfc98c0ad3
                                    • Opcode Fuzzy Hash: 67354c87d7afb37b96522ccabc174b7f34c6f187e44407b9d7e8191a7e2d7ee1
                                    • Instruction Fuzzy Hash: 00A15D30B012169BDB15EBA4C894AAEB7F2FB88300F548569D506DB381DF35ED42CBA5
                                    Function 053EABB8 Relevance: .3, Instructions: 280COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 97881312cdbcbe2b9439915db048f53b95766918db5172cf2a8f6ccf02e35149
                                    • Instruction ID: 662a14ff1200e83ef232fe99238ff4b5c6382dc0e481352c15aa2dd2c4a7f477
                                    • Opcode Fuzzy Hash: 97881312cdbcbe2b9439915db048f53b95766918db5172cf2a8f6ccf02e35149
                                    • Instruction Fuzzy Hash: 26B18875A006159FD724CF68C884A6AFBF2FF88301B588969E556DB791C731FC42CBA0
                                    Function 053E17C0 Relevance: .2, Instructions: 242COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 990259cf8e73f41ea1644a6c5282d49e560b10a4faaf9da249ad9176670af3c1
                                    • Instruction ID: bf54ae6cca2fe35a0fa571afecf8a1fa6020541e29e43f5b4f35645ded6ed27e
                                    • Opcode Fuzzy Hash: 990259cf8e73f41ea1644a6c5282d49e560b10a4faaf9da249ad9176670af3c1
                                    • Instruction Fuzzy Hash: 05A1F735B00215CFCB14DBA8C494AAEBBF2FF89300B158599E506AB3A5DB71ED41CF90
                                    Function 053E17B1 Relevance: .2, Instructions: 237COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 5197340cc586228bf23c5cff2de16f5cdaa4d30c8ddd4b47dfda6cf5d337c679
                                    • Instruction ID: b9fac0f80c5f7cd3abfeac6483a030c2936a0cd36076e730c673cd4aa6c98b4f
                                    • Opcode Fuzzy Hash: 5197340cc586228bf23c5cff2de16f5cdaa4d30c8ddd4b47dfda6cf5d337c679
                                    • Instruction Fuzzy Hash: C8910935B00215CFCB14DBA8C494AADBBF2FF88300B5545A9E506EB3A5DB71ED42CB50
                                    Function 053ED120 Relevance: .2, Instructions: 223COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 8b003621f6e2eec55b4c3ea8a99371c3072055e0fee22c094002232116c1d2bd
                                    • Instruction ID: 88aae8abc26d1c1a44c1f5aa13323daf27311bd14698134950d660ee8d97d682
                                    • Opcode Fuzzy Hash: 8b003621f6e2eec55b4c3ea8a99371c3072055e0fee22c094002232116c1d2bd
                                    • Instruction Fuzzy Hash: CF815D75B002059FDB04DF69C894AAEBBF6EF88710F158169E505EB3A1CB34ED01CB65
                                    Function 053EEC40 Relevance: .2, Instructions: 220COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0cdf2bb63345ac1873a65ec00ab1870acb89fbaf48bd97f00633ab3e9576a5f3
                                    • Instruction ID: c12f2bc0334011d75679d6a7a33f57ea56010896e7e63561b6e6b2116eda2c3c
                                    • Opcode Fuzzy Hash: 0cdf2bb63345ac1873a65ec00ab1870acb89fbaf48bd97f00633ab3e9576a5f3
                                    • Instruction Fuzzy Hash: 7861F331B00225CFDB24DF65985066EFBFBFFC8620B20842AD5569B385DB72D842C7A1
                                    Function 00B75D30 Relevance: .2, Instructions: 220COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0dc8b9ffa68dfc3b9bc2fc19106f0e295d2c125d0578ccb724ed123ef466da9f
                                    • Instruction ID: d25bdf645e9fe35145c3dfb14612f34c9a2da19f572943dfa0772f7e3eb1533b
                                    • Opcode Fuzzy Hash: 0dc8b9ffa68dfc3b9bc2fc19106f0e295d2c125d0578ccb724ed123ef466da9f
                                    • Instruction Fuzzy Hash: 47913C31A006058FDB25DF69D89459EBBF2EF88310B148269E919EF355DBB0ED46CB80
                                    Function 053E9837 Relevance: .2, Instructions: 219COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 6ee995b611521379df8840605fac8306349e7e8b4bfc0d1e840514681d3ffe2f
                                    • Instruction ID: 49c7cf2d0cac0409bf5379bf5243ee1ff5c1353de6691158f14d7ff9b7c7277f
                                    • Opcode Fuzzy Hash: 6ee995b611521379df8840605fac8306349e7e8b4bfc0d1e840514681d3ffe2f
                                    • Instruction Fuzzy Hash: B781AF76A002159FC704DF68C885BAAB7F5FF88311F1585A9E919DB392DB31EC01CBA1
                                    Function 00B741F0 Relevance: .2, Instructions: 215COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 60b2280f06e5c8c165607ace03a47d95d11978100241bddbcef01683c80a1db1
                                    • Instruction ID: 6f1c688af0bf9ed9b2ab5db1a8d3da03783cfa8c0cd952b631ffb1728d7850b8
                                    • Opcode Fuzzy Hash: 60b2280f06e5c8c165607ace03a47d95d11978100241bddbcef01683c80a1db1
                                    • Instruction Fuzzy Hash: 8E814B34B102059FDB05EF69D898A6EBBF2EF88300B108529E51ADB395DF74ED02CB41
                                    Function 05400128 Relevance: .2, Instructions: 211COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 18056c7db452249c98f4faf20e2e64740f21afafb39f2cc45c530323ee7a129b
                                    • Instruction ID: 670a813f8d0720f36021da02b8b33c8e5f4edeb4550a5fef88739b61401b5af3
                                    • Opcode Fuzzy Hash: 18056c7db452249c98f4faf20e2e64740f21afafb39f2cc45c530323ee7a129b
                                    • Instruction Fuzzy Hash: FB818074B002059FDB04DF68C884AAEB7F6EF85310F5581AAE909AF391DB71ED41CB80
                                    Function 053EEEB0 Relevance: .2, Instructions: 205COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0b3a6447c0faff31367e52ccf3657ebb361d4c32413d095e817c6fa8f449bda5
                                    • Instruction ID: ec6214ba41eb479c5b7c506f4a7a763e0136fa3ee503ee43d74ad0306037880d
                                    • Opcode Fuzzy Hash: 0b3a6447c0faff31367e52ccf3657ebb361d4c32413d095e817c6fa8f449bda5
                                    • Instruction Fuzzy Hash: E471A635B001199FDB14DFA9C884AAEB7F2FF88310F518129E915E73A1DB71AD52CB90
                                    Function 053E9F00 Relevance: .2, Instructions: 203COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 73e3e60ac605b7d7cac7eca760fc78266910903673b5c377889f7e8c3ea342d5
                                    • Instruction ID: 2c9480ffe66b35d978617a48f78ac871768d50d810cc41509ba54f1fe89f8e0a
                                    • Opcode Fuzzy Hash: 73e3e60ac605b7d7cac7eca760fc78266910903673b5c377889f7e8c3ea342d5
                                    • Instruction Fuzzy Hash: F2716E71B006059FDB18DF69C8845AEFBF2FF88210B14856DE919EB391DB34DD058B94
                                    Function 053EFCA8 Relevance: .2, Instructions: 200COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 68e905239095880177293be1c73c4eac4f69b712fd53870f26e281acf7b320dc
                                    • Instruction ID: 30a5382c0ddb8cc4d7f85af6c4830884a1c66a0a8840622d2a4704d0728be983
                                    • Opcode Fuzzy Hash: 68e905239095880177293be1c73c4eac4f69b712fd53870f26e281acf7b320dc
                                    • Instruction Fuzzy Hash: 24814B72600715DFCB24DF68C880A6EBBF2FF84300B448959E846AB696D771F941CFA0
                                    Function 00B76CB8 Relevance: .2, Instructions: 194COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: d83b44b3e74e14cf4e61b2583d7b333fe3d04ac1216060de31839a0772702ade
                                    • Instruction ID: 45fd420e24f28151589f02d4b76b37e51be28b2b565bb13074a9e70a22cdae70
                                    • Opcode Fuzzy Hash: d83b44b3e74e14cf4e61b2583d7b333fe3d04ac1216060de31839a0772702ade
                                    • Instruction Fuzzy Hash: 0D619E35B006058FCB04DF68C8845AEBBF6EFC9310B2485AAE61AEB351DB70ED058B51
                                    Function 00B788D8 Relevance: .2, Instructions: 192COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0575def4994ecb7e03c4f193025e6347fd1da603e948ce4228e6df8d872ce4f3
                                    • Instruction ID: e23e455ef1adda3113389362744ea0e8fa5021925fd9fd37e542842845b81bfe
                                    • Opcode Fuzzy Hash: 0575def4994ecb7e03c4f193025e6347fd1da603e948ce4228e6df8d872ce4f3
                                    • Instruction Fuzzy Hash: A661D834B10606DFCB14DFA9D49896EB7F2FF89314B118199E60AAB365DB30EC01DB51
                                    Function 053E3A58 Relevance: .2, Instructions: 178COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 01d5423baaa28db077a351ea022d14e0f68c90806c27875bbb05649c5755fbd4
                                    • Instruction ID: f2aac58daa6d83ef9323d68a87f7e7fc7f3288b4f89c0e0bfb239d5703727ea1
                                    • Opcode Fuzzy Hash: 01d5423baaa28db077a351ea022d14e0f68c90806c27875bbb05649c5755fbd4
                                    • Instruction Fuzzy Hash: 8051AE30B012259FDB249B65D858B7EBBE6FF84710F148929E416DB3D1DB70AC85CB90
                                    Function 053E26C8 Relevance: .2, Instructions: 173COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 8a4df3d792815eef2d832d53d3dfae7ded5ccd1b56ea1efe9fa5e33908c23599
                                    • Instruction ID: 22a4269ff60d13184dfb5d41bc95076bbb1bf2f80c1cd00c37e4464c26e02bf2
                                    • Opcode Fuzzy Hash: 8a4df3d792815eef2d832d53d3dfae7ded5ccd1b56ea1efe9fa5e33908c23599
                                    • Instruction Fuzzy Hash: AB612B39B00205CFCB15DFA8D49496AFBF6BF88310B158569E50ADB365EB70EC458FA0
                                    Function 053E26D8 Relevance: .2, Instructions: 170COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: c84bc9d2b4f599332db18e50a32c8be4c41f78f421c5a96360ba237451d0447b
                                    • Instruction ID: f079ca494e6fe5ad1960f5c15785486de7c6e60a1972a38c5b8a9bfa5ac497b3
                                    • Opcode Fuzzy Hash: c84bc9d2b4f599332db18e50a32c8be4c41f78f421c5a96360ba237451d0447b
                                    • Instruction Fuzzy Hash: AE510939B00205CFCB14DFA9D49496AFBF6BF88310B158569E50ADB365EB70EC418BA0
                                    Function 00B7FDA8 Relevance: .2, Instructions: 164COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 5a51976f555361434a3a48264bb09dfe36b164f48235d6240c78c9a64c00e190
                                    • Instruction ID: 24a425fb0311a39cf0d4bef8a13288b57c2a7b7f15864485ade21f15288de6fb
                                    • Opcode Fuzzy Hash: 5a51976f555361434a3a48264bb09dfe36b164f48235d6240c78c9a64c00e190
                                    • Instruction Fuzzy Hash: B6610E39A10605CFC750DF69D88896ABBF6FF8971071185A9E61ADB731DB30EC028B90
                                    Function 00B7D350 Relevance: .2, Instructions: 157COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a7d670e07b8b61dcfb4aab09af6fd0f6f024d65964c7bf7a0c68ca7734bf6ca9
                                    • Instruction ID: 371d0a0e3ae6f2c3695bfbd31cb5764c6ce871cef8c1d5e258cf1afe41805a35
                                    • Opcode Fuzzy Hash: a7d670e07b8b61dcfb4aab09af6fd0f6f024d65964c7bf7a0c68ca7734bf6ca9
                                    • Instruction Fuzzy Hash: 0651E134B042488FCF14DF69D4946AEBBF2FF85390F1584AAE819DB384DA34DD0587A2
                                    Function 00B76307 Relevance: .2, Instructions: 156COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ef05514998f9c4751b7e5f2e87cd4808976682480ab46c3e53f34e049341b7ea
                                    • Instruction ID: 7c4dc102e9b2a8dd6841cc4415ac785fbfae166c607ca7d57de9662ec47b99cd
                                    • Opcode Fuzzy Hash: ef05514998f9c4751b7e5f2e87cd4808976682480ab46c3e53f34e049341b7ea
                                    • Instruction Fuzzy Hash: 1B514E35A10619CFCB04CFA9C84499DB7F6FF8A700B2181AAE505EF361DBB1AD05CB80
                                    Function 00B7FDB8 Relevance: .2, Instructions: 156COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: cd1396616d466e3a18c0b5c02ab252f34c8015ef3b35d0c0de085b451c4df3db
                                    • Instruction ID: 93f367c4240399c24808665f39b936fea83aa32992ed49ea5ac4fa2eef182883
                                    • Opcode Fuzzy Hash: cd1396616d466e3a18c0b5c02ab252f34c8015ef3b35d0c0de085b451c4df3db
                                    • Instruction Fuzzy Hash: 6561DD39A10605CFC754DF69D88886ABBF6FF8971075185A9E51ADB731DB30EC02CB90
                                    Function 053EB9F8 Relevance: .2, Instructions: 154COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ce0662cabc505296535af1940b038becbf6e12bb1313142e13d61c207b1e04b5
                                    • Instruction ID: 6328bdc61428d728b225b609909bce36ed722bf1cf4b4508ab11192ad8d437aa
                                    • Opcode Fuzzy Hash: ce0662cabc505296535af1940b038becbf6e12bb1313142e13d61c207b1e04b5
                                    • Instruction Fuzzy Hash: 16519E34A002159FCB15DFA8D8D4DAEBBF2FB84311B55845AE5499B392DB31EC02CFA4
                                    Function 053E90B0 Relevance: .1, Instructions: 146COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 22ec860486d20e009b73d538ee6bb7b15e4fcaf44b3918d64681149755893c53
                                    • Instruction ID: 72d1d5831f872d2c4e14a6b7fc3e902a2694fb94b6fcc5943c5984da37f60fa4
                                    • Opcode Fuzzy Hash: 22ec860486d20e009b73d538ee6bb7b15e4fcaf44b3918d64681149755893c53
                                    • Instruction Fuzzy Hash: 7B517C74A10619DFDB04DFA9E588A9CFBF2FF88310F108169E509A73A1DB71AD45CB84
                                    Function 053ECF38 Relevance: .1, Instructions: 146COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 51b721c59779e854b5cb96d995877b5a9cd6e0022189f1b0e7f6e4079d9b0cdd
                                    • Instruction ID: 624f66043c2b5e7f063164dd932733f6eafb2c4d076a99363dd20e6258d6f2f0
                                    • Opcode Fuzzy Hash: 51b721c59779e854b5cb96d995877b5a9cd6e0022189f1b0e7f6e4079d9b0cdd
                                    • Instruction Fuzzy Hash: FF519075B002159FDB05DBA4C895B7EBBF2EFC8700F148469E906DB392DA75AC02CB91
                                    Function 053EE138 Relevance: .1, Instructions: 143COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: fc8270c53c0d1e4951782d33e7d4153f9ff8825ff99425349e4327ca664b5acf
                                    • Instruction ID: 1af9e996cd3621540515508e7aef4650cdcb30ae51fa93b32e65138f0d25340f
                                    • Opcode Fuzzy Hash: fc8270c53c0d1e4951782d33e7d4153f9ff8825ff99425349e4327ca664b5acf
                                    • Instruction Fuzzy Hash: 07517E75A00B15DFC720DF69D5849AAF7F6FB88310B108A1AD99AC7B80D731F841DB90
                                    Function 00B76040 Relevance: .1, Instructions: 138COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 1e563fda41886baff7f37e6014d03247733044e0f3590363ec7320e2cb293cc0
                                    • Instruction ID: 40ebb93285deb586cf08ced47a10d6bdc097d1742f31087698bf77848ebfd0ae
                                    • Opcode Fuzzy Hash: 1e563fda41886baff7f37e6014d03247733044e0f3590363ec7320e2cb293cc0
                                    • Instruction Fuzzy Hash: 8A517C34E1024ADFDB05EFB4D844BDDBBB1FF89300F108659E114AB291EB79A986CB50
                                    Function 053E90A7 Relevance: .1, Instructions: 137COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: fe121ea228fd3c2c9320c0cc4c33090068019e0abd3b631468df7e98f6287eb5
                                    • Instruction ID: d39d0c44679d7cc3062858bc071dd2290db9439d6b7bcfb83553348bab57da64
                                    • Opcode Fuzzy Hash: fe121ea228fd3c2c9320c0cc4c33090068019e0abd3b631468df7e98f6287eb5
                                    • Instruction Fuzzy Hash: 15517B75A00619DFCB04EFA8E58969CFBF2FF88310F108669E509A7351DB71AD46CB84
                                    Function 05400118 Relevance: .1, Instructions: 136COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 74da70ced60ef17558e6ffb703ec2e252bad284d26b56334d93ed19c5c633a91
                                    • Instruction ID: 65d9f05659cd4172eb52411919d61d09635a854e9b878861da6ed415b8414a0b
                                    • Opcode Fuzzy Hash: 74da70ced60ef17558e6ffb703ec2e252bad284d26b56334d93ed19c5c633a91
                                    • Instruction Fuzzy Hash: 415145757002059FDB48DF58C885EAEB7B6EF84310F5580A9E9099F3A2DB31EC42CB90
                                    Function 00B78BE8 Relevance: .1, Instructions: 136COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 82958d96a811539d046996522903cec1c8928772c41af0360f8640c082a4dcb5
                                    • Instruction ID: e55e48afb9c1a9461f2458ec49aa94007c7af15610ca7d5a5a285b3bb5a301cf
                                    • Opcode Fuzzy Hash: 82958d96a811539d046996522903cec1c8928772c41af0360f8640c082a4dcb5
                                    • Instruction Fuzzy Hash: DD510D30600601CFCB18CF69D8D8A667BB1EF89315B1485A8D929DF3A9DB30DC52CF91
                                    Function 053E484A Relevance: .1, Instructions: 134COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 7f9a229556523152dd579a3e1136ba2cce77534fbb37f7fe650ab4014c4f919a
                                    • Instruction ID: 35713e6501d927e34bc19d3cc8a92f797a90f044b310fd1b57808eb8097180ef
                                    • Opcode Fuzzy Hash: 7f9a229556523152dd579a3e1136ba2cce77534fbb37f7fe650ab4014c4f919a
                                    • Instruction Fuzzy Hash: 6B514D35521205DFCB05EF68E894C99BB76FF89310B01CA95F945AB325DB30E896CF60
                                    Function 05407388 Relevance: .1, Instructions: 132COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 52c878b922540d29edb56ac3e87ae5f894680e87a8fc4b1ca39c0f515331f091
                                    • Instruction ID: 61f66f87b33305db7be4da75415bf9180182afe6009e0e1c53faa3c3cd9427c8
                                    • Opcode Fuzzy Hash: 52c878b922540d29edb56ac3e87ae5f894680e87a8fc4b1ca39c0f515331f091
                                    • Instruction Fuzzy Hash: BC414C34B006059FDB54DF79C494AAEBBF2EF88710F248569E506AB390DB31AD42CB91
                                    Function 00B76031 Relevance: .1, Instructions: 129COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 1ca4fe9adf156878b586f97f15e1c292de781b13bb2f0680ee3e7cfd215f1408
                                    • Instruction ID: 969b32eb2587aea6de9bb8fdcf42eafc6de5ee3bb889f3e4c17bb6057ce97cbd
                                    • Opcode Fuzzy Hash: 1ca4fe9adf156878b586f97f15e1c292de781b13bb2f0680ee3e7cfd215f1408
                                    • Instruction Fuzzy Hash: 83515C34E1024ADFDB05EFA4D844B8DBBB2FF89300F108659E114BB295EB79A985CB54
                                    Function 053E3BB8 Relevance: .1, Instructions: 117COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ad72c6117940c22fe75908c7bd5293dd5f1c6cb9ab27aa67fdd94c44309578cf
                                    • Instruction ID: 0c3eae1938c3bb916496d04167d334aaa9da6e14e3a9a3b063776f781bf3cf5b
                                    • Opcode Fuzzy Hash: ad72c6117940c22fe75908c7bd5293dd5f1c6cb9ab27aa67fdd94c44309578cf
                                    • Instruction Fuzzy Hash: 75411D30B151299BDB18DBA5D858ABEBAF6BF84705F104529E403AB2A1DF746801CB54
                                    Function 00B7D8F8 Relevance: .1, Instructions: 116COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0adaac4ca458d0ed9dc3a508f1a7460a96551c09d12ed819d2d6df62fbfcdb74
                                    • Instruction ID: 2e2b5fac5a162c8a0be2ab9a40141748f28437c05696324f39fe1630ca3004d3
                                    • Opcode Fuzzy Hash: 0adaac4ca458d0ed9dc3a508f1a7460a96551c09d12ed819d2d6df62fbfcdb74
                                    • Instruction Fuzzy Hash: B2411A78700205DF9B04DB58D88096A7BF6FFCC350B248099E61ADB364D731ED02DB61
                                    Function 053E8598 Relevance: .1, Instructions: 112COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 335f665f0ad39f5eaf662a64e54bb503f191db15a88d75b8fd87be04b10b7db5
                                    • Instruction ID: 1f366062d6f591f71edf44fdcacdb3db6c7701e02fa05667dff326bdad1a0373
                                    • Opcode Fuzzy Hash: 335f665f0ad39f5eaf662a64e54bb503f191db15a88d75b8fd87be04b10b7db5
                                    • Instruction Fuzzy Hash: B3412974B10206CFCB04DF68D9859AEBBB6FF89314B108669E509DB365DB30ED468B90
                                    Function 053E7C63 Relevance: .1, Instructions: 111COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e1158e0da94806b45a065897dce2db750466f8bdc2d6cb8de4b47b4f0bc37512
                                    • Instruction ID: 27ae695a6dcefdec21466ebf1100ac3c5bd07fa516f4ff496c741a770387f069
                                    • Opcode Fuzzy Hash: e1158e0da94806b45a065897dce2db750466f8bdc2d6cb8de4b47b4f0bc37512
                                    • Instruction Fuzzy Hash: E6419F36E0075A9BCF10DFA5D8845EEF7B6FF95300B20C656E40577280EB70A986CB90
                                    Function 00B74C50 Relevance: .1, Instructions: 110COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 9aea9ce035e0ec95acafdcfb88ae1829407f9402b6be95d9dcab8467db8e91be
                                    • Instruction ID: 9d4a9cdf97989bede5ffb9e17c85bc0f20c50d5f2e0b0ee4e1f56eb7c40e10a2
                                    • Opcode Fuzzy Hash: 9aea9ce035e0ec95acafdcfb88ae1829407f9402b6be95d9dcab8467db8e91be
                                    • Instruction Fuzzy Hash: 7C317230B001058FDB249F69C4946BEB7F6EF89355F1484A9D52AE73A4DF70DC018B95
                                    Function 05403620 Relevance: .1, Instructions: 109COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 1eeb585e38f6c306dae3f68fe728e695051abef7d52a523478fef2681a61e247
                                    • Instruction ID: 64fd74bc1cc9da6540903b3659854102b9f5bfd0bb2b166c6f4ff6c2fec43ff6
                                    • Opcode Fuzzy Hash: 1eeb585e38f6c306dae3f68fe728e695051abef7d52a523478fef2681a61e247
                                    • Instruction Fuzzy Hash: 5B3127317002485FCB15BB3998985AE7FE7AFC525032884AEE50DCB392CE35DC0687A5
                                    Function 053E00F8 Relevance: .1, Instructions: 106COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 07682d5545155909eaba03e7379e31eac972d4d930c1b842b6da930d840363dd
                                    • Instruction ID: ce17c5e32953ce59a5ec515733d5b67b498339b08d6374610f5714f7e6d16448
                                    • Opcode Fuzzy Hash: 07682d5545155909eaba03e7379e31eac972d4d930c1b842b6da930d840363dd
                                    • Instruction Fuzzy Hash: 2E316139B00115CFCB04DBA8D89896EFBF6EF89310B10856ED919EB394DB74ED018B91
                                    Function 053E7C70 Relevance: .1, Instructions: 105COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 04ce5ef08303fd4747e7db2e4923bdfc509f27db0e900350b5e538d1041fb016
                                    • Instruction ID: 76d469acf5d69261e521460f85da926b6acd6a7a317e34d23bbdd1c3fc38f18f
                                    • Opcode Fuzzy Hash: 04ce5ef08303fd4747e7db2e4923bdfc509f27db0e900350b5e538d1041fb016
                                    • Instruction Fuzzy Hash: 5B310532F003595BCB14DBA5D8945AFFBFAEFC9310710816AE409A7381DF34AC0187A0
                                    Function 00B7DCD0 Relevance: .1, Instructions: 104COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0703be59eef009763a65e43052a4027378be3821472754d2e5cbf7e321d2e752
                                    • Instruction ID: 4c644ec8af5a9af5d6c563ea18c3cfb923215da1f83e21145c70f9bca9157f23
                                    • Opcode Fuzzy Hash: 0703be59eef009763a65e43052a4027378be3821472754d2e5cbf7e321d2e752
                                    • Instruction Fuzzy Hash: A0414C3560060ADFCB11CF58C8808AABBF6FF4A354B64C499E9599B361D732E916CB90
                                    Function 053E4E28 Relevance: .1, Instructions: 103COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 5c0cbed3d0eea736d7c271095205aa11035bae32ebf969155f90781956a1ff38
                                    • Instruction ID: 642571cf4ad4aa3358705e48b18b1cdc2abaeceaa3e371be7da5eec56a95b318
                                    • Opcode Fuzzy Hash: 5c0cbed3d0eea736d7c271095205aa11035bae32ebf969155f90781956a1ff38
                                    • Instruction Fuzzy Hash: 2631A575E103098FCB05EFB9C8049DE7FB5FF8A210B01866AE545EB260EF309955CBA1
                                    Function 00B744CB Relevance: .1, Instructions: 103COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ac0836e1fcb40456917fbfae253093c64749490360e4d0dc81759028eec5c61d
                                    • Instruction ID: ee1ae469c0c1adce84c7266d3b25747265248138c6734587178606de7c6064dc
                                    • Opcode Fuzzy Hash: ac0836e1fcb40456917fbfae253093c64749490360e4d0dc81759028eec5c61d
                                    • Instruction Fuzzy Hash: DE416D74A00205DFDB14DB64D499B6EBBF2FF48301F148559E5199B3A2CB709C46CB80
                                    Function 00B70A10 Relevance: .1, Instructions: 100COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: c5945d80464f3f916d026559e3bf1b55bcb4df575067812109a61dbf755d9f48
                                    • Instruction ID: 40fcbfdf0be1f001560a75552a6a8d0dacc7692e84bc827c13ea14a5075453b2
                                    • Opcode Fuzzy Hash: c5945d80464f3f916d026559e3bf1b55bcb4df575067812109a61dbf755d9f48
                                    • Instruction Fuzzy Hash: 4F416174E01219DFDB58DFA9D980AAEBBF2BF88300F14816AE818B7354DB345942CF50
                                    Function 053EBCF1 Relevance: .1, Instructions: 98COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 5b0ae30184c65e136bcb55dd65b9eb70a0405f92c1c90a64e335e343eb606a7d
                                    • Instruction ID: f463887fff1624ded183756f5306c77c1dede347f5df5df22af1ad0d20b56a9c
                                    • Opcode Fuzzy Hash: 5b0ae30184c65e136bcb55dd65b9eb70a0405f92c1c90a64e335e343eb606a7d
                                    • Instruction Fuzzy Hash: F2316B74B012058FCB15DFA4D4949AEFBF2FB88301B648669E406D7385DB35DC42CB95
                                    Function 05407C49 Relevance: .1, Instructions: 97COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: f4317e19798ba17c931f8b496b14b7bf68f25512fa5f1985f70f7b74edae5c5e
                                    • Instruction ID: daba3ad0aa9a57a7f60e1f0e54287c59e6ca8350bd9f3f425e5a88b4cc553899
                                    • Opcode Fuzzy Hash: f4317e19798ba17c931f8b496b14b7bf68f25512fa5f1985f70f7b74edae5c5e
                                    • Instruction Fuzzy Hash: E231A235705240DFC314DB38D945A9BBFE6EF85615B29C8AEE059CB392CA75EC02C790
                                    Function 05401180 Relevance: .1, Instructions: 96COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 32b33a996113ee4c46ce7e781031952174ed7309b86a50032313c6201896bb8c
                                    • Instruction ID: 6b3703a8289935b2eafa9cb1d59ac987ebcb1ff3ab641a42909a92bac713f9bc
                                    • Opcode Fuzzy Hash: 32b33a996113ee4c46ce7e781031952174ed7309b86a50032313c6201896bb8c
                                    • Instruction Fuzzy Hash: B441E375E002099FCB04DFA9C9849EEBBF6FF88310B25946AE515F7251DB30AD41CBA4
                                    Function 00B7A5B9 Relevance: .1, Instructions: 96COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 6f439f96fd00c6a295a8c11d3aa2db584d7565554a8b0a1fc638d5b0175852df
                                    • Instruction ID: 7b4430dea567e606c6f4bcf8c0d19a25ba509e4c9ea1ba56fa355e57193a6d9f
                                    • Opcode Fuzzy Hash: 6f439f96fd00c6a295a8c11d3aa2db584d7565554a8b0a1fc638d5b0175852df
                                    • Instruction Fuzzy Hash: FF314F35A001089FCB01DF68D8809DDBBB6FF8D310B15819AE919EB361C732EC06CB50
                                    Function 053E0062 Relevance: .1, Instructions: 94COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 835731563e62369ed231d3a307cba1a2456b75e45fdcf2da0fff8fe3e4068d9b
                                    • Instruction ID: 0e085835f7316478dbe9c616479e3a920c806f22d0675e9d8c89b7786fd6fc94
                                    • Opcode Fuzzy Hash: 835731563e62369ed231d3a307cba1a2456b75e45fdcf2da0fff8fe3e4068d9b
                                    • Instruction Fuzzy Hash: 2E21E9357001148FCB149B7CD848A6EBBF6EF84264714862FE509C7394EB70DD468780
                                    Function 053EBBD8 Relevance: .1, Instructions: 93COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 480c44bf2a1bab0ef2a4c9eb5ee290d556895d6e4d0afd1d4474945dcc8d07e0
                                    • Instruction ID: 57e04e4af5f14f809c6d1e86b7a4d42579ca2b318aff2d029a807762c492d873
                                    • Opcode Fuzzy Hash: 480c44bf2a1bab0ef2a4c9eb5ee290d556895d6e4d0afd1d4474945dcc8d07e0
                                    • Instruction Fuzzy Hash: 8B316D34600206DFCB15DF68C895ABEBBF3FB88311B558659E406EB391DB31E842CB95
                                    Function 053E12F9 Relevance: .1, Instructions: 91COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 070659184f185ce8f3f542e30e4c2ef0a4a8658f41bd50a38d14104089b61bfb
                                    • Instruction ID: 6365387b402f51653a0e4a409f497ce59699c70e0dc14500960ac4efeb40ce73
                                    • Opcode Fuzzy Hash: 070659184f185ce8f3f542e30e4c2ef0a4a8658f41bd50a38d14104089b61bfb
                                    • Instruction Fuzzy Hash: 0A31B631A04254DFCB159BA8D854BAEBFF6FF8A310F054069E105EB3A1DE745C41CBA1
                                    Function 00B77180 Relevance: .1, Instructions: 90COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 2c289cb8f9de21a0980be8cacd6e9fc8b5f5db730748d14da482f761ec233593
                                    • Instruction ID: 01bd93570b2f6ab73dda5ef41d85bb5c2a2a1a5ac96ba6933f260c305c6ec211
                                    • Opcode Fuzzy Hash: 2c289cb8f9de21a0980be8cacd6e9fc8b5f5db730748d14da482f761ec233593
                                    • Instruction Fuzzy Hash: E5310D70604B018FC734DF69D984A5AB7F1FB49320B208B6DD57A877A2DB30A945CB91
                                    Function 053E396B Relevance: .1, Instructions: 88COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b2b09a8f0a4ccf01a7bc263cef1cbb5bc47a01c500bb7a9885152e7d5c70fe3b
                                    • Instruction ID: 7948ffa8e9b9fd47316933b95e03519e83d10ac5f6afb46eae9b54cbd997ac8e
                                    • Opcode Fuzzy Hash: b2b09a8f0a4ccf01a7bc263cef1cbb5bc47a01c500bb7a9885152e7d5c70fe3b
                                    • Instruction Fuzzy Hash: 86110DA39087A14FD7026B68DCA53D93F50CFA23A1F0905A7D580C72D3F968484A8FE2
                                    Function 00B76FA8 Relevance: .1, Instructions: 88COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: facc1e160b03717aa3adaacc5001c95bdf4d3bf9a79c130a914c88c4aefa638a
                                    • Instruction ID: aed8f72d53fbe2912102628b707af357ff37b47394d832c795094dbc7acac99f
                                    • Opcode Fuzzy Hash: facc1e160b03717aa3adaacc5001c95bdf4d3bf9a79c130a914c88c4aefa638a
                                    • Instruction Fuzzy Hash: 4A312C35B042058FCB14CF58D494AAEB7F2EF49354F1585A9E81AEB3A1DB31DD01CB54
                                    Function 053E1D3A Relevance: .1, Instructions: 87COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 72b05a64d0fe65ab3e78eebdea4f7e15caacab3745e0265b4f567f00ab7c71eb
                                    • Instruction ID: 706ece68921486aeab2de688c748e13182ba0d633de6cb8ebcb41527f0b385a4
                                    • Opcode Fuzzy Hash: 72b05a64d0fe65ab3e78eebdea4f7e15caacab3745e0265b4f567f00ab7c71eb
                                    • Instruction Fuzzy Hash: 4631F974600A11CFCB30DF69D84866ABBF1EB85310B544A5DD1969B6E1D770E946CF80
                                    Function 053E1D48 Relevance: .1, Instructions: 87COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: fad0a7dfd48667e30ba2c8a30a27eb72a250cb152809f4ccf88e5a45da0f886f
                                    • Instruction ID: ed2b601a3d121ae0b405b11266c212ea74002773a63332c2a45cfebbc11348e9
                                    • Opcode Fuzzy Hash: fad0a7dfd48667e30ba2c8a30a27eb72a250cb152809f4ccf88e5a45da0f886f
                                    • Instruction Fuzzy Hash: 38310734600B16CFCB30DF69C848A6ABBF5FB89310B504A1CE1969B6E1D770E946CF80
                                    Function 00B78F80 Relevance: .1, Instructions: 87COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a0fb2dbdda6c994354df86f7e6b7678023bee42f36963b70b43081a0c8d1b682
                                    • Instruction ID: 6542e6b818ffa7929e50817f89f01783297c3a86cd57ff436dd07dd25794240a
                                    • Opcode Fuzzy Hash: a0fb2dbdda6c994354df86f7e6b7678023bee42f36963b70b43081a0c8d1b682
                                    • Instruction Fuzzy Hash: 43311E706107018FC730CF69C84466AB7F2EF89350B148A5CD4AADB7A1DB31E946CF90
                                    Function 00B7B7FA Relevance: .1, Instructions: 85COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: fe04a0d85009209afc81451af224f83e187d42cca72f0503f6c1595899e789b6
                                    • Instruction ID: 3cf8493e616a8ab26a31e2a2f5a1c7c4cfb1cf77801ecfd44cc17a08bc4f654e
                                    • Opcode Fuzzy Hash: fe04a0d85009209afc81451af224f83e187d42cca72f0503f6c1595899e789b6
                                    • Instruction Fuzzy Hash: A921A0313102018FE706A779A8A5A9E77EBDBC9350350C56AD22DCB745EFA0DC428795
                                    Function 053E30B0 Relevance: .1, Instructions: 84COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a4bb63b65ace37c86318c1020d1e306caa79c3bd35325df9297af44169a7970a
                                    • Instruction ID: d271fafaf5b8a0e896258b8f0b6aab7dd49117599af456db037749ee08041105
                                    • Opcode Fuzzy Hash: a4bb63b65ace37c86318c1020d1e306caa79c3bd35325df9297af44169a7970a
                                    • Instruction Fuzzy Hash: 272191357042158FCB11DB788984A6EBFF6EF85244B05859EE509CF3E5EB74EC0187A1
                                    Function 05401698 Relevance: .1, Instructions: 84COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 80eff2246aa5ed37971331447b7e910751621926c7865acd3440b086b8d71127
                                    • Instruction ID: ab6c88b25b82676983adbb5cea59c54e8f265ddf70553da24b36f1061da691cf
                                    • Opcode Fuzzy Hash: 80eff2246aa5ed37971331447b7e910751621926c7865acd3440b086b8d71127
                                    • Instruction Fuzzy Hash: 84317A75604109AFDB10DF54D884BFF37BAEB84300F20A17AE806DB695D735A941CBA1
                                    Function 00B78E00 Relevance: .1, Instructions: 84COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 6bb27c395c7a5bf318655aa0041b5d095cb2b73d824dcb39a1043f2f5b550a68
                                    • Instruction ID: 85c3245da8da27b9b558257d3b936c186662f8272b5a5f76095e909356bcb357
                                    • Opcode Fuzzy Hash: 6bb27c395c7a5bf318655aa0041b5d095cb2b73d824dcb39a1043f2f5b550a68
                                    • Instruction Fuzzy Hash: A631DE746006018FC730DF69D85866AB7F1EF89320B148A5CD5AADB7A1DB30E946CF90
                                    Function 053E8EF0 Relevance: .1, Instructions: 80COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: c0f2ac960e96e9773e0348a520e61ea8765d47f2666d4a8fd6dfc0f584d01018
                                    • Instruction ID: bcf71fdbbc10294a061c0f7df103fc04d392ec983a742bcbe061e77c23be56be
                                    • Opcode Fuzzy Hash: c0f2ac960e96e9773e0348a520e61ea8765d47f2666d4a8fd6dfc0f584d01018
                                    • Instruction Fuzzy Hash: 452104712007018FD716DB78D85469EBBE2FF44310B004A1ED08ACB796EF74B94A8795
                                    Function 053E28E2 Relevance: .1, Instructions: 80COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: f1f33150e4c470daaddad7584aa84c6fa4f9ad91b9329583dc818ddf1886287f
                                    • Instruction ID: 4f8723375b96012280bb030854b6cf638474d4933c7600a5479eec04325ef8a9
                                    • Opcode Fuzzy Hash: f1f33150e4c470daaddad7584aa84c6fa4f9ad91b9329583dc818ddf1886287f
                                    • Instruction Fuzzy Hash: 4E219334B00219AFDB049BA1D859BBEBBBBFF84710F118519F502AB291DF705841CB50
                                    Function 00B7B808 Relevance: .1, Instructions: 80COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0711430790637e24f1497a04ebbc1fe9d41382b932c70d6a6097ea18fd1d0967
                                    • Instruction ID: b9ab50dc70915e9f9fee52ebfadb460d9c84bf9ad355ac0283dde52c2780b6c0
                                    • Opcode Fuzzy Hash: 0711430790637e24f1497a04ebbc1fe9d41382b932c70d6a6097ea18fd1d0967
                                    • Instruction Fuzzy Hash: C221B0313102019FA606B77EA895A9EB7EBDBC9350350C529E22E8B744EFB0DC428791
                                    Function 053ED91D Relevance: .1, Instructions: 79COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: c5b622e042f75c74fb22b366156fbc76189d2ea6e5c2c745f835bb601015f252
                                    • Instruction ID: 796f2eab888b3dc091f3a2ab6c3ea4a9716e2849758d7f289571fa37b6b4d39b
                                    • Opcode Fuzzy Hash: c5b622e042f75c74fb22b366156fbc76189d2ea6e5c2c745f835bb601015f252
                                    • Instruction Fuzzy Hash: 4D311C75A01208AFCB05DFA4D895AEEBFBAFF48310F148519F406A7250DB71A841CB50
                                    Function 00B790F8 Relevance: .1, Instructions: 77COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: d127fbb3a96a843c4800e78df1c02280626f72eb42c0165a318bbd7ce55f0011
                                    • Instruction ID: c13688f256d28976feb49c72fa1517ede0b6f839b9e2560605789d0e4b912e0a
                                    • Opcode Fuzzy Hash: d127fbb3a96a843c4800e78df1c02280626f72eb42c0165a318bbd7ce55f0011
                                    • Instruction Fuzzy Hash: A6213C30A017029FDB24DF69D888A6AB7F5EF84710B508A6CD56AA7790DB30E915CB90
                                    Function 05400D59 Relevance: .1, Instructions: 75COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: fbbea9a30b8698644a7245470054a37b80295b422500d46a73612a92c728d5e8
                                    • Instruction ID: b872e56c237083d0e6daf260f0cc87404e5d63545b6dcf4a1168f46d4f736f2c
                                    • Opcode Fuzzy Hash: fbbea9a30b8698644a7245470054a37b80295b422500d46a73612a92c728d5e8
                                    • Instruction Fuzzy Hash: 5B21D435700611ABD718DBA5DC59BBABBA2FFC8311F508126E55AC37C1DB70B852C790
                                    Function 053E7A28 Relevance: .1, Instructions: 73COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b2574949a06b9ceaf86d797a46564e2468564a84ea9dc72435557f6ead45f125
                                    • Instruction ID: 1e8ed5f6d7a4c515570e889ba85a7ae3afd8b7a35161013ab15181f1d7a7aa0e
                                    • Opcode Fuzzy Hash: b2574949a06b9ceaf86d797a46564e2468564a84ea9dc72435557f6ead45f125
                                    • Instruction Fuzzy Hash: 84313839A11219CFCB55DF64E985ADCBBB6FF48310F008599E90AAB324DB319982DF50
                                    Function 053E8F00 Relevance: .1, Instructions: 72COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 48c613602f65bdb9bb23f592c6c938dd99c9ce55d725d4cd413f16225bfea5f8
                                    • Instruction ID: 5a2fc3a26a724524f4b98e5c26cadf4d8d62074b64ebb24f58761c766cc23352
                                    • Opcode Fuzzy Hash: 48c613602f65bdb9bb23f592c6c938dd99c9ce55d725d4cd413f16225bfea5f8
                                    • Instruction Fuzzy Hash: DC2122302007018FD725EB29E88479EBBE6FF84314B004A2DD14ACB781DF74F84A8B99
                                    Function 00B74F68 Relevance: .1, Instructions: 70COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: eb3c7974749d19dc8ffaf0c4eceb80b70409e34d3d8b34c350e62ef0f45ba890
                                    • Instruction ID: 7402d3fcc33e373ccbbfeca8fbe7b0f4ffb0718a613d3cf88bbccc720a1e54ec
                                    • Opcode Fuzzy Hash: eb3c7974749d19dc8ffaf0c4eceb80b70409e34d3d8b34c350e62ef0f45ba890
                                    • Instruction Fuzzy Hash: 52218634600505CFCF28CF64D8C4A9A7BB5EF48320B148299D8299F2D6DB71D851CBE1
                                    Function 053EB008 Relevance: .1, Instructions: 68COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 27e01e2e80d716a6c82dc563cbdd3481f69964da60923b1d4e46b4c375b6b6e6
                                    • Instruction ID: 31010aad9ac2ff38eb1177e42b80196dbca507013cdbb9a4836b090e984bbaf4
                                    • Opcode Fuzzy Hash: 27e01e2e80d716a6c82dc563cbdd3481f69964da60923b1d4e46b4c375b6b6e6
                                    • Instruction Fuzzy Hash: A71148313043149FD7149F69984066EBBEAEBC8360714462EE409C7380DE34AC0283AA
                                    Function 05402570 Relevance: .1, Instructions: 67COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a38c2258c8f924dba8208c9624c3bdf7c31ef83c9c09865c01b819910dd89e75
                                    • Instruction ID: e4ef09002c81fa503646d426847100b295d5e12696066db4b04e1da4b98da859
                                    • Opcode Fuzzy Hash: a38c2258c8f924dba8208c9624c3bdf7c31ef83c9c09865c01b819910dd89e75
                                    • Instruction Fuzzy Hash: 2D11A2357002029FCB01A669E88559FBBE6DF85210750866BE909CB395DF74DC068798
                                    Function 053E7B83 Relevance: .1, Instructions: 66COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 3ea7b962e472c636af52c18fc96882ba74cdbc95a15886afc8215f0da8918801
                                    • Instruction ID: d7b31e661593162f3d6b68413c9ff70d77a19ef567862099fd5c33ec65b979f8
                                    • Opcode Fuzzy Hash: 3ea7b962e472c636af52c18fc96882ba74cdbc95a15886afc8215f0da8918801
                                    • Instruction Fuzzy Hash: A1213075E0130ADBCB00EFB5D8846DEFBB5EF99300B50862AE519A7250EF70A945CB90
                                    Function 053E3E6E Relevance: .1, Instructions: 65COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: d577d8cf5700abb5613e74ea0d4b6480ae875c81d0cff85c802d1f6cedd44b24
                                    • Instruction ID: 928ad155190dd955ca0de763b05bc703987fb7e037c5bbaef4b2446eac9a1166
                                    • Opcode Fuzzy Hash: d577d8cf5700abb5613e74ea0d4b6480ae875c81d0cff85c802d1f6cedd44b24
                                    • Instruction Fuzzy Hash: 3F1151763502059FC704DB68F8D586AFBB6EFC5220314896AE60A9B351DE70EC05CBA0
                                    Function 05401B19 Relevance: .1, Instructions: 65COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 51b2faed7a8da5a011064005086f8e66fa6ce5692c8b085a83520e8d286de7af
                                    • Instruction ID: fd5e17321997827c4c903214d120b8065835d0a65c1e5f426344bc7ca5fe2e71
                                    • Opcode Fuzzy Hash: 51b2faed7a8da5a011064005086f8e66fa6ce5692c8b085a83520e8d286de7af
                                    • Instruction Fuzzy Hash: 941193757003069FD701EB65E8C59AEBBB6FBC4350B40852AE5198B340EF70ED028BE8
                                    Function 00B7CE98 Relevance: .1, Instructions: 65COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 23b0d07b1f94aa51c7630a921b87492f98130e81608df2f42bd2c50f51736994
                                    • Instruction ID: 00e335f474e645e74ff345a24b4cd1f5174713f22cb556251dc2ae098bac79c3
                                    • Opcode Fuzzy Hash: 23b0d07b1f94aa51c7630a921b87492f98130e81608df2f42bd2c50f51736994
                                    • Instruction Fuzzy Hash: 4E11BE793042409FCB19DB68D490A6A7BF3EFC9260B21809DE55ECB341CB31EC028B50
                                    Function 00B74E18 Relevance: .1, Instructions: 64COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e2cc3faa71d66f55981e79590838eda90f35d699c1515e3570d618c63d4aa9dc
                                    • Instruction ID: 950ece81cd3480a3625f870935593ae6c9a466b18ea8a434dd69ec32ffb909c4
                                    • Opcode Fuzzy Hash: e2cc3faa71d66f55981e79590838eda90f35d699c1515e3570d618c63d4aa9dc
                                    • Instruction Fuzzy Hash: 0F21FA30200705CFD735CFA6D948AAAB7F1FF45321B108A6DD4669B6A1DB31E94ACF90
                                    Function 053E2150 Relevance: .1, Instructions: 63COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: c42d2dd9c2d98a6ec727d93e01463e8866f90447080725bb7d264d81053cfd2a
                                    • Instruction ID: c2a7ae75be230b0bc3241253f99194a684c0c0874a307301d809e9e97e3922e2
                                    • Opcode Fuzzy Hash: c42d2dd9c2d98a6ec727d93e01463e8866f90447080725bb7d264d81053cfd2a
                                    • Instruction Fuzzy Hash: B6215475600206DFCB00DB68E8859AEFBB6FF85310B40856AE519DB355DB30E9458FA1
                                    Function 053EAF38 Relevance: .1, Instructions: 62COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: eba6a3076e739cd36afee0c27f767892c95003e02b8b8b83007f20281c7db6c4
                                    • Instruction ID: 4702f42b418f43179909dc13e0949a2ff169e27690fedd2bc669fa79988b43bb
                                    • Opcode Fuzzy Hash: eba6a3076e739cd36afee0c27f767892c95003e02b8b8b83007f20281c7db6c4
                                    • Instruction Fuzzy Hash: 7D11553230A3815FD7059B38985075E3BA2AF86620F6441AAE448CF3C2CB24ED47C7A5
                                    Function 00B7A518 Relevance: .1, Instructions: 62COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: d6fe2dd41b658e068ae35b4a410b43661cb94bf17d15607244f9e34c0f6a0ba7
                                    • Instruction ID: 6cf93a7cd7526d7cc742bd737017a43c7a7e79765be5eff293487343b02f26ef
                                    • Opcode Fuzzy Hash: d6fe2dd41b658e068ae35b4a410b43661cb94bf17d15607244f9e34c0f6a0ba7
                                    • Instruction Fuzzy Hash: F911C636B002158BCF108B94D8049EEBBA9DBC4B11B0580A5DA1EA7220DA308C12CB91
                                    Function 05401D11 Relevance: .1, Instructions: 61COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0a839b5a8ef22efd9a78ccba44d09791a411c73463c1047367559b29da47f1ac
                                    • Instruction ID: f3481c4faf835d769b24cf34fcb032e5a38d387bb90f264331b0b8b70da75101
                                    • Opcode Fuzzy Hash: 0a839b5a8ef22efd9a78ccba44d09791a411c73463c1047367559b29da47f1ac
                                    • Instruction Fuzzy Hash: 48016D763005119B8608EB69F884AAAB7AAFBC8261324847BE909C7355CE36E813C754
                                    Function 05402580 Relevance: .1, Instructions: 61COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 4f13c5025f84eff249a9f955989306f20eee8316a7fa5b35dc513690a2182b10
                                    • Instruction ID: 3609819e166ccec5f135874bd65e3bcb70f9ddcfa0db3e7cf1a37e8176e92c41
                                    • Opcode Fuzzy Hash: 4f13c5025f84eff249a9f955989306f20eee8316a7fa5b35dc513690a2182b10
                                    • Instruction Fuzzy Hash: C31194357002029F8B01ABA9E88559FBBE6DF84210350C66BE909CF395DF74EC0587A8
                                    Function 00B7CEA8 Relevance: .1, Instructions: 61COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: f2e286b4a221bce265214d39325e96d3bd4364f3edb9eed0fbb08f4fc76c4e6d
                                    • Instruction ID: 9282defe3a8e0786e9f80fd60a110f577827454a9ce3bd5ebd9c5727f7f5cb2b
                                    • Opcode Fuzzy Hash: f2e286b4a221bce265214d39325e96d3bd4364f3edb9eed0fbb08f4fc76c4e6d
                                    • Instruction Fuzzy Hash: 4D118C393002019FCB18DB6DD494A2ABBE7EBCC320B2084ADE55ECB340DA31EC029B50
                                    Function 053E2160 Relevance: .1, Instructions: 60COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 2a4aa634e2a9048c90ee98348e1e6e972f2acdbb2c00a249233eed5441aadf54
                                    • Instruction ID: 93d12135d86188f092f90e6ac3951f9517f09649ecfa56145d2ac3cc97abe9c8
                                    • Opcode Fuzzy Hash: 2a4aa634e2a9048c90ee98348e1e6e972f2acdbb2c00a249233eed5441aadf54
                                    • Instruction Fuzzy Hash: 63114275A0020ADFCB00DBA9D8859AEFBF5FF84350B408529E5199B354DB30E9058BA0
                                    Function 00B7A509 Relevance: .1, Instructions: 60COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 939811b13fc514d9a1416bd242aef8adb7ff727462fb9dda1b800c78596bec54
                                    • Instruction ID: 9a7e3620f02be5ec8495eba6fe539ac124649af2f6401e20af6214e8a50ad721
                                    • Opcode Fuzzy Hash: 939811b13fc514d9a1416bd242aef8adb7ff727462fb9dda1b800c78596bec54
                                    • Instruction Fuzzy Hash: F011E936A102148FDF508B94C8446ADBBFAEFC8711F0684A5D61FE7121DA308C02CB82
                                    Function 053E7922 Relevance: .1, Instructions: 59COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 240638272e8afb9d2e0306383f8eafdad7c2b45ec1690ae4d97af9f27990d789
                                    • Instruction ID: 3bee52b65660d8d187c3f49fd5596d60e371e97569c576a67e35ef992d4f1881
                                    • Opcode Fuzzy Hash: 240638272e8afb9d2e0306383f8eafdad7c2b45ec1690ae4d97af9f27990d789
                                    • Instruction Fuzzy Hash: D221FB74A01218CFCB54DF64D849BA8BBB6FB48310F108599E809AB391DF709E81CF50
                                    Function 05401B28 Relevance: .1, Instructions: 59COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e3dae4a15c8855b9021940c3632c1908358a8fd9ff5e1629986d596c8833e202
                                    • Instruction ID: 2500eb8bba76725c11f9e1a9aee495834644f44d304cb47f8a2bd4c930f1aeff
                                    • Opcode Fuzzy Hash: e3dae4a15c8855b9021940c3632c1908358a8fd9ff5e1629986d596c8833e202
                                    • Instruction Fuzzy Hash: 55116D757003059F9705EB69E8858AEBBB6FBC4350780852AE6198B340EF70ED028B98
                                    Function 05407D3F Relevance: .1, Instructions: 58COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ecf7f8398edd150bd35c9f26e16a79e85e43dd169e8e6398982abc8d0b5a7c8a
                                    • Instruction ID: 10a4b7269630063396fe0c18588f2b12485463deb1a8431dbb6e51f612d910a9
                                    • Opcode Fuzzy Hash: ecf7f8398edd150bd35c9f26e16a79e85e43dd169e8e6398982abc8d0b5a7c8a
                                    • Instruction Fuzzy Hash: 5901A572B002199FCB14DBE5EC996FEBB76FBC8251F144265E915E3380DB305902CB91
                                    Function 00B718A1 Relevance: .1, Instructions: 56COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: d03320745d01be6c7dde623650212d8da0fd9161e731158c944fbed2dfffbec6
                                    • Instruction ID: 518e1f3f6035b763a55e4e2e7bf6394a85e3131b91e0d93940d6a26eb3c8ade4
                                    • Opcode Fuzzy Hash: d03320745d01be6c7dde623650212d8da0fd9161e731158c944fbed2dfffbec6
                                    • Instruction Fuzzy Hash: 73114C2560A3909FC7035B3D886556D3FE1DE9631030885EFC5AACB2A3DB1CD847876B
                                    Function 053E00E8 Relevance: .1, Instructions: 55COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0c24979e6ed54c4be88f81a16c6ecddd675de58a27cf319d3021feb996727ae8
                                    • Instruction ID: a91c3baf65209ec15db4be733e93a0fd6699658586e38860c927d1ade8e81c97
                                    • Opcode Fuzzy Hash: 0c24979e6ed54c4be88f81a16c6ecddd675de58a27cf319d3021feb996727ae8
                                    • Instruction Fuzzy Hash: 0201C4367005159BCB14A76CDC98A6EBBF6EF84250F40C52EE409CB395DBB4EC0687C0
                                    Function 053E7E80 Relevance: .1, Instructions: 55COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 360fe16dbed759ed73fa19e16a8eb38f865290b5e3f5100ddfdfd4526bf2ae0a
                                    • Instruction ID: 17693d5b7839dccff84f29c507fa2c55e9e9f7f69cd1901567b5d6e5e30335eb
                                    • Opcode Fuzzy Hash: 360fe16dbed759ed73fa19e16a8eb38f865290b5e3f5100ddfdfd4526bf2ae0a
                                    • Instruction Fuzzy Hash: 4E01F5717002048BC305A7BDA4152AD6BE7EBC5620754452FE10ACB346CF649C078796
                                    Function 053EAE48 Relevance: .1, Instructions: 52COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ffb0584b43fee09b40d4e92bcfd0b056194d90f5dcc1856fd864f860e5d5acc4
                                    • Instruction ID: 4a325f2432f43f16f7dcd9c04679ce85b7f00640977cc16cdae09f5d75ffaab8
                                    • Opcode Fuzzy Hash: ffb0584b43fee09b40d4e92bcfd0b056194d90f5dcc1856fd864f860e5d5acc4
                                    • Instruction Fuzzy Hash: 771139353006048FD324DB5AD884A6BB7FAFF88620B55851DE156CB760CB70FC01CB90
                                    Function 053EB8E0 Relevance: .1, Instructions: 52COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 62081ff8b68dc8c685a08d186a15a2351ef4e92405ec55a4d38bcef31c8f3a1a
                                    • Instruction ID: 7c7d429b93d7e3c9e616026f858fd4515196880e996f1153f32479b2b7bf62ab
                                    • Opcode Fuzzy Hash: 62081ff8b68dc8c685a08d186a15a2351ef4e92405ec55a4d38bcef31c8f3a1a
                                    • Instruction Fuzzy Hash: DA01F530A04716DFD724EB64D441BAAB7E2EB80310F40C92DE08A8B792CB74FD42CB42
                                    Function 05407291 Relevance: .1, Instructions: 52COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 4a18f8b71faa3824b18467e39d16ac2a29ac484e01601755e71f3718946e3016
                                    • Instruction ID: a93afba022339970911de325af79f2d1a4e50ac2e83bd5109414c111d4f05783
                                    • Opcode Fuzzy Hash: 4a18f8b71faa3824b18467e39d16ac2a29ac484e01601755e71f3718946e3016
                                    • Instruction Fuzzy Hash: 43111C75A10215CFCB18DF68C55869D7BF2BF88201B2544AAE506EB7A0CF71AC45CB91
                                    Function 053E4539 Relevance: .1, Instructions: 51COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 83f99d81262a1ef67d1b2e016b617adecec0813f8ea61be8487bb575fc0fedcd
                                    • Instruction ID: 0e8178f55eddd66c8c25afe36bc9062afd520936393f71d4e1606c0081bd6b97
                                    • Opcode Fuzzy Hash: 83f99d81262a1ef67d1b2e016b617adecec0813f8ea61be8487bb575fc0fedcd
                                    • Instruction Fuzzy Hash: 5D01213370062447CB06A2B8A86536E66DB9F884307580ABAE10EEB3C4DDA5DC074392
                                    Function 053E1308 Relevance: .1, Instructions: 51COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 6e8d4631f2cab484d741158381b58a27d019f63ea9be2a5d29d31de12d56d2dd
                                    • Instruction ID: 39a33fab7e6e5a4947253ea87fa01210fb653c9cfb554cb20f0e97c4610df78e
                                    • Opcode Fuzzy Hash: 6e8d4631f2cab484d741158381b58a27d019f63ea9be2a5d29d31de12d56d2dd
                                    • Instruction Fuzzy Hash: 5A11A531E14219DFDF14DBA8D855AEDBBB6BF89310F000469E105BB7A0EB786D44CBA1
                                    Function 053E25FF Relevance: .0, Instructions: 50COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 5ed7a1150a23b22ae1e49c6d0f36d08b7e921a167b9a420fc38bbc79a0375589
                                    • Instruction ID: eb5751e9e4089df778f03f49c27f103d9cf54c8b5b80386ed6a92235efd62938
                                    • Opcode Fuzzy Hash: 5ed7a1150a23b22ae1e49c6d0f36d08b7e921a167b9a420fc38bbc79a0375589
                                    • Instruction Fuzzy Hash: D701ADB6D00129CFCB00EF6CCC942DABBF1EF49200F64815AD558DB250E2309A43CF91
                                    Function 053EE2F0 Relevance: .0, Instructions: 50COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: bd2fdd7c90e594d0271e1d1d1096386ed6001b9c6e3e4e76b87544ebf39a3083
                                    • Instruction ID: 0e52a22f676b417c9593cfaf72b9234db2d2335a387d76f5fd649e33cfa9c0f8
                                    • Opcode Fuzzy Hash: bd2fdd7c90e594d0271e1d1d1096386ed6001b9c6e3e4e76b87544ebf39a3083
                                    • Instruction Fuzzy Hash: E9012B327053804FD313976AACA45DA7FE6EFC5250349846FD149C7392EE64CC068B58
                                    Function 053E7B78 Relevance: .0, Instructions: 50COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 01e6632146f710c14f0fc8bd253b1f82f437834d6af70db6592f908957d51a73
                                    • Instruction ID: 8041ffc108c5a4d1cc21487f7e680733d19b892e2397840d97c40918ada5a465
                                    • Opcode Fuzzy Hash: 01e6632146f710c14f0fc8bd253b1f82f437834d6af70db6592f908957d51a73
                                    • Instruction Fuzzy Hash: 3B114836E1134ACBCB01EFB1D8541DEF7B2EF95300B10C65AE4566B291EF70A986CB90
                                    Function 05407CC0 Relevance: .0, Instructions: 50COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: c3a742708485b8b23c6e25b15fb72e569e3c43905bd6ff93670b80c9594a8646
                                    • Instruction ID: b37d263ea1b7b50313da1100fd8ea48bbef8b57acb0b6bff118201c927c33d29
                                    • Opcode Fuzzy Hash: c3a742708485b8b23c6e25b15fb72e569e3c43905bd6ff93670b80c9594a8646
                                    • Instruction Fuzzy Hash: B20148353002148FC708EB39D988DAFBBEAEFC96143558469F409CB365CE31EC028B90
                                    Function 054072A0 Relevance: .0, Instructions: 49COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 5184639748e405e906d806b19a2e2f7182dde967dec56fdebc3fb15e05b3b3d8
                                    • Instruction ID: 274f8cf44ec6f1421604de0dade29daf035ef1d12458e1d7107125b5bff0d5c4
                                    • Opcode Fuzzy Hash: 5184639748e405e906d806b19a2e2f7182dde967dec56fdebc3fb15e05b3b3d8
                                    • Instruction Fuzzy Hash: A711FA75A102158FCB18DF68C458A9DBBF6FF88701F2004A9E506EB7A1CF75AC41CB95
                                    Function 053EB6D0 Relevance: .0, Instructions: 47COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: f0a6c697f7c45f111714958457206b393c7674a7968c2c1b95ce7d66e5cca51b
                                    • Instruction ID: 707ae0df76dc3f95f4fab4e38a87c015463420ad44e37025768b7274ca862a2d
                                    • Opcode Fuzzy Hash: f0a6c697f7c45f111714958457206b393c7674a7968c2c1b95ce7d66e5cca51b
                                    • Instruction Fuzzy Hash: 8F019E76600201DFD308DB6AD885A9ABBF6EF84251B04C569E518CB311DB32EC02CBA4
                                    Function 007DD005 Relevance: .0, Instructions: 47COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2202895075.00000000007DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007DD000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_7dd000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ffba55864229bf9319ecc75e890bb2846de2766835a7073cb451347a9dd53dd9
                                    • Instruction ID: 15ad47e69bd9b520cdd60f771c25cfdc97c9017068cd486e9e5a40c84ea5f2c0
                                    • Opcode Fuzzy Hash: ffba55864229bf9319ecc75e890bb2846de2766835a7073cb451347a9dd53dd9
                                    • Instruction Fuzzy Hash: 8501616100D3C45FD7224B258C84652BFB4EF43224F1981DBE9848F297C26D5C45C771
                                    Function 007DD01D Relevance: .0, Instructions: 45COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2202895075.00000000007DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007DD000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_7dd000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 025fb46939df305e6d7e904f4cecb91c216b427e38ee72c227e0ee1bd4aacaa5
                                    • Instruction ID: e297edb85d2b620ba7a7703452e20ad730c32343f9b6b52c03ee7e213eac94d3
                                    • Opcode Fuzzy Hash: 025fb46939df305e6d7e904f4cecb91c216b427e38ee72c227e0ee1bd4aacaa5
                                    • Instruction Fuzzy Hash: 4501A271508345AAE7309A65CD84B67BFA8EFC1324F18C51BED494A386C27DDC46C6B1
                                    Function 053E4E15 Relevance: .0, Instructions: 44COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0431d7ac04f0cc9f0be269ea9a86b0abfec9def01603a25815bac38389b8655f
                                    • Instruction ID: 4348412adb9063c7ee06d7f23ec632e1eb891dcebbfd45c775921adde28e3960
                                    • Opcode Fuzzy Hash: 0431d7ac04f0cc9f0be269ea9a86b0abfec9def01603a25815bac38389b8655f
                                    • Instruction Fuzzy Hash: 0D014C72D107088FCB11EFB8D9095DD7FF8BF0A211B0146AAE545EB251FB708698CBA1
                                    Function 05403F82 Relevance: .0, Instructions: 44COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b8d71290d40b6c08d07a108cc0b218b9cd6f76226e54ad0992a90366d9d7445a
                                    • Instruction ID: 5845ec10be1040862f40f5da9f0e57b437db046888229d4e466b4a002ad7a406
                                    • Opcode Fuzzy Hash: b8d71290d40b6c08d07a108cc0b218b9cd6f76226e54ad0992a90366d9d7445a
                                    • Instruction Fuzzy Hash: E5F09633B045155BE718CA6AAC897FBBBF6E7C4625F148D7BE509C3380DB7194428290
                                    Function 053E1290 Relevance: .0, Instructions: 43COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ea93a17faefbc07f8f64be56e28e44bbac197a2a634ff7cf114afa359bd4afb4
                                    • Instruction ID: 469984dcc6869d3b72b7d27c109538fe7a1388f0410b773157618209b0d18849
                                    • Opcode Fuzzy Hash: ea93a17faefbc07f8f64be56e28e44bbac197a2a634ff7cf114afa359bd4afb4
                                    • Instruction Fuzzy Hash: F0F0FC727402509FC715566DA858B1B7FBAFBCD710F15805AF14DCB396CD149C0287A1
                                    Function 00B77B78 Relevance: .0, Instructions: 43COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a2f5c636e93ae87d7d6573035cb303e4610368089bd970959302091db1f6774f
                                    • Instruction ID: 4b03c7b52157e40ea990df25edbfabe3b46f269db972e62ac21ef39a40b3b4ae
                                    • Opcode Fuzzy Hash: a2f5c636e93ae87d7d6573035cb303e4610368089bd970959302091db1f6774f
                                    • Instruction Fuzzy Hash: C701D6367086069FD7129769E862A6AB7E6EB85311B00456AE519CB384EE70DC028794
                                    Function 00B7BE60 Relevance: .0, Instructions: 43COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0301379a6e934389c7ac78603086bb150b42859b04e449cc63759cd734e1a0b0
                                    • Instruction ID: 9fa0cd6b7dc3f6f945913a3b12e2fdd30f49b7455433d3800e40ce6d6d01f545
                                    • Opcode Fuzzy Hash: 0301379a6e934389c7ac78603086bb150b42859b04e449cc63759cd734e1a0b0
                                    • Instruction Fuzzy Hash: B8016D387001018FCB10DB69D498A65BBF2EFCD35131688DEE588CB355DB20DC02CB51
                                    Function 00B77B88 Relevance: .0, Instructions: 42COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: f3d7d99b7a8c61be4257c05cc959892c6b99a8822691dbd676e8a90f74777df5
                                    • Instruction ID: 4ffdaea3594a0c371ad055338314654f3575b5a6a8b36cd35b4d38447035e253
                                    • Opcode Fuzzy Hash: f3d7d99b7a8c61be4257c05cc959892c6b99a8822691dbd676e8a90f74777df5
                                    • Instruction Fuzzy Hash: 09F0F6313086065FE711965EEC51A6FB7FAEBC9710B00453AE509C7344EEB0EC024794
                                    Function 053EB6E0 Relevance: .0, Instructions: 41COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 8d9af6faea4ec87c896cb957db42bb4dc8b0fecdaa8454fc090252028c1d9aba
                                    • Instruction ID: d9819c6ba258840e552a6b7246e12f37ce0339e6a017c96c21a7b84ae00a16bc
                                    • Opcode Fuzzy Hash: 8d9af6faea4ec87c896cb957db42bb4dc8b0fecdaa8454fc090252028c1d9aba
                                    • Instruction Fuzzy Hash: E1014675600301DFD318DB6AE98599BBBF6EF88360710856AE51DCB351EB71EC02CBA4
                                    Function 053EAFF8 Relevance: .0, Instructions: 40COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ded3dabecb49d9510c6003dd349ae706eae00128566c834072c077a4dfeeffa7
                                    • Instruction ID: 57efc9bab3e59ef046b34cde608a9f7aa0a5d828376448e32d2ee26fa5aa41a2
                                    • Opcode Fuzzy Hash: ded3dabecb49d9510c6003dd349ae706eae00128566c834072c077a4dfeeffa7
                                    • Instruction Fuzzy Hash: 9CF0E972304614AFDB149BA99C85EBFBBEEEBC4691714462EF509C3350DB31AD018794
                                    Function 053E9A60 Relevance: .0, Instructions: 38COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: f14e1f9a199852d467ffa52db2b9a1b6f24398f702d379d1b0eaf286f0042e2f
                                    • Instruction ID: 23163a583d42c526c8a8b17e0cd84febc433721820b7b8101b8ca73df4c70d7c
                                    • Opcode Fuzzy Hash: f14e1f9a199852d467ffa52db2b9a1b6f24398f702d379d1b0eaf286f0042e2f
                                    • Instruction Fuzzy Hash: 68F0C231619249DFD314EFA0A4076BD7BB5EB82341F0081A6FE058B240CE325D20C7AA
                                    Function 05401C99 Relevance: .0, Instructions: 38COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: bb64f315c47959ffc7996d83899b983b0b1381f688af206290b1aafa9b9b4a42
                                    • Instruction ID: 6d0dcec2684ac9611d8de36b47a5fc09df1595c3e7ce40a6b4b69b6ed7dea6a9
                                    • Opcode Fuzzy Hash: bb64f315c47959ffc7996d83899b983b0b1381f688af206290b1aafa9b9b4a42
                                    • Instruction Fuzzy Hash: D8F0F6793002118BC711965EAD84EDBBBEBEB81361B15842EE109C7780DE38D8068784
                                    Function 00B7BE70 Relevance: .0, Instructions: 38COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 1a4fbe16609d6ad9801cedd26354bf76d486f356785bc1d5738333920bbc4622
                                    • Instruction ID: 36c1f6de98ef54c8bb7f90741ed47293ddfa6144e05bd7d05e42eae091a27e8f
                                    • Opcode Fuzzy Hash: 1a4fbe16609d6ad9801cedd26354bf76d486f356785bc1d5738333920bbc4622
                                    • Instruction Fuzzy Hash: 8CF017387001018F8714DB6ED488D66BBF6EFCD36572588A8E549CB355DB31EC02CB90
                                    Function 053E7D50 Relevance: .0, Instructions: 37COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e64a01add47e2033a7624cda3ff551a6cd0177c32351d5c03bff3c65b0742d38
                                    • Instruction ID: b7026e35a9ad63fee1d1c1745fa6ffc5aaac7e04be064f6b565272887af23894
                                    • Opcode Fuzzy Hash: e64a01add47e2033a7624cda3ff551a6cd0177c32351d5c03bff3c65b0742d38
                                    • Instruction Fuzzy Hash: 62F02B777083800FC3159225FCD8B6BBFEADBC6211B09806ED04EC3382DC248C018751
                                    Function 00B7F930 Relevance: .0, Instructions: 37COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0a12b9bb77fb83bb0fbc5ac509e082e3409a82ed0955396a49b7406b295214be
                                    • Instruction ID: b50686a064bce67361549a7e7585f97653d8edd8b0ae94cb032735c0e9d456aa
                                    • Opcode Fuzzy Hash: 0a12b9bb77fb83bb0fbc5ac509e082e3409a82ed0955396a49b7406b295214be
                                    • Instruction Fuzzy Hash: 7DF02B367002409FC715DB59E89096AFB9AEFC8720B14846FE909CB352C936DC02CBE1
                                    Function 053E3030 Relevance: .0, Instructions: 36COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b27d3720ecf4b2d25c29ead4bbc90e4c34a127db1480169b12bcb0ce5d9d1810
                                    • Instruction ID: e7824468e788f9e5d0d673339d71a0f3289b1f9a6f5f0c9758119d1f2e5d8602
                                    • Opcode Fuzzy Hash: b27d3720ecf4b2d25c29ead4bbc90e4c34a127db1480169b12bcb0ce5d9d1810
                                    • Instruction Fuzzy Hash: 04F0A930910229CBCF15CBA8D4187EEBBF2AB8C311F100A29D402B33E0CB354D46CBA0
                                    Function 053EE390 Relevance: .0, Instructions: 36COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: de058089e9c842cebb922d9b08514b30f392c455acc5348d5c88cb8423bafc4b
                                    • Instruction ID: 6516402ae5619dc32859d77bada138e4ac3b9a5d1ee64fe8322c93660be3f41e
                                    • Opcode Fuzzy Hash: de058089e9c842cebb922d9b08514b30f392c455acc5348d5c88cb8423bafc4b
                                    • Instruction Fuzzy Hash: 94F02B367043108FD310CBB8D88499EBBF9EF843603044A2EE55DCB391D670ED428790
                                    Function 053EB9E9 Relevance: .0, Instructions: 36COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: fbadcd8b3ea8ad0c6167cae242cfc5f1bd1fe7ba8b2214965039880330010cfb
                                    • Instruction ID: 0eca9ddf6481e8b41a74b7b2ef5cf1724b64946c050b63e36e50a049971b5ad4
                                    • Opcode Fuzzy Hash: fbadcd8b3ea8ad0c6167cae242cfc5f1bd1fe7ba8b2214965039880330010cfb
                                    • Instruction Fuzzy Hash: 59F02431B00310AFC705DB58E885D69BBE6FB843617058466E148CB351DB35DC01CBA4
                                    Function 053E12A0 Relevance: .0, Instructions: 35COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 2de2ca421b82be8f2bcd609ab52eff3d17bb0d00739ab911227faebb3b7abd2a
                                    • Instruction ID: 0bebd622ce6587f56acf87ac299fa5f0a46cb305ad4ec31f95c31839bfb1cdb4
                                    • Opcode Fuzzy Hash: 2de2ca421b82be8f2bcd609ab52eff3d17bb0d00739ab911227faebb3b7abd2a
                                    • Instruction Fuzzy Hash: A0F089357001105FD7545A5DA848B2B7BAAFBC8710F148065F50DCB355CD209C0187A1
                                    Function 053EDA62 Relevance: .0, Instructions: 35COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ad2be74f24296224087bbe388aaf77daa2ff3d44a43b55cf558e88d18672b01a
                                    • Instruction ID: dd726e858923130b933dfafdc2dbd2c71653f18a6db4d6af52754f24fdf0e55e
                                    • Opcode Fuzzy Hash: ad2be74f24296224087bbe388aaf77daa2ff3d44a43b55cf558e88d18672b01a
                                    • Instruction Fuzzy Hash: B2F082323012259BC705EB39E494A5F7B6AEFC6361BA08125FD058F364CF349C02CBA1
                                    Function 00B74632 Relevance: .0, Instructions: 35COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: d1d27ac15f8a2662c5353d9661e0e0bdf290fe0a92bffba0a0f3a88d95f7835c
                                    • Instruction ID: 4e875ef7e87786a424e3c17ce861bcf4512733d9165763376968861aa42ad44d
                                    • Opcode Fuzzy Hash: d1d27ac15f8a2662c5353d9661e0e0bdf290fe0a92bffba0a0f3a88d95f7835c
                                    • Instruction Fuzzy Hash: E701A27060024ACFDB10DB54D184BADBBF2FB45309F248598D4195B391CB759D8BCB81
                                    Function 053EE3A0 Relevance: .0, Instructions: 34COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: f1e5a0628e0f81857a94e2ea4d783980913a67f3aa88a154dbf5006b3dab8fac
                                    • Instruction ID: 4765aca6446b4e1291caef336c243e82b5ca376f6b0cc4c346229f267a897001
                                    • Opcode Fuzzy Hash: f1e5a0628e0f81857a94e2ea4d783980913a67f3aa88a154dbf5006b3dab8fac
                                    • Instruction Fuzzy Hash: A4F054353003159F9714DA6DD884D5EBBE9EF852603108629F519CB390DA71ED418790
                                    Function 05401CA8 Relevance: .0, Instructions: 34COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 38c71b73322d7ff210c8ceafa026f024bb78c41755d4cc929b54f83d96779846
                                    • Instruction ID: 61608e3d9685b3d1d80ec427fdf48678968421ee6e66762d692c70e89c2dd5a4
                                    • Opcode Fuzzy Hash: 38c71b73322d7ff210c8ceafa026f024bb78c41755d4cc929b54f83d96779846
                                    • Instruction Fuzzy Hash: FAF082793043119B8A11AA5FA994D9BBBFBEBC57A0350843FE509C7384DE75EC028794
                                    Function 05400D10 Relevance: .0, Instructions: 33COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 932fab73368c9c12973a8035d71f0dda4f2d54afffced795e5fe763d9cf81523
                                    • Instruction ID: c320d8544f6d763de2a32942674597ad6b24732136f87a705531cfa3d54e8768
                                    • Opcode Fuzzy Hash: 932fab73368c9c12973a8035d71f0dda4f2d54afffced795e5fe763d9cf81523
                                    • Instruction Fuzzy Hash: 4AE02231300B3067C326A224AC4AF57BAEADBC5B11F20842AE50987380CE21EC03CAD8
                                    Function 05408181 Relevance: .0, Instructions: 33COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: dea3aedff4957cad653cbd7c9345d154052eadc13ff10edb40a3a72840cc817b
                                    • Instruction ID: 7e30b9ae97a956a2ff7dfbf89ed7efc04173babff37c23a5e0ae43c9bb339fee
                                    • Opcode Fuzzy Hash: dea3aedff4957cad653cbd7c9345d154052eadc13ff10edb40a3a72840cc817b
                                    • Instruction Fuzzy Hash: DDF0A0323100149FC7449B6EE858F5ABBDAEFCDB20B244069F20DCB3A1CE61EC018B91
                                    Function 053E4F58 Relevance: .0, Instructions: 32COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: dae27673dad333e62e9112b740e7e15d123e88696a49a20dc5a41cb7ccec9a7a
                                    • Instruction ID: 8f210dd0ce5b06549dfcd949acbf7557f5d2b92c6a2116f4bd894ae52c61d509
                                    • Opcode Fuzzy Hash: dae27673dad333e62e9112b740e7e15d123e88696a49a20dc5a41cb7ccec9a7a
                                    • Instruction Fuzzy Hash: F4F05C32A146148FCB01EFA8D8049853BB5EF4B210B028696F444CB165D630C842C7E5
                                    Function 053EB980 Relevance: .0, Instructions: 32COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 306f89279e4fd65a92d521933f6b1109968cb2f6e12e956ef9eabe575fee8ec5
                                    • Instruction ID: e910a1169c4c253eedda9fd92c17980da46adfe374705bda2fc9c7b3da31329e
                                    • Opcode Fuzzy Hash: 306f89279e4fd65a92d521933f6b1109968cb2f6e12e956ef9eabe575fee8ec5
                                    • Instruction Fuzzy Hash: 1FF0903A704710CBC3059BB5E9689667BE2EF843127048569E446C7791DB34AC42CB44
                                    Function 05406611 Relevance: .0, Instructions: 32COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e78c0cb5b62b246d303394d5a870338ec22c68ea302109caf463c312fafe6238
                                    • Instruction ID: e708a5fc2bda46d239229a3e2f23c73398d853666415af094e094874090c7612
                                    • Opcode Fuzzy Hash: e78c0cb5b62b246d303394d5a870338ec22c68ea302109caf463c312fafe6238
                                    • Instruction Fuzzy Hash: 5AF0A7367045645F8704A76E9C5895ABBD9EFC922131400AAE10DC73A2C920AC01C7A5
                                    Function 05408188 Relevance: .0, Instructions: 31COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: de0fa37406a59fcda87ae2325fc522b021d7be64ac6ed7ecad9028ec3b618442
                                    • Instruction ID: c2324361b33cbe689c8e9286264434ab576adbdb6e26bc1786f865bb45ed4b1d
                                    • Opcode Fuzzy Hash: de0fa37406a59fcda87ae2325fc522b021d7be64ac6ed7ecad9028ec3b618442
                                    • Instruction Fuzzy Hash: A5E065353105145FC7449B6EE858E5ABBDAEFCDB20B214069F20DCB3B1CE61EC018794
                                    Function 00B718D8 Relevance: .0, Instructions: 31COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 9e1d041ad28ae04531c4dec746d46445d60b5a5dd1bf38ce7d52243711d6ee0f
                                    • Instruction ID: 4b7da2ddc2cbdbb24f5f34d265baf52a4b5f708b9c49f294f83186e92e039c98
                                    • Opcode Fuzzy Hash: 9e1d041ad28ae04531c4dec746d46445d60b5a5dd1bf38ce7d52243711d6ee0f
                                    • Instruction Fuzzy Hash: A0F082353012059F8B12AB2DA85456E77E6DBC9351300C479D15ACB351DF38AD4347A6
                                    Function 053E3040 Relevance: .0, Instructions: 30COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 7e38371561e64d86413fb56c9820c00cece7f46d93c00b980f2ea93574bc1539
                                    • Instruction ID: f964e0da6554ffff74191468f6b900897257954bd197b5d9a50bfa09739f6a52
                                    • Opcode Fuzzy Hash: 7e38371561e64d86413fb56c9820c00cece7f46d93c00b980f2ea93574bc1539
                                    • Instruction Fuzzy Hash: 14F03431A10229DBCF19DBA8D8197EEBBF6AB8C311F100929D402B7390CB761D05CBA1
                                    Function 053EDA70 Relevance: .0, Instructions: 30COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 16d18b09dd649490ac1e8f4f0480b8d4612380b262cfefce2e591bcd3e969600
                                    • Instruction ID: e1f2bcfc07797e1e6710e14b5fa964ee02b9fe518c309436ece2dc85a5a82a62
                                    • Opcode Fuzzy Hash: 16d18b09dd649490ac1e8f4f0480b8d4612380b262cfefce2e591bcd3e969600
                                    • Instruction Fuzzy Hash: 19F030313012289BC705EB3AE49496E7B6BEFC63607A08125FD054B364CF349D02CBA1
                                    Function 053EDA06 Relevance: .0, Instructions: 29COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 6307a69e08ff49f3cb88980b153734929f59dafc4fb7664bf504d8d6ce8d9860
                                    • Instruction ID: 2ca41f64fe34f39d106a69a195b5b972c1e25ed02c40664a4dec783101542312
                                    • Opcode Fuzzy Hash: 6307a69e08ff49f3cb88980b153734929f59dafc4fb7664bf504d8d6ce8d9860
                                    • Instruction Fuzzy Hash: F4F01D31A15118DFCF20CF65E585AECBBF6FB48351F148429E815AB680D7719A54CF60
                                    Function 05403ED0 Relevance: .0, Instructions: 28COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 635357af84bedacbd7b130f4129254725c6007c4ecd67b733818d873306af265
                                    • Instruction ID: e62872daf7fc9140ac2be76bc438dc282c2a3147394357562ff1840f3ec145db
                                    • Opcode Fuzzy Hash: 635357af84bedacbd7b130f4129254725c6007c4ecd67b733818d873306af265
                                    • Instruction Fuzzy Hash: ADE0263170024057C61822BE6C586ABBEDFEBCC720B20847AF90AC7380DE658C0282A5
                                    Function 053E3535 Relevance: .0, Instructions: 27COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: f43006546d042eb77789c25c6af7ddc629f2819977f90ed1d91b759807e6ce00
                                    • Instruction ID: cb9676e42b6be00d883243661dd5f66ddb18e4dbb643164d3bc17bcf20355925
                                    • Opcode Fuzzy Hash: f43006546d042eb77789c25c6af7ddc629f2819977f90ed1d91b759807e6ce00
                                    • Instruction Fuzzy Hash: 61E06536B100298FCB04EB6CE4558AE77FAAFC86117208556D407E73E0CE70EC0187D0
                                    Function 053E4548 Relevance: .0, Instructions: 27COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 68c365605103ded3f1ca0a04ff5f42f152bb56be50747df9c1d3972227f8e305
                                    • Instruction ID: daad288fc2e4cb210c268d171848f942893d4136fd638994ff3cff178cbd1a5a
                                    • Opcode Fuzzy Hash: 68c365605103ded3f1ca0a04ff5f42f152bb56be50747df9c1d3972227f8e305
                                    • Instruction Fuzzy Hash: 68E02632304224634A0421EA349802FAAEFEFCC570740007DE30DC7380DDA1DC0243A0
                                    Function 053E2630 Relevance: .0, Instructions: 27COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 9026d33e845e7cd6915f16fa7d3756639e0fc418bec857b9a4499a4159797e39
                                    • Instruction ID: 40b7e581b08a2ee3429c50d053c9b44c1abd31513b42882f2affa1fa12b10c50
                                    • Opcode Fuzzy Hash: 9026d33e845e7cd6915f16fa7d3756639e0fc418bec857b9a4499a4159797e39
                                    • Instruction Fuzzy Hash: 79F06275E00219DF8B44DFADD84169EFBF5EF49210B64816AE918E7211E731AA128FD0
                                    Function 05405A90 Relevance: .0, Instructions: 27COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: c7af8be2adbc9dff8d7aff728f8b55f26a452210837624c3dac6ab0550e5ca9a
                                    • Instruction ID: cee64610808b4275cd7a95ea11a16c5322937651e352782bdeb48f343e63a398
                                    • Opcode Fuzzy Hash: c7af8be2adbc9dff8d7aff728f8b55f26a452210837624c3dac6ab0550e5ca9a
                                    • Instruction Fuzzy Hash: 4FE0DF367002258BCB19AA38E4153AA77E6EB89242B008478D40ADB390CE72EC03CBC4
                                    Function 053EB930 Relevance: .0, Instructions: 25COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 8f55a775e3d3b67bf9ded03670ca6329194e7addf02428b7f1116c8ca2a86544
                                    • Instruction ID: aef1a2d981219196de6012df66f6a99f846a9a299b8c5cccf9307e51575b12e1
                                    • Opcode Fuzzy Hash: 8f55a775e3d3b67bf9ded03670ca6329194e7addf02428b7f1116c8ca2a86544
                                    • Instruction Fuzzy Hash: 7EF03030500725CFC721DB55D444EA6B7E6EB41220F00CA2DE09A87762DBB4A945CB41
                                    Function 05400D20 Relevance: .0, Instructions: 25COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 853e8d6e2d59849ecf14d43807db5ef37437fce06c3216d823dc0df9dbbbe86a
                                    • Instruction ID: 214e56d35287c506fd224526e7b31e52da0459a96624bd75aabf8066e1a4c928
                                    • Opcode Fuzzy Hash: 853e8d6e2d59849ecf14d43807db5ef37437fce06c3216d823dc0df9dbbbe86a
                                    • Instruction Fuzzy Hash: CBE0863174176067C32666559C05F17BBEADBC5F10F20446DF519477C0CE71AC02C798
                                    Function 05406DC8 Relevance: .0, Instructions: 25COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 3d53f0cc3b14aebadc82da5423afa655e15f8a49fd531c644ca9f08b0987a4b8
                                    • Instruction ID: 3e2d8f879faec536ba14ca1417ff6a0ad586029e15874435b10d5cdfb6aa716e
                                    • Opcode Fuzzy Hash: 3d53f0cc3b14aebadc82da5423afa655e15f8a49fd531c644ca9f08b0987a4b8
                                    • Instruction Fuzzy Hash: C1E08637200114EBCB176B70D846BCABFA5DF09241B05C07AE9058A761DA37D55297E4
                                    Function 00B7FF92 Relevance: .0, Instructions: 25COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 9712b57bde17d34468b9b9876a53640850a480cf578c4334c3239fc2029e5c83
                                    • Instruction ID: a1e1a018667a267ccf61b8e9a1dcccde7fc058719a8a8aebf4efa4faf4c620f5
                                    • Opcode Fuzzy Hash: 9712b57bde17d34468b9b9876a53640850a480cf578c4334c3239fc2029e5c83
                                    • Instruction Fuzzy Hash: FAE0DF3230A2000F83306A6D3804082AFF6EACA26039602ABE049CB395C8208C06C7A5
                                    Function 053E3350 Relevance: .0, Instructions: 24COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ab10a18a5039914ea98805b54b7a89f688c64a47f629c3e501c5798be7444294
                                    • Instruction ID: 92e26bfc4a10ed817e30ec74193deeb55adb57435aa44a72152a61a47777264b
                                    • Opcode Fuzzy Hash: ab10a18a5039914ea98805b54b7a89f688c64a47f629c3e501c5798be7444294
                                    • Instruction Fuzzy Hash: 28F039B1D0425A8F8F50DBACA804AEEBBF0EB58200B10446AC49AE3240E3305A03CF81
                                    Function 00B7D528 Relevance: .0, Instructions: 24COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 7b75683fb979dd3dcbe7215679efe4ec05f47901c26aa2798add245dcf06a045
                                    • Instruction ID: 42aaf0a3f51deee8188be5e8d7f98f8ee23f7f72718e7d078ecd3d11c18575ba
                                    • Opcode Fuzzy Hash: 7b75683fb979dd3dcbe7215679efe4ec05f47901c26aa2798add245dcf06a045
                                    • Instruction Fuzzy Hash: ACF03970E09349AFCB51DBB8E44448DBFF1EB45300F0189EEE448D7351EA344A49CB42
                                    Function 053E4591 Relevance: .0, Instructions: 23COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 2cd9cd68a74997dc9caced60d20b0ce270eb3aa9a9689767ef49858f603c6575
                                    • Instruction ID: b5c5f7564b94b9a51637d5c8aba322cd298aa14272827c716dcc45227da919da
                                    • Opcode Fuzzy Hash: 2cd9cd68a74997dc9caced60d20b0ce270eb3aa9a9689767ef49858f603c6575
                                    • Instruction Fuzzy Hash: 8CE06D32D002149BDB40EBA4AA043DABBB6AB05211F2485A6D558EB5C0E331DA29CF50
                                    Function 05401AB1 Relevance: .0, Instructions: 23COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: cdff1cf28328b1cf788d2c088944e266eaa1f51066225d13d5add91411a322fb
                                    • Instruction ID: 8fae198e8419e6c6794e526cdf3d076789cc7425a3b71821cb1922f1f88fd905
                                    • Opcode Fuzzy Hash: cdff1cf28328b1cf788d2c088944e266eaa1f51066225d13d5add91411a322fb
                                    • Instruction Fuzzy Hash: 02E086B150010EEBCB40DB68ED827CD77B9F744204F0089A9E808D3301EF31AE019759
                                    Function 053E45A0 Relevance: .0, Instructions: 22COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 39605570a38e620a13c9ebf380a7b09c528d35e5f6d5ef461b71cc26cb8fcabc
                                    • Instruction ID: c110c9494ade30ad594d208ff123bc817463eafd5570c368a1428122f62024aa
                                    • Opcode Fuzzy Hash: 39605570a38e620a13c9ebf380a7b09c528d35e5f6d5ef461b71cc26cb8fcabc
                                    • Instruction Fuzzy Hash: 9FE01A31D00218ABCB40DFA9E8457DDBBF9EB09210F1085A6E959E7280E671AA158F91
                                    Function 05405AA0 Relevance: .0, Instructions: 21COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 66e70e27e9a955314213d6e35f49f4172b9aceab9214b12a4f6ff166ab885988
                                    • Instruction ID: e7bff1f3566238f9f32c006be77d42a53925039228931ac1bb4b7666afd0835f
                                    • Opcode Fuzzy Hash: 66e70e27e9a955314213d6e35f49f4172b9aceab9214b12a4f6ff166ab885988
                                    • Instruction Fuzzy Hash: 2CE0EC317112248F8B59AA38E11456A77E6EB896553100479D40ADB390DE71EC02CBC4
                                    Function 053E3360 Relevance: .0, Instructions: 19COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 1eae80eee85d59b877dd5d6dbab1d376013771cdfb871837185bd9a6ef020c38
                                    • Instruction ID: dcce56b43b61c044edef9c460f4ce57f3e5457a84aec576b10e775748c1d3e70
                                    • Opcode Fuzzy Hash: 1eae80eee85d59b877dd5d6dbab1d376013771cdfb871837185bd9a6ef020c38
                                    • Instruction Fuzzy Hash: 77E00271D0422A9F8B44EFADA9055EEBBF8EA48210B50446AD919E3240E7346A11CFD1
                                    Function 053ECF08 Relevance: .0, Instructions: 19COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 26aba39e1fe65637d0d3bd820e8dd5fcba3ea3f961726450a0e72266f14bf1de
                                    • Instruction ID: a5348be520044df71687a98291e5d8b67ebd68598e5528bb6beb1eabdc3dfdbf
                                    • Opcode Fuzzy Hash: 26aba39e1fe65637d0d3bd820e8dd5fcba3ea3f961726450a0e72266f14bf1de
                                    • Instruction Fuzzy Hash: BDD05E327106249BC3056B38E89A686FBAAEF84665B200469E10AD3380CB31A811CBC5
                                    Function 053E3A10 Relevance: .0, Instructions: 19COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 842701dbb5e468eb43e3c61f056616b027f0bb4981486d430c2c2242d72f162a
                                    • Instruction ID: 4168689a34be1068e9f696842d3b4af4725de6e9ce3b2c2f81bddbeceea6c4e8
                                    • Opcode Fuzzy Hash: 842701dbb5e468eb43e3c61f056616b027f0bb4981486d430c2c2242d72f162a
                                    • Instruction Fuzzy Hash: BFD05E36B102549786042AA9B84956A7BEEC7CD662B00413EFA0AC7340CDB99C018BA5
                                    Function 00B7D538 Relevance: .0, Instructions: 19COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: d3600c766a1580c6d40487d0db09b49e5a5d6c8ecb98460827a98df63ce85e38
                                    • Instruction ID: 07145b40126e05a46d3dd86262e5f7eb30301a07ac6f4043eb9d7e92873bf56f
                                    • Opcode Fuzzy Hash: d3600c766a1580c6d40487d0db09b49e5a5d6c8ecb98460827a98df63ce85e38
                                    • Instruction Fuzzy Hash: D7E09274E0520CAFCB44EFA8E44559DBBF5AB48300F0081ADA819A7350EA745A458F91
                                    Function 05406DD8 Relevance: .0, Instructions: 18COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 850c72a686cf5cc96e1f5a15e321fe3762b7e72309f95ade811db36c595e81c2
                                    • Instruction ID: 36e73471d816f6720c783188cec0abdc72766e227c01164f24b7f3fec9c054af
                                    • Opcode Fuzzy Hash: 850c72a686cf5cc96e1f5a15e321fe3762b7e72309f95ade811db36c595e81c2
                                    • Instruction Fuzzy Hash: E7D05E36300218AF8B0A6BB0D409CCEBFE9EF0A25030180BAE5098B661DE33D951DBD4
                                    Function 053E9014 Relevance: .0, Instructions: 17COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 9b47307b69aeb143e3554c0457ffa224fbd4f9c6259cec7a02d5dbd59e5f7001
                                    • Instruction ID: 99c83bd7cdeee0daa8b2db84a4701a1161e51e42c13064947fe75827671dc867
                                    • Opcode Fuzzy Hash: 9b47307b69aeb143e3554c0457ffa224fbd4f9c6259cec7a02d5dbd59e5f7001
                                    • Instruction Fuzzy Hash: D4D017357045588FCB09DF39E858499BF62FF8461630882AAE10ACB266CB209802CB80
                                    Function 053E3321 Relevance: .0, Instructions: 16COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: c0f55f9a4822a0b559eb66c08eb49fe605c104d90dca79f285b16fbdc6654ff2
                                    • Instruction ID: 9b7df35e9e43b856fcc9e54ea344e0eade1ebfe6fc9c1c403b0e6a42c4ff5955
                                    • Opcode Fuzzy Hash: c0f55f9a4822a0b559eb66c08eb49fe605c104d90dca79f285b16fbdc6654ff2
                                    • Instruction Fuzzy Hash: C1D0A735714110CFCB10DBACE480E5577F5AF9C21034500C8E449CB350DA60FC418B80
                                    Function 05401AC0 Relevance: .0, Instructions: 16COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a9b7221a192c14584ed620822de15c1ca5587110c4868979095a8aeaaf5d2e3b
                                    • Instruction ID: b1953d87e3fb8548484d41214464d632a4447a190dfdb40ce02ab11b69b7b27b
                                    • Opcode Fuzzy Hash: a9b7221a192c14584ed620822de15c1ca5587110c4868979095a8aeaaf5d2e3b
                                    • Instruction Fuzzy Hash: 5ED01770A1020DEF8B40EFA9E94559DBBBAFB45204B1045A9E808D3304EA31AF009B89
                                    Function 00B70E80 Relevance: .0, Instructions: 16COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 10cbb2560ea51509f98457f14d672435f039dc7a43742ec17e14659bd376113e
                                    • Instruction ID: 5693f06affe74da97000b9eb4a4dd98610864200b12adbc314eb32e51f03ef16
                                    • Opcode Fuzzy Hash: 10cbb2560ea51509f98457f14d672435f039dc7a43742ec17e14659bd376113e
                                    • Instruction Fuzzy Hash: 47D01730A0220DEF8B00EFA9E94155DB7B9EB48204B2085A9D508D7311EA356F019B91
                                    Function 053E24F0 Relevance: .0, Instructions: 15COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: f08d4768404fb248e9d5d153489177c2cbce41a2629a39e57b3dc11c80b1a3f7
                                    • Instruction ID: 49f182c7ccfc7d8ed85bfd16ec8afe2f1f526cbf66762998cb27a456b7995cf7
                                    • Opcode Fuzzy Hash: f08d4768404fb248e9d5d153489177c2cbce41a2629a39e57b3dc11c80b1a3f7
                                    • Instruction Fuzzy Hash: 74D0C934704221CFCB24DBACE490D6577EAAF8C22539145D9E98ADF7A5DE61EC418B80
                                    Function 053ECF18 Relevance: .0, Instructions: 13COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b09aec909d5c88a0ebe87949bba0f1ac23a6d736563272ac5d86aefc72031bad
                                    • Instruction ID: 93d19d79eb5b801fea29633726ad6b20207e38014a95c9a157cf838453d94d6d
                                    • Opcode Fuzzy Hash: b09aec909d5c88a0ebe87949bba0f1ac23a6d736563272ac5d86aefc72031bad
                                    • Instruction Fuzzy Hash: 59C08C31B1173887831A3768A4154DAB7DDDB89A72300047EE50A87740CE72AC02C7C9
                                    Function 053E4F82 Relevance: .0, Instructions: 13COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 7af9c25e3e5c24461561947618358f8f5c63ed3bd692b498b14f124f6fe5b756
                                    • Instruction ID: 0cc1c31b861536a059f193b30aab5ba1e5b3b0f1b2d1070e52986f032b3e1417
                                    • Opcode Fuzzy Hash: 7af9c25e3e5c24461561947618358f8f5c63ed3bd692b498b14f124f6fe5b756
                                    • Instruction Fuzzy Hash: 1CC080720593874FC3036F98B5181843F3AD61A10030745C7D188CE556C9124987C769
                                    Function 053E1EB9 Relevance: .0, Instructions: 12COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 91fe2116b261a7d7d17894771152269b2a5eecb1571c742551c18ffcfd70c16f
                                    • Instruction ID: 11cd187d8c3be1f240a88b39e207da708db03c26d7e88eb68bdaa15a8738c5bd
                                    • Opcode Fuzzy Hash: 91fe2116b261a7d7d17894771152269b2a5eecb1571c742551c18ffcfd70c16f
                                    • Instruction Fuzzy Hash: BAD0A7B690F3C00FCB03C7389E985403FF0665A211705408BE0C2CF292D02C8181C722
                                    Function 053E4349 Relevance: .0, Instructions: 10COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: eecae64ed0980e3f03148d52a9f397d07e49ed5678347e38a0bf759f4c5501eb
                                    • Instruction ID: 91f9e50dbf39a20326d79551e65c537d0c649dd77ac1829f2ebdab76bf04055f
                                    • Opcode Fuzzy Hash: eecae64ed0980e3f03148d52a9f397d07e49ed5678347e38a0bf759f4c5501eb
                                    • Instruction Fuzzy Hash: 89C04C717100204B8548D56CA690459E7929FD9614329C46A9919C7355CA32DC538B81
                                    Function 053E2E50 Relevance: .0, Instructions: 10COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a3f5a693f67e5b0dccbd3e3ef71b51225ddcae0e072cf7841f696fa69e571f9a
                                    • Instruction ID: d0dae4a79032e569313d2e0527f9257df1884b0db30c8218bf37348cce70362e
                                    • Opcode Fuzzy Hash: a3f5a693f67e5b0dccbd3e3ef71b51225ddcae0e072cf7841f696fa69e571f9a
                                    • Instruction Fuzzy Hash: 72C012AA1092804FC7028B209864680BF309F6A10834A80E7D8948B39BCA2A8A07C726
                                    Function 05401C0F Relevance: .0, Instructions: 10COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 5eb48ad11fdd2656cc3b53ba98e342f1c7a78414d8af986c41f5cfa17ab32903
                                    • Instruction ID: 9be43a9842af3d1a9531da59cd9131da7fc28f7334ed0363512210138923c280
                                    • Opcode Fuzzy Hash: 5eb48ad11fdd2656cc3b53ba98e342f1c7a78414d8af986c41f5cfa17ab32903
                                    • Instruction Fuzzy Hash: 4DB0922261282287DE14CA20B88FBD43B269780252F09CB31A50284240EA16C4068951
                                    Function 00B719E1 Relevance: .0, Instructions: 10COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 75916a1832f015f2b17f18edb2fc0c43cdf1f85e39fc87be8164d8434600ef38
                                    • Instruction ID: 4da2d8e4950452965d5d2bfacf1bb502e616e6e86c480ba68e3a75ceceaa1164
                                    • Opcode Fuzzy Hash: 75916a1832f015f2b17f18edb2fc0c43cdf1f85e39fc87be8164d8434600ef38
                                    • Instruction Fuzzy Hash: E3D012301041805BC344DBACC66A615FFB2AF82208B1CC4ECCC598F24BD627DD03CB40
                                    Function 054000F6 Relevance: .0, Instructions: 9COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 58854b83ba2351cb1a660c4075858a57f78f2cd862954914f5af68e2da21e8ff
                                    • Instruction ID: 403ecac4fdbe4460d0d1852e2785d5edcbb292f69de58b487bf7d01f3ef66545
                                    • Opcode Fuzzy Hash: 58854b83ba2351cb1a660c4075858a57f78f2cd862954914f5af68e2da21e8ff
                                    • Instruction Fuzzy Hash: 06C04C36A100098B8F04DBC4F4455DCF771EB84226B104162D61552510CA312957CB40
                                    Function 00B7D510 Relevance: .0, Instructions: 9COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2203597653.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_b70000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 13882fb518e4155232f5fdc7810c1dc36479b9fbca8a21c0cf040961b5173fec
                                    • Instruction ID: 2cfcfa3b09524e4bac247a86e965c86fead321cec806f0c038b5450e32c53155
                                    • Opcode Fuzzy Hash: 13882fb518e4155232f5fdc7810c1dc36479b9fbca8a21c0cf040961b5173fec
                                    • Instruction Fuzzy Hash: 58B0927090930CAF8620DB99980185ABBACDA0A210F0001D9FA0887320E972A9105AE1
                                    Function 053E4F90 Relevance: .0, Instructions: 7COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a06859d09b36ed3dbea8e0db3857e252515cf563ae91bdbeb94d96f933ef53bb
                                    • Instruction ID: a89bc6f3d12a4fa212b4d9c1b74c42975a1536ce7de4415997f421f0f53fc037
                                    • Opcode Fuzzy Hash: a06859d09b36ed3dbea8e0db3857e252515cf563ae91bdbeb94d96f933ef53bb
                                    • Instruction Fuzzy Hash: 8FB0123101430F8FC7817B99F8065047B2CD540314B408650B10C89A05DD6568424BEC
                                    Function 05401DB0 Relevance: .0, Instructions: 7COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 4c2fc4b5efc4ce673df083f42f2b15179b1b8434dd48bbbac519bd585a3cf27d
                                    • Instruction ID: 560ecf923cb7d33fcca5afe10e7cc142be25a063f5690a36143bd2398dd814ba
                                    • Opcode Fuzzy Hash: 4c2fc4b5efc4ce673df083f42f2b15179b1b8434dd48bbbac519bd585a3cf27d
                                    • Instruction Fuzzy Hash: C3C09B7151810457C700DB11DE8775B7734EB50304F61D064B90C5E355C771CC26DB99
                                    Function 054081D9 Relevance: .0, Instructions: 6COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 094a3c7f43b62b0b73fcc7e0b895763d2421ae60a59ec518b5bf4951f2cc3886
                                    • Instruction ID: ef5522de941a4f46d6caae7b834ea9b5cc0dc85ed07c9ef544cb96afd62105f0
                                    • Opcode Fuzzy Hash: 094a3c7f43b62b0b73fcc7e0b895763d2421ae60a59ec518b5bf4951f2cc3886
                                    • Instruction Fuzzy Hash: 86B0123E601300CFE3C46670C0511C87776EA571043E840ACC4048D280D73BD403DB01
                                    Function 053E2E60 Relevance: .0, Instructions: 5COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 90914831e188827bec8fb6699bd0399d0e9162b9d4fb3fdc093ca0e1bd9b8edc
                                    • Instruction ID: e413b76829ce511345703c63ff0569b35dd3d5bbca212faf01176842e92940fb
                                    • Opcode Fuzzy Hash: 90914831e188827bec8fb6699bd0399d0e9162b9d4fb3fdc093ca0e1bd9b8edc
                                    • Instruction Fuzzy Hash: 3BB011302000008B8288CA08C880808F3A2ABE8308328C0AEA808CB20ACF33E803CA08

                                    Non-executed Functions

                                    Function 0540039B Relevance: .5, Instructions: 549COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215228240.0000000005400000.00000040.00000800.00020000.00000000.sdmp, Offset: 05400000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_5400000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0827233d9898113b2165f95b36a0cdf34c7d657741923a6749c7c8d9b2f2e646
                                    • Instruction ID: 51d53453457319437c9e4107653838181f7385bcf8df70c38e5d0ee31aafd9fb
                                    • Opcode Fuzzy Hash: 0827233d9898113b2165f95b36a0cdf34c7d657741923a6749c7c8d9b2f2e646
                                    • Instruction Fuzzy Hash: C5221934B01214CFDB19DB38C958BADB7F2AF89215F6484A9D50A9B3A1DB35DD82CF40
                                    Function 053E60C0 Relevance: .4, Instructions: 376COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.2215107989.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_53e0000_SSA-Statement283482.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: aa1855dd2fc5aaabfc58babd550069090ccf0f1ab639d299c1092f857f95c798
                                    • Instruction ID: 87dcddb06abdc5f88f1299cc48c19e4a7f9df11c248db415969857488e20a641
                                    • Opcode Fuzzy Hash: aa1855dd2fc5aaabfc58babd550069090ccf0f1ab639d299c1092f857f95c798
                                    • Instruction Fuzzy Hash: EAE15E31E1065ADFCF01DFA8D8405DEFBB2FF99310B15865AE415BB250EB70A986CB90

                                    Executed Functions

                                    Function 06FD29A0 Relevance: 1.4, Strings: 1, Instructions: 163COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: W
                                    • API String ID: 0-655174618
                                    • Opcode ID: 6d569a716a9a4b3cc600690d7f1b820f1716ee51cbc18459054b5b585aecd3dd
                                    • Instruction ID: 1936239d9fd9a8eebc2ff3aad98c4be3d0e6ace90781c78018ed6994e8fff5de
                                    • Opcode Fuzzy Hash: 6d569a716a9a4b3cc600690d7f1b820f1716ee51cbc18459054b5b585aecd3dd
                                    • Instruction Fuzzy Hash: 5A51AE75B042018FD746DF39C89066ABBF2EF8921070985AAE945DF396DF34ED02CB91
                                    Function 06FD28B4 Relevance: 1.4, Strings: 1, Instructions: 153COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: k
                                    • API String ID: 0-140662621
                                    • Opcode ID: 8a963a58348b72613610709b5f9a4aecfc82a5f3adb120174dc1e2529256da56
                                    • Instruction ID: b7beb8afaa08fa82f8615060285aea83111a692b534eced352033ecf2e922e97
                                    • Opcode Fuzzy Hash: 8a963a58348b72613610709b5f9a4aecfc82a5f3adb120174dc1e2529256da56
                                    • Instruction Fuzzy Hash: 32412531B042509FEB559B789C6077E7BA7EFC9200F08446AE506DB395DE34EE0683D1
                                    Function 06FD6508 Relevance: .2, Instructions: 237COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 5bfcd37b4e28e21841af9c24e8bb153ce374e1140af2eab940016c5e96db5ba9
                                    • Instruction ID: 88242bf576b60d83acd07aafd10f398445b4be60644e959bc9149aa3affce323
                                    • Opcode Fuzzy Hash: 5bfcd37b4e28e21841af9c24e8bb153ce374e1140af2eab940016c5e96db5ba9
                                    • Instruction Fuzzy Hash: 9081AC30F112199FDB249F65D858BAEBBB3AF89740F188569E406DB281DF74AC44CB81
                                    Function 06FD29C8 Relevance: .2, Instructions: 228COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 15f99395eb9c0029462ba4dd3fa49355e8ff73c73d55e13049aea0771de848a8
                                    • Instruction ID: 753b56f8b8c51c0f3add48c00428bb7122f4ce5e6a4b327c4cfb54a3604f3186
                                    • Opcode Fuzzy Hash: 15f99395eb9c0029462ba4dd3fa49355e8ff73c73d55e13049aea0771de848a8
                                    • Instruction Fuzzy Hash: 99918D35A10606CFCB44EF69D8905ADB7B2FF89310B148669E909AB354EF74FD81CB90
                                    Function 06FD1080 Relevance: .2, Instructions: 212COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ce8ab18a8642bd89d3927b0b90c98a852f1e17d0c8e1c002dd12b421543911f6
                                    • Instruction ID: 66844b710b395f7699c0d8376f3c46081f31fa27be05080db4c5cfe764988009
                                    • Opcode Fuzzy Hash: ce8ab18a8642bd89d3927b0b90c98a852f1e17d0c8e1c002dd12b421543911f6
                                    • Instruction Fuzzy Hash: D1718235B00214DFEB54EBB5C854A6EBBA7EFC8210F188129E506EB394DE75FC428791
                                    Function 06FD6F08 Relevance: .2, Instructions: 180COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 7b99159c934d16d8aed7a887e40d5b795ceeb875b223a6448c29082ad7e4c039
                                    • Instruction ID: f0dcc29b508e405daed62cd8b31b51cb7c3a9ef66d9e4341e4cc3e1b332835d8
                                    • Opcode Fuzzy Hash: 7b99159c934d16d8aed7a887e40d5b795ceeb875b223a6448c29082ad7e4c039
                                    • Instruction Fuzzy Hash: 8161E731D053869FDB02DFB8D8646D9BFB1EF86300F1581DAD140AB292DB34A889CB90
                                    Function 06FD62C8 Relevance: .2, Instructions: 166COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 8602b81d5990671a751831dc6024aae4fe85bc6aed74f02c7bff7450559c2b74
                                    • Instruction ID: f886af64a552cdfa3e24fb35c826e7627e156812cca88847b5d01c942498a0c7
                                    • Opcode Fuzzy Hash: 8602b81d5990671a751831dc6024aae4fe85bc6aed74f02c7bff7450559c2b74
                                    • Instruction Fuzzy Hash: FB519E35A092949FCB02DF6CD8A04D9BFF1EF8A210B1940DBE580DB362D634EC45CBA5
                                    Function 06FD0C1C Relevance: .2, Instructions: 158COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a0e45bed9bbbe52804b3786f765068e07f8fe542e1b54a7894028b3f195084fe
                                    • Instruction ID: e11365f0ba62722c3f077f091530f2646714a5191bf347f7971320fc9aa59a49
                                    • Opcode Fuzzy Hash: a0e45bed9bbbe52804b3786f765068e07f8fe542e1b54a7894028b3f195084fe
                                    • Instruction Fuzzy Hash: 6C51CF31B04254AFEB54DB68D8947AE7BB3EF8D310F18406AE406E7385CE786C05C7A1
                                    Function 06FD1630 Relevance: .2, Instructions: 157COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: c6b7c27b820f42a580b955e6fcd22cd543f495e58027971f93c0a8ba30577214
                                    • Instruction ID: a94fee5f36db5b0052738b34e8afd8a745bafbd090eca000c06dcf59c6b069e8
                                    • Opcode Fuzzy Hash: c6b7c27b820f42a580b955e6fcd22cd543f495e58027971f93c0a8ba30577214
                                    • Instruction Fuzzy Hash: D451C135B002499FD755DFB8D8506AEBBF7AFC9250B18817AE914D7360DA30AD02CBA1
                                    Function 06FD6F78 Relevance: .1, Instructions: 137COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 85f3cb8424479ab61c6c6e5fa2a40fa406060d996bac30b20d4da6b765760f80
                                    • Instruction ID: d817f3ab132c0509ae16f404267d342d0c7684df39af070d4a52055cc11c86f2
                                    • Opcode Fuzzy Hash: 85f3cb8424479ab61c6c6e5fa2a40fa406060d996bac30b20d4da6b765760f80
                                    • Instruction Fuzzy Hash: C9516D30E1024ADFDB01DFB8D854B9DBBB2FF89300F108659E114AB391EB75A985CB90
                                    Function 06FD2268 Relevance: .1, Instructions: 106COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e64a24d63cfc40f32d911b494b152002f82032361a37ef007c35732c627367dd
                                    • Instruction ID: 2eb583cb0d3c353f22ac2f69515b2374c0eeee02d24a1ed73e1438ed94c1f18e
                                    • Opcode Fuzzy Hash: e64a24d63cfc40f32d911b494b152002f82032361a37ef007c35732c627367dd
                                    • Instruction Fuzzy Hash: 5241E876B102149FCB54DF68D98099EBBB2FF8C710B14816AE905EB360DB31ED41CB90
                                    Function 06FD6380 Relevance: .1, Instructions: 105COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a183b4de0878e745352cd4a68d1468c2c41d66a01e15e03d96288d6d018d75a7
                                    • Instruction ID: c098b754c1dffacedbdf1b043cd4b2597575052379f837616bd300f257b94f0d
                                    • Opcode Fuzzy Hash: a183b4de0878e745352cd4a68d1468c2c41d66a01e15e03d96288d6d018d75a7
                                    • Instruction Fuzzy Hash: D041E579A11218DFCB44DFA9E89499DBBF6FF89310F15806AE805E7325DB30AC41CB90
                                    Function 06FD50BF Relevance: .1, Instructions: 104COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 4adcd1a992da402ac39088e505313ae84050b01b11a88b761ff213ba3abe5d39
                                    • Instruction ID: acf61366d63fa6031c39f14d438f6e360cafdd026a54ad45c86f48834b547e2d
                                    • Opcode Fuzzy Hash: 4adcd1a992da402ac39088e505313ae84050b01b11a88b761ff213ba3abe5d39
                                    • Instruction Fuzzy Hash: 5A31A035E10218DFEB249F65D8547AEBBF3AF88345F18802AD811AB395DF75AC41CB90
                                    Function 06FD50D0 Relevance: .1, Instructions: 98COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: f21ae49ae7402488f46c3a1d95d7175b7d9f8851ae69be9d1210b23d89a07ca6
                                    • Instruction ID: 821abace883550fec7305d05f69faff25a480fc8c35738cc3adba46c1ac480b8
                                    • Opcode Fuzzy Hash: f21ae49ae7402488f46c3a1d95d7175b7d9f8851ae69be9d1210b23d89a07ca6
                                    • Instruction Fuzzy Hash: 29318F34E10208DFEB249F65D8547AEBBF7AF88304F188129D811AB395DF75AC41CB90
                                    Function 06FD2D60 Relevance: .1, Instructions: 93COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 4cc81f05ed0349e97bcd4fbe1f1b5ff68a56b95b81a90f780f28c3809893b581
                                    • Instruction ID: 06b558160a3b685ab0be18730901f5a2128251caab0946018ae97086ea1f67b4
                                    • Opcode Fuzzy Hash: 4cc81f05ed0349e97bcd4fbe1f1b5ff68a56b95b81a90f780f28c3809893b581
                                    • Instruction Fuzzy Hash: AA21DD31B002555FDB989A389C907BF7BB7EF85201F18406AE506C7294EA34AA0583E0
                                    Function 06FD63A0 Relevance: .1, Instructions: 91COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a3c07c34f35583d65db80f0af52118e649b888a2d4d640444f7837c3ecd045ab
                                    • Instruction ID: 8065a02e473a41f3619ac8edbae911e0bf0a16870a8e0b4d4ff52afc4ed2f780
                                    • Opcode Fuzzy Hash: a3c07c34f35583d65db80f0af52118e649b888a2d4d640444f7837c3ecd045ab
                                    • Instruction Fuzzy Hash: A331A278A011189FCB44DFA9D49499DBBFAFF89210B158169E905E7325DB30AC41CB90
                                    Function 06FD28C4 Relevance: .1, Instructions: 88COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 203228e2b9e253eb3f052e18bc0b88b50d4819456e4e8b770c3d27eaf13e7f9e
                                    • Instruction ID: 9c0dc03a22af0c1b055a1456cede0ed3b5661d6919b73304407c41a927aa0d4c
                                    • Opcode Fuzzy Hash: 203228e2b9e253eb3f052e18bc0b88b50d4819456e4e8b770c3d27eaf13e7f9e
                                    • Instruction Fuzzy Hash: C3210631B043109FE755AAA598943BE7F97EFC5250F18806AE809C72C1DE78AC01C3A1
                                    Function 06FD28E4 Relevance: .1, Instructions: 86COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ecc356c48fc91706cb54235adc06a286719c5322faeb217d91974241f7c4b474
                                    • Instruction ID: 1554406b542d30a24aa679b8e912a3900b67b504d525d2587ea600d14806f9ad
                                    • Opcode Fuzzy Hash: ecc356c48fc91706cb54235adc06a286719c5322faeb217d91974241f7c4b474
                                    • Instruction Fuzzy Hash: 89214932E05364AFDB5227646C147BA7F56DF42120F1C80ABEF4CDA192D934A985D3E1
                                    Function 06FD1064 Relevance: .1, Instructions: 83COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 1fbdca511c27bf55c0383c4d056983b2d9180ba9d322c0bd0a56a331e717c98e
                                    • Instruction ID: 8ce90dad7a2ed15cae82e612164471dfd96173ed40f66d362540c69559dd04dc
                                    • Opcode Fuzzy Hash: 1fbdca511c27bf55c0383c4d056983b2d9180ba9d322c0bd0a56a331e717c98e
                                    • Instruction Fuzzy Hash: 1F210D32F012549BDB10DB65C8946AE7FEFDFC8240F08416AD906D7281DA74FD0687A1
                                    Function 06FD8A30 Relevance: .1, Instructions: 81COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ab626b1e4adda4ab6bee2d5006276fb517a22c52914a10fc0fa125a618416730
                                    • Instruction ID: a8e5d90008ae7f169086eee7acd3940c565c32f1e0eb240f8aa565ed7a530618
                                    • Opcode Fuzzy Hash: ab626b1e4adda4ab6bee2d5006276fb517a22c52914a10fc0fa125a618416730
                                    • Instruction Fuzzy Hash: 65219630F01209AFEB54DF65D8997AEBBB3AF88740F249029E412A7380DF746D01CB51
                                    Function 06FD9360 Relevance: .1, Instructions: 80COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ea3049abac32ea3bbd3a2cd78b9cda23dca9a190d5dd60fdd2851f9def0b1b55
                                    • Instruction ID: bc79652d7f7aa7b2b51c64156cad2ab7aa5bd6737b67ef0fed3c9162c8845518
                                    • Opcode Fuzzy Hash: ea3049abac32ea3bbd3a2cd78b9cda23dca9a190d5dd60fdd2851f9def0b1b55
                                    • Instruction Fuzzy Hash: D5212631B093518FD7559B71889036E7FA7AF85110F1C806BD819C72D2DE78AD06C3A1
                                    Function 06FD8A40 Relevance: .1, Instructions: 78COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: d0e5e012de098b84b365a4a62bcfa2980fc4b6cc9ebcc8c37c2aa982cbd6b29b
                                    • Instruction ID: f14f83b2b45975c5bf374ea04cd5a359f8ed548b3e1b58d92a59bd9fef3e884d
                                    • Opcode Fuzzy Hash: d0e5e012de098b84b365a4a62bcfa2980fc4b6cc9ebcc8c37c2aa982cbd6b29b
                                    • Instruction Fuzzy Hash: 94219670F01208AFEB44DF65D8997AEBBB3AF88740F149029E512A7384DF746D01CB91
                                    Function 06FD3070 Relevance: .1, Instructions: 70COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b217514861f9ffe06ae98a62dc89f4ff7e44c864fcb9c0ad57bf25301ae157aa
                                    • Instruction ID: 46fad6b9a8df30419d2384a0632a11415bdfb9d500a0eb986292783867ed89a6
                                    • Opcode Fuzzy Hash: b217514861f9ffe06ae98a62dc89f4ff7e44c864fcb9c0ad57bf25301ae157aa
                                    • Instruction Fuzzy Hash: 86217F35F00115AFCB54DB64DC94AAA7BB3EF8D314F18801AD905A7390DE75BC46CBA1
                                    Function 06FD28D4 Relevance: .1, Instructions: 69COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 6b2a7ed9c98771ed911dc013923afbce2c14f88ca0f10ca894d69b8e6ec12653
                                    • Instruction ID: 862c362c958f43486d6edb3b5351f43e0b7da49aa6e7041eef771ca125d7cef5
                                    • Opcode Fuzzy Hash: 6b2a7ed9c98771ed911dc013923afbce2c14f88ca0f10ca894d69b8e6ec12653
                                    • Instruction Fuzzy Hash: 75110A11F193601BEB6527345C503BA7B9BCF86214F0D48EBDA05CB682CCB5BD0613E2
                                    Function 06FD2878 Relevance: .1, Instructions: 69COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 648f5e279f3580b1e2f07c67fff3b99bad8c8bd4643be75a1c0245c7736e6e57
                                    • Instruction ID: 204392284ea21cb4600eaac4f89c678cd9a474f056ad4e54f4107e5cfa1b29d2
                                    • Opcode Fuzzy Hash: 648f5e279f3580b1e2f07c67fff3b99bad8c8bd4643be75a1c0245c7736e6e57
                                    • Instruction Fuzzy Hash: 87112B62D0E3A05FD7026B295CF15997FAA9EC2210B0E40DBD588CB1D3E9149849C3EA
                                    Function 06FD2258 Relevance: .1, Instructions: 66COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 5572e2785d46c001eb17d0617150f16acfb12c3489ed81d6b58c0ec7cb6bced3
                                    • Instruction ID: 740f3541054f4c3fb9c6db2fc689cd5fe619fec71cc4d0fe616c747e7f6c50ba
                                    • Opcode Fuzzy Hash: 5572e2785d46c001eb17d0617150f16acfb12c3489ed81d6b58c0ec7cb6bced3
                                    • Instruction Fuzzy Hash: A7215C75E101149FCB44DF69D8849DEBBB2FF8C710F10812AE805EB320EB30A941CBA0
                                    Function 06FD9463 Relevance: .1, Instructions: 62COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 38b3b7df2be0883a0d3283653776bf199e0e6cfd6b6aaa660e3815fafa2ae254
                                    • Instruction ID: 47403d44e2745b1fff1cf0ba34e1c0b4ca23383e84132c0e51961842a5e92279
                                    • Opcode Fuzzy Hash: 38b3b7df2be0883a0d3283653776bf199e0e6cfd6b6aaa660e3815fafa2ae254
                                    • Instruction Fuzzy Hash: 1C213B30B00114AFDB94EF64D891AA97BA3EF8C311F14442AD819A73C0DF787C468BA0
                                    Function 06FD1958 Relevance: .1, Instructions: 61COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 8301aea536811a59941ca5495fd18ac0b0e0ecf6ac7ea475f033f4862d10c5e1
                                    • Instruction ID: b5b9a329904db639cf4bfa214678e4425ed733b08805c4ca429102a75122a03a
                                    • Opcode Fuzzy Hash: 8301aea536811a59941ca5495fd18ac0b0e0ecf6ac7ea475f033f4862d10c5e1
                                    • Instruction Fuzzy Hash: 56114F75600165BFDB14CF68D894AA97FB6FF8C321F14401AE40AE7384CB796C46CBA1
                                    Function 06FD3080 Relevance: .1, Instructions: 59COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: bb579a7b996ddb735d971cc90d46f0fc59eac78aaa8eac1aa2920a06f54f58b8
                                    • Instruction ID: 833d225fd210278a57cb1d33a7e4dd0238410499413f1956abd3ac58cda66092
                                    • Opcode Fuzzy Hash: bb579a7b996ddb735d971cc90d46f0fc59eac78aaa8eac1aa2920a06f54f58b8
                                    • Instruction Fuzzy Hash: B9113D35B00115AFDB54DF65DC90AAA7BB7EF8C310F148029E409A7390DE79BC468BA0
                                    Function 06FD9470 Relevance: .1, Instructions: 57COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 98dec0b82259318583b94dc353b6b4bdba8562d972dee5be8eaccbeec40dcc83
                                    • Instruction ID: 42c3c869400a16c92e8d4bd5bec0d572c0f2e64c544026df35bc68968c88343d
                                    • Opcode Fuzzy Hash: 98dec0b82259318583b94dc353b6b4bdba8562d972dee5be8eaccbeec40dcc83
                                    • Instruction Fuzzy Hash: 6F110D34B00114AFDB94EF64D891AA97BA7EF8C311F14442AD419A73C0DF79BC468BA0
                                    Function 06FD1378 Relevance: .1, Instructions: 56COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 3f390b3c1862541a852224a81f3d90089e2083b024aa24033c42f123f4c34974
                                    • Instruction ID: 4537aaa7587307513184c782983093004a4b3ee351e15a91d227813106461569
                                    • Opcode Fuzzy Hash: 3f390b3c1862541a852224a81f3d90089e2083b024aa24033c42f123f4c34974
                                    • Instruction Fuzzy Hash: D3211571D042498FDB20DFAAC985AEEFBB0FF88324F148529D91967240C7356905CFA1
                                    Function 06FD2CD0 Relevance: .1, Instructions: 55COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: d9d3370e9b7763a406aac7575a0dc6d0dc0438bd5fdae1c97f86cc5810e9d652
                                    • Instruction ID: 5750cdcf48df3e9f9cbaf9bf96aa939459b3a6cad89cb52742ea94e5c13ec4d0
                                    • Opcode Fuzzy Hash: d9d3370e9b7763a406aac7575a0dc6d0dc0438bd5fdae1c97f86cc5810e9d652
                                    • Instruction Fuzzy Hash: B601A132F001188BDF549AA8DC102EEB7F7EF88315F08817AC605B7254DB39AA45CBE0
                                    Function 06FD8058 Relevance: .1, Instructions: 53COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e84df452a2c02574744e24c94de910f0aa45d2037c76dc3089ea2c3710c48c6b
                                    • Instruction ID: ea495497284fa8e0e0c75ce96c722c3d94f6531b08c332d67050980d8c88b763
                                    • Opcode Fuzzy Hash: e84df452a2c02574744e24c94de910f0aa45d2037c76dc3089ea2c3710c48c6b
                                    • Instruction Fuzzy Hash: CC018F7A3111109F8748DA6EF89486EF7AAFBC86A0325803AE505C7350CE32EC128794
                                    Function 06FD1380 Relevance: .1, Instructions: 53COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 8ceaa8419c5d5b9282fb3516cd29e3f53199e35823509f4f103f71ac9396eaac
                                    • Instruction ID: 9228b602baaf97698118b9d6604323b09249006f415e46ed5687840edbda66a2
                                    • Opcode Fuzzy Hash: 8ceaa8419c5d5b9282fb3516cd29e3f53199e35823509f4f103f71ac9396eaac
                                    • Instruction Fuzzy Hash: 4A11F475D042498FEB10DFAAC881ADEFBF4FF88324F148419D51967240CB756945CFA5
                                    Function 06FD2CC2 Relevance: .1, Instructions: 52COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 16a68531c232130df0e9e18fe4f0630e0031598f77fbd55bf743dabcd5e08cf9
                                    • Instruction ID: f39e4d49dec7f7a9f53702705212224f8629a609af8cc1e56b8daf263db3c835
                                    • Opcode Fuzzy Hash: 16a68531c232130df0e9e18fe4f0630e0031598f77fbd55bf743dabcd5e08cf9
                                    • Instruction Fuzzy Hash: 1001F536F001548BDF589A64CD107EEBBF3AF88310F08806AC505BB254DB35AA85CBE1
                                    Function 06FD1440 Relevance: .1, Instructions: 51COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 37617ec681616589bd01571eb9f1d77929a51cb735a68c95e4ed276aa2cd830d
                                    • Instruction ID: b8c6ca0af2273a9c4e02846d012dcfb09284eb3d709d39ec3e856d25770df0a5
                                    • Opcode Fuzzy Hash: 37617ec681616589bd01571eb9f1d77929a51cb735a68c95e4ed276aa2cd830d
                                    • Instruction Fuzzy Hash: 7401D830F163456FC719DFB498715363F9AEDC710431909ABD905CF251E924A80583E1
                                    Function 06FD1968 Relevance: .1, Instructions: 51COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 622804de2b602102022598a40c62ee57482f8586fa9d812bec4e3c9960d33164
                                    • Instruction ID: 4bdb5aaa77878b3bf6a1b3c31e04a847435eb089790e60234321e3d51dd66991
                                    • Opcode Fuzzy Hash: 622804de2b602102022598a40c62ee57482f8586fa9d812bec4e3c9960d33164
                                    • Instruction Fuzzy Hash: D5110075600125AFDB14DF68D494AA97BB6FF8C311F14401AE509E7384DF79BC45CBA0
                                    Function 06FD1829 Relevance: .0, Instructions: 49COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e7d4acb6c4c2bb98bfa007b221d1bb619c87d704015efd49e797ccff70ddb094
                                    • Instruction ID: 45a452f483a8e51d9c4a24d53951da3e51a96a759da7cd41ccd8d7c3bed909b0
                                    • Opcode Fuzzy Hash: e7d4acb6c4c2bb98bfa007b221d1bb619c87d704015efd49e797ccff70ddb094
                                    • Instruction Fuzzy Hash: 3F01F931E0410497E764EA689D59BEF79EB9BC8300F18415DE401B3380CE716D00C7F2
                                    Function 06FD6A21 Relevance: .0, Instructions: 47COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 6b4220ff97095f6d648ee83d045df193e32aa804df37d42a2f71c7ffda34b8f0
                                    • Instruction ID: c89f487bb14cb4ae6386a270a2f1cb7d006f5e7db5e23760ab3f927b5dd90d97
                                    • Opcode Fuzzy Hash: 6b4220ff97095f6d648ee83d045df193e32aa804df37d42a2f71c7ffda34b8f0
                                    • Instruction Fuzzy Hash: 8A019231B001559BDB98AB6989587AFBAE7AFC8204F28846ED405FB390CE755D058BC1
                                    Function 06FD6B0C Relevance: .0, Instructions: 46COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 854f8ef85d2a12110ac97fe17113d0f933943e039750428f7aa5cd19e35d18a7
                                    • Instruction ID: dbf5da001b73a6f18af44ca99fbff4eba42aeee46cf61b8dbee6280d32051274
                                    • Opcode Fuzzy Hash: 854f8ef85d2a12110ac97fe17113d0f933943e039750428f7aa5cd19e35d18a7
                                    • Instruction Fuzzy Hash: B7F04433F042209BEBD596E09C103BD7353DB81304F4C816AE248DA6D1DA26B4038380
                                    Function 06FD6A30 Relevance: .0, Instructions: 45COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 866cde6b2b461621a2e3b9a4ed3c761f53eb25729b106fb606922b175646be69
                                    • Instruction ID: 35ecdb843b1dfe26414b2de378579ab82f0cb63608c449fbcb44c0d9e6c2dcab
                                    • Opcode Fuzzy Hash: 866cde6b2b461621a2e3b9a4ed3c761f53eb25729b106fb606922b175646be69
                                    • Instruction Fuzzy Hash: D7018431B0011497DB98AA69C8547AF7AE79FC8344F18846DD505E7390CE756D0587D1
                                    Function 048ED01D Relevance: .0, Instructions: 45COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000002.2216246844.00000000048ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 048ED000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_2_48ed000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 12a7142d6ab04fc6e953f2e60e10ca4a52ffa07bc3569aafdbe3b847c8622d3c
                                    • Instruction ID: cf7a1581c13cf3117ae1c2bd607408288a086561cc8fb8f29eec58ca68935790
                                    • Opcode Fuzzy Hash: 12a7142d6ab04fc6e953f2e60e10ca4a52ffa07bc3569aafdbe3b847c8622d3c
                                    • Instruction Fuzzy Hash: D301F731508306DAE710AE26ED84B77BFC8EF42324F1CCA1ADD188E142D279E44AC6B1
                                    Function 048ED006 Relevance: .0, Instructions: 44COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000002.2216246844.00000000048ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 048ED000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_2_48ed000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 401d4381624f679c20e54659a8e9e8b2691fd2260f86bc91a84067ed5d004142
                                    • Instruction ID: 1317207adea3601f04ea44429e309c035161547b03849e9868b29bff66b0915e
                                    • Opcode Fuzzy Hash: 401d4381624f679c20e54659a8e9e8b2691fd2260f86bc91a84067ed5d004142
                                    • Instruction Fuzzy Hash: 7D014C6100E3C09EE7128B25D894B62BFB4EF53224F1D85CBD9888F1A3C2699848C772
                                    Function 06FD7FD0 Relevance: .0, Instructions: 41COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 56e12f428c37e90390f185d33683f819efcc3b49987173b5a65f41d91f63ac65
                                    • Instruction ID: 839335324283402030e99add2e202f9c3efd376ad4ec1971e9004d815bdd98fd
                                    • Opcode Fuzzy Hash: 56e12f428c37e90390f185d33683f819efcc3b49987173b5a65f41d91f63ac65
                                    • Instruction Fuzzy Hash: 6AF0F6317013429FC312A66DE851457BFE6DFD5264304856AE54ACB311DFB5EC0587D0
                                    Function 06FD1431 Relevance: .0, Instructions: 36COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a1c52077f7a8be3d09cf409e65e26e8bd989c9ef3f7869156cba9d035b7f03bd
                                    • Instruction ID: a5f8445f1ec53d080d3006d24092bb527345d83e1c9af12d960a25c6d0457b8a
                                    • Opcode Fuzzy Hash: a1c52077f7a8be3d09cf409e65e26e8bd989c9ef3f7869156cba9d035b7f03bd
                                    • Instruction Fuzzy Hash: 33F0F670F02252AFC708DFB5D4A153A3F96F9C6214308086FC501CF290EA24A805C3E1
                                    Function 06FD804B Relevance: .0, Instructions: 35COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 4d1b0293ac7db5ee6781e654100d7bf371a25d546d2fba79a5259823e2d0725a
                                    • Instruction ID: 087f28841ca6a9a1ef34a6afe7c62c29bdfccdb9d17b6edb56473bbba6d92ad5
                                    • Opcode Fuzzy Hash: 4d1b0293ac7db5ee6781e654100d7bf371a25d546d2fba79a5259823e2d0725a
                                    • Instruction Fuzzy Hash: 33F0A07370A3516BC312465EFC04983FFAAEBC52B5B188167F249C3211CAB5A80187E0
                                    Function 06FD7FE0 Relevance: .0, Instructions: 34COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 49a0ee01795d5bcc06e06ab7b0b68676e05b0a43bf64471bea0c880d394233e9
                                    • Instruction ID: a6b228e6a2278a4260f0830941c3dd85426298b174c861acb9dcca840d414150
                                    • Opcode Fuzzy Hash: 49a0ee01795d5bcc06e06ab7b0b68676e05b0a43bf64471bea0c880d394233e9
                                    • Instruction Fuzzy Hash: BDF0A7717002016B8321E65EE84595BBFDBDFD56A4744C62AE60ACB301DFB1FC0147D0
                                    Function 06FD2EF8 Relevance: .0, Instructions: 32COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b31d1ceba0056f7c6cf590f8d401bae4c4544a8b6cf730b2ec207904930b6f44
                                    • Instruction ID: 665e39a93f364df481221f8d2eceea5bebc3426592453c1d5f36603580c31af1
                                    • Opcode Fuzzy Hash: b31d1ceba0056f7c6cf590f8d401bae4c4544a8b6cf730b2ec207904930b6f44
                                    • Instruction Fuzzy Hash: 83F0A021F286941BEBAA16648C003E67F9A4B52614F0804ABEA8587793D5E5EE0753E2
                                    Function 06FD5278 Relevance: .0, Instructions: 32COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 58034cb9c2700b490c93a0c34778629d2ec54b553a3f6ea516f4aeed8096cf60
                                    • Instruction ID: 959fd86de583117d7a882719e692145d0deb632bcbd136880cf23df8ec44235e
                                    • Opcode Fuzzy Hash: 58034cb9c2700b490c93a0c34778629d2ec54b553a3f6ea516f4aeed8096cf60
                                    • Instruction Fuzzy Hash: 17F05572709344AFC3019A2AD8106A2BFAADFD6224F2040BAE048CB252DD36AC02C790
                                    Function 06FD5288 Relevance: .0, Instructions: 25COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ff54acca1163a2ee9b35f38a841ef6707c8304e73e4d2ea168e60354c91d9862
                                    • Instruction ID: 4e0134ae36b2fdba6bdbdd0fb8de1db436364fd4a423f6845affab9d3e774a79
                                    • Opcode Fuzzy Hash: ff54acca1163a2ee9b35f38a841ef6707c8304e73e4d2ea168e60354c91d9862
                                    • Instruction Fuzzy Hash: 72E08C367112049BD314AA6AE850A67F7AEEBC9628B204479E50DC7355CD72AC028790
                                    Function 06FD2959 Relevance: .0, Instructions: 24COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 658ef80c6e5c44c06c92912f9ecc8457fc998a66dcf2dc4d1bcf052f2da539db
                                    • Instruction ID: bc0462cd0282ffd1f77f189f0fa7b8d14f1b343442922fb8888dcf49d767b844
                                    • Opcode Fuzzy Hash: 658ef80c6e5c44c06c92912f9ecc8457fc998a66dcf2dc4d1bcf052f2da539db
                                    • Instruction Fuzzy Hash: 79E0D8F1509289FFC701DBB8D9510BCBFF5DF42100B1146D5D688E3202EA302E16D751
                                    Function 06FD7F68 Relevance: .0, Instructions: 24COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: befc9514f2d5ad863aa5c5252c6e0278c41024b34b253619b5aca8e280c293ca
                                    • Instruction ID: 5f23845134398360867018cab1559eeb03b582bd76d1b3747b9c5fc267fc5c8e
                                    • Opcode Fuzzy Hash: befc9514f2d5ad863aa5c5252c6e0278c41024b34b253619b5aca8e280c293ca
                                    • Instruction Fuzzy Hash: F9E0657050534AAFCB02DBB8D861199BFF4EF02214B219AAAD844E3212EB346E51CB51
                                    Function 06FD17F0 Relevance: .0, Instructions: 20COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ef389a340cfd1be1c09ab43337cee749e76bc1c31031edc8fa70c3ce155c21ab
                                    • Instruction ID: 0985b42fe4a23e045f7084b13be94f61342971556f244486b1d677a2bca47aab
                                    • Opcode Fuzzy Hash: ef389a340cfd1be1c09ab43337cee749e76bc1c31031edc8fa70c3ce155c21ab
                                    • Instruction Fuzzy Hash: 3DD05B372191945FC3065B24AD114D67F769B5922130840A7FC45D77B1CD711E25C7F1
                                    Function 06FD2F80 Relevance: .0, Instructions: 19COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: d6c6da9ed4394d1a63f14bb013c3c6a723967ad60d6fd5e9c64ad5136c1c1f37
                                    • Instruction ID: 676ff59ce16441c29c0d39aad7926a5a23ec1e74cda3220b7feece1808e82489
                                    • Opcode Fuzzy Hash: d6c6da9ed4394d1a63f14bb013c3c6a723967ad60d6fd5e9c64ad5136c1c1f37
                                    • Instruction Fuzzy Hash: B6D09726E093A09BCB01177035602DABF29CF46021F1E80C3CE18DF307DA38AC1243E0
                                    Function 06FD0C0C Relevance: .0, Instructions: 17COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 6683cb2f1cb619258eef43e02fa8e6b5f036e12e37c2cbe09f254c18826d1b8a
                                    • Instruction ID: 3056bf42f3564e1c4a5606228fa5b45249facbf4a091afcd18fa6156f150a8a2
                                    • Opcode Fuzzy Hash: 6683cb2f1cb619258eef43e02fa8e6b5f036e12e37c2cbe09f254c18826d1b8a
                                    • Instruction Fuzzy Hash: 84D0233331401C6F5350AA5CDC858BA7F9AEB94360754443BF90283360CD70BC5283E5
                                    Function 06FD2968 Relevance: .0, Instructions: 16COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 88206a893f8c960f750831ba9f7e1fcf0fcd3941b1f1e53006d2458b4da15498
                                    • Instruction ID: 8c8b848a94985beb4c54254715fea58c0f632d3888c4848ec102690246ecf2e4
                                    • Opcode Fuzzy Hash: 88206a893f8c960f750831ba9f7e1fcf0fcd3941b1f1e53006d2458b4da15498
                                    • Instruction Fuzzy Hash: 93D012F0911109EFCB40EFA8D90156DBBB5DB45204B1146E9D908E3201DA716E049781
                                    Function 06FD7F78 Relevance: .0, Instructions: 16COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: fe672342df83b28b6771fcc57b5c234d75588e86169b802baf920d2e4b1b609e
                                    • Instruction ID: e3c5057d8a318afc1630e4e2dff0d4cc1082efdfd1e78dd808107733da148ac8
                                    • Opcode Fuzzy Hash: fe672342df83b28b6771fcc57b5c234d75588e86169b802baf920d2e4b1b609e
                                    • Instruction Fuzzy Hash: 58D017B0A01209FFCB00EFA8E90156DBBF9EB45204F108AA8D808E3201EE316E409B91
                                    Function 06FD0440 Relevance: .0, Instructions: 15COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000005.00000003.2215430322.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_5_3_6fd0000_rundll32.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: dd82f8d516dfae3b57237bf39f57015cb02b3377b7e1c5d7d9344430ecc398ee
                                    • Instruction ID: abdfeb06720760f9bd91eaa611ae2ce5c281d56c5069ac2159c1de8cc739214a
                                    • Opcode Fuzzy Hash: dd82f8d516dfae3b57237bf39f57015cb02b3377b7e1c5d7d9344430ecc398ee
                                    • Instruction Fuzzy Hash: 21C0127390E7D16FC61245540C848DAAF25A5B310478E43CAD04489012D1096667D2F2

                                    Execution Graph

                                    Execution Coverage:9.9%
                                    Dynamic/Decrypted Code Coverage:100%
                                    Signature Coverage:10.7%
                                    Total number of Nodes:28
                                    Total number of Limit Nodes:1
                                    execution_graph 25070 5662b40 25071 5662b81 25070->25071 25072 5662bf9 RegDisablePredefinedCache 25071->25072 25073 5662bdc 25071->25073 25072->25073 25074 5660380 25075 5660381 25074->25075 25079 56603c4 25075->25079 25083 56603d0 25075->25083 25080 56603c8 CreateFileA 25079->25080 25082 5660505 25080->25082 25085 56603d1 CreateFileA 25083->25085 25086 5660505 25085->25086 25045 3ba0bf0 25048 3ba0c21 25045->25048 25049 3ba0c15 25048->25049 25050 3ba0c59 25048->25050 25053 3ba1268 25050->25053 25054 3ba1283 25053->25054 25058 3ba14f8 25054->25058 25062 3ba14f2 25054->25062 25055 3ba1324 25059 3ba1515 25058->25059 25066 3ba0f48 25059->25066 25063 3ba1515 25062->25063 25064 3ba0f48 CryptProtectData 25063->25064 25065 3ba154d 25064->25065 25065->25055 25067 3ba1738 CryptProtectData 25066->25067 25069 3ba154d 25067->25069 25069->25055

                                    Executed Functions

                                    Function 03BA0F48 Relevance: 1.6, APIs: 1, Instructions: 64encryptionCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 168 3ba0f48-3ba1778 170 3ba177a-3ba177d 168->170 171 3ba1780-3ba17c1 CryptProtectData 168->171 170->171 172 3ba17ca-3ba17f2 171->172 173 3ba17c3-3ba17c9 171->173 173->172
                                    APIs
                                    • CryptProtectData.CRYPT32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 03BA17AE
                                    Memory Dump Source
                                    • Source File: 00000008.00000002.4068995137.0000000003BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 03BA0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_8_2_3ba0000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID: CryptDataProtect
                                    • String ID:
                                    • API String ID: 3091777813-0
                                    • Opcode ID: 4e9a7d321aa191e3316bf98fd4c169ae0ab1061069b9844215c4b90499f2b6a0
                                    • Instruction ID: 9ee35dddcb28888910f3a99d05dd10b23e39f4aae1fb72728c242b2c605d58c3
                                    • Opcode Fuzzy Hash: 4e9a7d321aa191e3316bf98fd4c169ae0ab1061069b9844215c4b90499f2b6a0
                                    • Instruction Fuzzy Hash: 4D2143B680464ADFDF10CF9AC844AEEBBF1FF88314F148569E918A7210C339A551CFA0
                                    Function 03BA1730 Relevance: 1.6, APIs: 1, Instructions: 63encryptionCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 176 3ba1730-3ba1778 177 3ba177a-3ba177d 176->177 178 3ba1780-3ba17c1 CryptProtectData 176->178 177->178 179 3ba17ca-3ba17f2 178->179 180 3ba17c3-3ba17c9 178->180 180->179
                                    APIs
                                    • CryptProtectData.CRYPT32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 03BA17AE
                                    Memory Dump Source
                                    • Source File: 00000008.00000002.4068995137.0000000003BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 03BA0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_8_2_3ba0000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID: CryptDataProtect
                                    • String ID:
                                    • API String ID: 3091777813-0
                                    • Opcode ID: e5bbbd408c6e25f740e03f3f662ca46ac06865965482b67cd07e0baf5cc0279b
                                    • Instruction ID: 592ce5c59b25dbfbcb3d7302f53c6a871b3c642ae71ccbd12ae4cd40b949b763
                                    • Opcode Fuzzy Hash: e5bbbd408c6e25f740e03f3f662ca46ac06865965482b67cd07e0baf5cc0279b
                                    • Instruction Fuzzy Hash: 8C2125B680064ADFDF10CF9AC844ADEBBB1FF88310F14856AE915A7211D739A555CFA0
                                    Function 056603C4 Relevance: 1.6, APIs: 1, Instructions: 123fileCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 23 56603c4-56603c6 24 56603cd 23->24 25 56603c8-56603ca 23->25 28 5660434-5660453 24->28 29 56603cf 24->29 26 56603d1-566042c 25->26 27 56603cc 25->27 30 5660480-5660503 CreateFileA 26->30 31 566042e-5660433 26->31 27->24 28->30 34 5660455-5660457 28->34 29->26 41 5660505-566050b 30->41 42 566050c-566054a 30->42 31->28 35 566047a-566047d 34->35 36 5660459-5660463 34->36 35->30 37 5660467-5660476 36->37 38 5660465 36->38 37->37 40 5660478 37->40 38->37 40->35 41->42 46 566054c-5660550 42->46 47 566055a 42->47 46->47 48 5660552 46->48 49 566055b 47->49 48->47 49->49
                                    APIs
                                    • CreateFileA.KERNEL32(?,?,?,?,?,00000001,00000004), ref: 056604ED
                                    Memory Dump Source
                                    • Source File: 00000008.00000002.4076721320.0000000005660000.00000040.00000800.00020000.00000000.sdmp, Offset: 05660000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_8_2_5660000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID: CreateFile
                                    • String ID:
                                    • API String ID: 823142352-0
                                    • Opcode ID: eab6b3b615a8869dabb3920c9de35bab48a7a94354a44e8fdf6d66aa72e3fe1b
                                    • Instruction ID: 306325d8facd331d4dab29f7e3b98a3ddaec0391d88be0a9d339f27230938b1b
                                    • Opcode Fuzzy Hash: eab6b3b615a8869dabb3920c9de35bab48a7a94354a44e8fdf6d66aa72e3fe1b
                                    • Instruction Fuzzy Hash: 695164B0D04249DFDB10CFA9C988B9EBBF2BF48314F248129E818AB351D7B59845CF91
                                    Function 056603D0 Relevance: 1.6, APIs: 1, Instructions: 116fileCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 50 56603d0-566042c 52 5660480-5660503 CreateFileA 50->52 53 566042e-5660453 50->53 61 5660505-566050b 52->61 62 566050c-566054a 52->62 53->52 58 5660455-5660457 53->58 59 566047a-566047d 58->59 60 5660459-5660463 58->60 59->52 63 5660467-5660476 60->63 64 5660465 60->64 61->62 69 566054c-5660550 62->69 70 566055a 62->70 63->63 65 5660478 63->65 64->63 65->59 69->70 71 5660552 69->71 72 566055b 70->72 71->70 72->72
                                    APIs
                                    • CreateFileA.KERNEL32(?,?,?,?,?,00000001,00000004), ref: 056604ED
                                    Memory Dump Source
                                    • Source File: 00000008.00000002.4076721320.0000000005660000.00000040.00000800.00020000.00000000.sdmp, Offset: 05660000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_8_2_5660000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID: CreateFile
                                    • String ID:
                                    • API String ID: 823142352-0
                                    • Opcode ID: 506fcbeff494aa6687fb7ab47ff6add9a93e3b84381325f8610048c0668038a7
                                    • Instruction ID: 91af6e1a5b67e13a8e709455a5bfec3b70f10289cd8250dac880704286e47359
                                    • Opcode Fuzzy Hash: 506fcbeff494aa6687fb7ab47ff6add9a93e3b84381325f8610048c0668038a7
                                    • Instruction Fuzzy Hash: 4D4144B0D00259DFDB10CFA9C988B9EBBF2BB48314F248129E818AB351D7B59845CF91
                                    Function 05662B40 Relevance: 1.6, APIs: 1, Instructions: 91registryCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 73 5662b40-5662bcb 80 5662bdc-5662bf4 73->80 81 5662bcd-5662bda 73->81 82 5662cb6-5662ce0 80->82 81->80 85 5662bf9-5662c28 RegDisablePredefinedCache 81->85 93 5662ce2 82->93 94 5662c6d 82->94 86 5662c31-5662c4c call 5662608 85->86 87 5662c2a-5662c30 85->87 95 5662c51-5662c69 86->95 87->86 96 5662cb4 93->96 97 5662ce4-5662cf6 93->97 98 5662c6f 94->98 99 5662c78 94->99 95->94 96->82 98->99 99->96
                                    APIs
                                    • RegDisablePredefinedCache.ADVAPI32 ref: 05662C11
                                    Memory Dump Source
                                    • Source File: 00000008.00000002.4076721320.0000000005660000.00000040.00000800.00020000.00000000.sdmp, Offset: 05660000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_8_2_5660000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID: CacheDisablePredefined
                                    • String ID:
                                    • API String ID: 1885667121-0
                                    • Opcode ID: e9081bb2ec8be704194d708a87d4a29494dba5622cd34a0dd871a15cef450cde
                                    • Instruction ID: 535b791f5dfa31e61c129de439f90289a53b0581dcaf245ae582c1ca7681857f
                                    • Opcode Fuzzy Hash: e9081bb2ec8be704194d708a87d4a29494dba5622cd34a0dd871a15cef450cde
                                    • Instruction Fuzzy Hash: E2314574E00248DFDB14DFA9D564BAEBBF6BF88304F148429E805AB390DBB46885CF51
                                    Function 00EBD670 Relevance: .1, Instructions: 75COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000008.00000002.4047037214.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_8_2_ebd000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 018c64f284c0b716ea6e531e94d2c54b59bfe4f897336795c5a2bf01020a6fa9
                                    • Instruction ID: cae11b2b7a6694ab2c4e20fd076c8fe63fd039ddaf34bbaf17f419578de21f09
                                    • Opcode Fuzzy Hash: 018c64f284c0b716ea6e531e94d2c54b59bfe4f897336795c5a2bf01020a6fa9
                                    • Instruction Fuzzy Hash: 0E216776508240DFDB05DF10DDC0B97BF65FB88314F20816EE8091B256D336D856CBA1
                                    Function 00EBD66B Relevance: .1, Instructions: 56COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000008.00000002.4047037214.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_8_2_ebd000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
                                    • Instruction ID: c81420235622e58858547f09bc6ae2bba46b27a74503e3fec029367617649e74
                                    • Opcode Fuzzy Hash: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
                                    • Instruction Fuzzy Hash: 6011D676504280CFCB16CF10D9C4B96BF71FB94314F24C5AAD8090B256C336D856CB91
                                    Function 00EBD005 Relevance: .0, Instructions: 45COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000008.00000002.4047037214.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_8_2_ebd000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e38b13f2eb7260bfe3bcab0d9cdf374c1fec189aac0a837f9a34cacee7324ab9
                                    • Instruction ID: e18649d360d084e976c3b64a23f1cbf35e854251028b0eb8b54b41c43919e843
                                    • Opcode Fuzzy Hash: e38b13f2eb7260bfe3bcab0d9cdf374c1fec189aac0a837f9a34cacee7324ab9
                                    • Instruction Fuzzy Hash: FB01406100E3C09FE7138B25DC94792BFB4AF53224F19C1DBD9889F1A3D2699849CB72
                                    Function 00EBD01D Relevance: .0, Instructions: 45COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000008.00000002.4047037214.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_8_2_ebd000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e09a0e36c39dad13397e1246051e8a32c400ed70d68a9721c3bb84ba170c8bcc
                                    • Instruction ID: 2e6ce6f0080a0732e1eddbe574ed60caa67be2b040bfb0c58425b4db08bb8b11
                                    • Opcode Fuzzy Hash: e09a0e36c39dad13397e1246051e8a32c400ed70d68a9721c3bb84ba170c8bcc
                                    • Instruction Fuzzy Hash: 70012B7140C344DAE7115A25DDC0BE7FF99EF41364F18C11AED085F182D279D842CAB1

                                    Non-executed Functions

                                    Function 01124D30 Relevance: 1.6, APIs: 1, Instructions: 58COMMON
                                    Download Yara Rule
                                    APIs
                                    • RtlGetVersion.NTDLL(0000009C), ref: 01124DBE
                                    Memory Dump Source
                                    • Source File: 00000008.00000002.4048348815.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_8_2_1120000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID: Version
                                    • String ID:
                                    • API String ID: 1889659487-0
                                    • Opcode ID: be17790efd33f2b1308670752d5cb1bbb8626a14c64f6182c99fceee2c4ef76d
                                    • Instruction ID: 74b6311a2428a6357c6477388d9f391cc4d7198e3a1bd44121b1e8d44c54f4a1
                                    • Opcode Fuzzy Hash: be17790efd33f2b1308670752d5cb1bbb8626a14c64f6182c99fceee2c4ef76d
                                    • Instruction Fuzzy Hash: 52211471A04368DFEF60DF19C844B99FBB9FB44214F1082D9E50CA7640CB75AA98CF96

                                    Execution Graph

                                    Execution Coverage:10.3%
                                    Dynamic/Decrypted Code Coverage:100%
                                    Signature Coverage:0%
                                    Total number of Nodes:5
                                    Total number of Limit Nodes:1
                                    execution_graph 18874 7ffd342f8014 18876 7ffd342f801d 18874->18876 18875 7ffd342f8082 18876->18875 18877 7ffd342f80f6 SetProcessMitigationPolicy 18876->18877 18878 7ffd342f8152 18877->18878

                                    Executed Functions

                                    Function 00007FFD34606761 Relevance: 12.5, Strings: 9, Instructions: 1246COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: @R`4$PM/4$XM/4$X]14$h4_4$h4_4$hl_4$hn_4$]14
                                    • API String ID: 0-924944704
                                    • Opcode ID: 1f39941f740c2a1cfef2dce27d4b3937a0080b96ae733a304b1a75dd25dc4eae
                                    • Instruction ID: 9e02a5ac7f9e15d709edd7a1bec91c170fd7a4d4ffeed72e4ec126af51c32a0a
                                    • Opcode Fuzzy Hash: 1f39941f740c2a1cfef2dce27d4b3937a0080b96ae733a304b1a75dd25dc4eae
                                    • Instruction Fuzzy Hash: 4B82E231B1CA6A8FEBA5AF2884A56F573D1EF97304F54007AD54EC72D2DE2DB8029341
                                    Function 00007FFD346091BB Relevance: 8.3, Strings: 5, Instructions: 2013COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: @\14$H,j4$X_4$p\14$0_4
                                    • API String ID: 0-3312876796
                                    • Opcode ID: 436ed30b4f7b1f6e458e19dcbd99ddd21d74bcfb18e435b884ccb5af4e98f303
                                    • Instruction ID: 06938ef78b79c991ffb63b2a9a33b32337108ba246d3e7cffb7b8d79a122b692
                                    • Opcode Fuzzy Hash: 436ed30b4f7b1f6e458e19dcbd99ddd21d74bcfb18e435b884ccb5af4e98f303
                                    • Instruction Fuzzy Hash: 7CF26331A08A298FDBA4DF28C8A47E877E2FF56300F5441B9D50DD7292DE39AD85DB40
                                    Function 00007FFD34600280 Relevance: 5.5, Strings: 4, Instructions: 546COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 929 7ffd34600280-7ffd34600289 930 7ffd3460028b-7ffd3460028c 929->930 931 7ffd34600293-7ffd346002ce 929->931 930->931 935 7ffd34600318-7ffd34600340 931->935 936 7ffd346002d0-7ffd34600306 931->936 941 7ffd34600364-7ffd3460037c 935->941 942 7ffd34600342-7ffd34600361 935->942 947 7ffd346003a0-7ffd346003be 941->947 948 7ffd3460037e-7ffd3460039d 941->948 942->941 951 7ffd346003da 947->951 952 7ffd346003c0-7ffd346003d0 947->952 948->947 954 7ffd346003df-7ffd346003e5 951->954 955 7ffd346003d7-7ffd346003d8 952->955 956 7ffd346003eb-7ffd346003f4 954->956 957 7ffd3460047e-7ffd34600481 954->957 955->951 958 7ffd346003f6-7ffd34600403 956->958 959 7ffd3460040d-7ffd34600418 956->959 960 7ffd346004d8-7ffd346004f6 957->960 961 7ffd34600483-7ffd3460048d 957->961 958->959 968 7ffd34600405-7ffd3460040b 958->968 962 7ffd3460041a-7ffd34600437 959->962 963 7ffd34600464-7ffd3460047c 959->963 979 7ffd346004fa-7ffd34600506 960->979 980 7ffd34600640-7ffd3460065e 960->980 969 7ffd34600495-7ffd346004ae 961->969 970 7ffd34600722-7ffd34600763 962->970 971 7ffd3460043d-7ffd34600462 962->971 963->957 968->959 975 7ffd346004b0-7ffd346004b2 969->975 976 7ffd3460051f-7ffd3460052a 969->976 971->963 981 7ffd346004b4 975->981 982 7ffd3460052e-7ffd3460053a 975->982 983 7ffd3460052b-7ffd3460052c 976->983 986 7ffd3460050c-7ffd3460051a 979->986 987 7ffd34600508-7ffd3460050a 979->987 1002 7ffd34600664-7ffd3460066e 980->1002 1003 7ffd346006fd-7ffd3460071f 980->1003 981->979 988 7ffd346004b6-7ffd346004ba 981->988 989 7ffd3460053c-7ffd3460053e 982->989 990 7ffd34600540-7ffd34600541 982->990 983->982 993 7ffd3460051d-7ffd3460051e 986->993 987->993 988->983 995 7ffd346004bc-7ffd346004c1 988->995 996 7ffd34600551-7ffd34600555 989->996 998 7ffd34600542-7ffd3460054e 990->998 993->976 995->998 1000 7ffd346004c3-7ffd346004ce 995->1000 1001 7ffd34600556-7ffd3460056e 996->1001 998->996 1004 7ffd346004d0-7ffd346004d5 1000->1004 1005 7ffd3460053f 1000->1005 1012 7ffd34600574-7ffd34600582 1001->1012 1013 7ffd34600570-7ffd34600572 1001->1013 1008 7ffd34600674-7ffd34600682 1002->1008 1009 7ffd34600670-7ffd34600672 1002->1009 1003->970 1004->1001 1011 7ffd346004d7 1004->1011 1005->990 1014 7ffd34600685-7ffd346006a2 1008->1014 1009->1014 1011->960 1015 7ffd34600585-7ffd346005a2 1012->1015 1013->1015 1020 7ffd346006a8-7ffd346006b6 1014->1020 1021 7ffd346006a4-7ffd346006a6 1014->1021 1022 7ffd346005a8-7ffd346005b6 1015->1022 1023 7ffd346005a4-7ffd346005a6 1015->1023 1024 7ffd346006b9-7ffd346006d6 1020->1024 1021->1024 1025 7ffd346005b9-7ffd346005cf 1022->1025 1023->1025 1029 7ffd346006dc-7ffd346006ea 1024->1029 1030 7ffd346006d8-7ffd346006da 1024->1030 1033 7ffd346005e6-7ffd346005ed 1025->1033 1034 7ffd346005d1-7ffd346005e4 1025->1034 1032 7ffd346006ed-7ffd346006f6 1029->1032 1030->1032 1032->1003 1037 7ffd346005f4-7ffd34600607 1033->1037 1034->1033 1038 7ffd3460060d-7ffd34600610 1034->1038 1037->1038 1039 7ffd34600627-7ffd3460063a 1038->1039 1040 7ffd34600612-7ffd34600625 1038->1040 1039->980 1040->980 1040->1039
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: 01I4$0_4$2_4$\14
                                    • API String ID: 0-2282072005
                                    • Opcode ID: 5a06f0899ec28118e75170c75dfc096de762ac0dffe136076d878e7fd7d389fb
                                    • Instruction ID: 893376ebb115bba8441eb20ef7dbf8039f6a43dffc494b73336da0797def7bb0
                                    • Opcode Fuzzy Hash: 5a06f0899ec28118e75170c75dfc096de762ac0dffe136076d878e7fd7d389fb
                                    • Instruction Fuzzy Hash: FFF1C071B1CE5A4FE7A9AB2894A56F537D1EF9B300F1440BAE58DC7293DD2CE8429340
                                    Function 00007FFD34606974 Relevance: 3.1, Strings: 2, Instructions: 559COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: PM/4$XM/4
                                    • API String ID: 0-4056937192
                                    • Opcode ID: 8f648c4c534b53935cd099d2805559bfaccd67d08aaffbd76d3198add4848048
                                    • Instruction ID: c93617eb7a051c8bc53850e813431ce657f82668bb75cb9792e062f1f7cb65fc
                                    • Opcode Fuzzy Hash: 8f648c4c534b53935cd099d2805559bfaccd67d08aaffbd76d3198add4848048
                                    • Instruction Fuzzy Hash: 7F12E331B1CA678EEBA9AF2884F06F972D1EF57304F544079D54ED72D2DE2DB8019241
                                    Function 00007FFD3460738D Relevance: 2.9, Strings: 2, Instructions: 426COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1554 7ffd3460738d-7ffd34607391 1555 7ffd3460739b 1554->1555 1556 7ffd34607393-7ffd3460739a 1554->1556 1557 7ffd3460739c-7ffd346073af 1555->1557 1556->1555 1556->1557 1559 7ffd346073b1-7ffd346073b4 1557->1559 1560 7ffd34607420-7ffd34607432 1557->1560 1561 7ffd346073b6-7ffd346073f8 call 7ffd34606418 call 7ffd34606428 call 7ffd346052d0 1559->1561 1562 7ffd34607435-7ffd3460743c 1559->1562 1560->1562 1575 7ffd34607463-7ffd34607467 1561->1575 1584 7ffd346073fa-7ffd3460741d 1561->1584 1565 7ffd34607578-7ffd346075da 1562->1565 1566 7ffd3460743d-7ffd3460745f 1562->1566 1581 7ffd346079e8-7ffd34607a06 call 7ffd34600a70 * 2 1565->1581 1582 7ffd346075e0-7ffd346075fe call 7ffd34600a70 * 2 1565->1582 1566->1575 1583 7ffd34607469-7ffd346074ee call 7ffd346052d8 1575->1583 1598 7ffd34607a0c-7ffd34607a13 1581->1598 1599 7ffd34607b12-7ffd34607b1d 1581->1599 1596 7ffd34607604-7ffd3460760c 1582->1596 1597 7ffd3460787e-7ffd3460789c call 7ffd34600a70 * 2 1582->1597 1583->1565 1584->1583 1589 7ffd3460741f 1584->1589 1589->1560 1605 7ffd34607613-7ffd34607616 1596->1605 1620 7ffd346078c6-7ffd346078d9 call 7ffd34600a70 * 2 1597->1620 1621 7ffd3460789e-7ffd346078a8 1597->1621 1602 7ffd34607a26-7ffd34607a28 1598->1602 1603 7ffd34607a15-7ffd34607a24 1598->1603 1607 7ffd34607a2f-7ffd34607a42 1602->1607 1603->1602 1616 7ffd34607a2a 1603->1616 1609 7ffd3460761c-7ffd3460762a 1605->1609 1610 7ffd34607618-7ffd3460761a 1605->1610 1622 7ffd34607a44-7ffd34607a53 1607->1622 1614 7ffd3460762d-7ffd34607642 1609->1614 1610->1614 1632 7ffd34607648-7ffd3460766c call 7ffd34606558 * 2 1614->1632 1633 7ffd34607644-7ffd34607646 1614->1633 1616->1607 1643 7ffd346078de-7ffd346078e4 1620->1643 1625 7ffd346078bc 1621->1625 1626 7ffd346078aa-7ffd346078ba 1621->1626 1628 7ffd34607a55-7ffd34607a72 1622->1628 1629 7ffd34607a9f-7ffd34607aad 1622->1629 1634 7ffd346078be-7ffd346078bf 1625->1634 1626->1634 1641 7ffd34607a78-7ffd34607a9d 1628->1641 1642 7ffd34607b1e-7ffd34607b97 1628->1642 1629->1599 1629->1622 1637 7ffd3460766f-7ffd34607684 1632->1637 1633->1637 1634->1620 1652 7ffd3460768a-7ffd346076ae call 7ffd34606558 * 2 1637->1652 1653 7ffd34607686-7ffd34607688 1637->1653 1641->1629 1667 7ffd34607b99-7ffd34607bdd 1642->1667 1668 7ffd34607be0-7ffd34607c36 1642->1668 1645 7ffd3460799b-7ffd346079a6 1643->1645 1646 7ffd346078ea-7ffd346078f5 1643->1646 1664 7ffd346079ac-7ffd346079bb 1645->1664 1665 7ffd346079a8-7ffd346079aa 1645->1665 1661 7ffd346078fb-7ffd3460790a 1646->1661 1662 7ffd346078f7-7ffd346078f9 1646->1662 1659 7ffd346076b1-7ffd346076c6 1652->1659 1653->1659 1679 7ffd346076cc-7ffd346076e3 call 7ffd34606558 1659->1679 1680 7ffd346076c8-7ffd346076ca 1659->1680 1669 7ffd3460790d-7ffd3460793b 1661->1669 1662->1669 1670 7ffd346079be-7ffd346079c0 1664->1670 1665->1670 1667->1668 1689 7ffd34607c3c-7ffd34607c60 1668->1689 1690 7ffd34607c38-7ffd34607c39 1668->1690 1684 7ffd3460793b 1669->1684 1685 7ffd346078cd-7ffd346078d4 1669->1685 1670->1599 1678 7ffd346079c6-7ffd346079e7 1670->1678 1682 7ffd346076f3-7ffd34607701 1679->1682 1680->1682 1696 7ffd34607707-7ffd34607715 1682->1696 1697 7ffd34607703-7ffd34607705 1682->1697 1684->1684 1684->1685 1685->1643 1691 7ffd346078d9 call 7ffd34600a70 1685->1691 1705 7ffd34607c92-7ffd34607c9b 1689->1705 1706 7ffd34607c62-7ffd34607c71 1689->1706 1690->1689 1691->1643 1700 7ffd34607718-7ffd34607719 1696->1700 1697->1700 1707 7ffd34607720-7ffd34607721 1700->1707 1708 7ffd34607c77-7ffd34607c91 1706->1708 1709 7ffd34607c73-7ffd34607c74 1706->1709 1710 7ffd34607728-7ffd3460772f 1707->1710 1709->1708 1710->1597 1712 7ffd34607735-7ffd3460773c 1710->1712 1712->1597 1714 7ffd34607742-7ffd34607759 1712->1714 1716 7ffd3460775b-7ffd3460776d 1714->1716 1717 7ffd3460778e-7ffd34607799 1714->1717 1720 7ffd34607773-7ffd34607781 1716->1720 1721 7ffd3460776f-7ffd34607771 1716->1721 1722 7ffd3460779b-7ffd3460779d 1717->1722 1723 7ffd3460779f-7ffd346077ae 1717->1723 1724 7ffd34607784-7ffd34607787 1720->1724 1721->1724 1725 7ffd346077b1-7ffd346077b3 1722->1725 1723->1725 1724->1717 1727 7ffd346077b9-7ffd346077d0 1725->1727 1728 7ffd34607868-7ffd3460787a 1725->1728 1727->1728 1732 7ffd346077d6-7ffd346077f3 1727->1732 1728->1597 1735 7ffd346077f5-7ffd346077fd 1732->1735 1736 7ffd346077ff 1732->1736 1737 7ffd34607801-7ffd34607803 1735->1737 1736->1737 1737->1728 1739 7ffd34607805-7ffd3460780f 1737->1739 1740 7ffd34607811-7ffd3460781b call 7ffd34604498 1739->1740 1741 7ffd3460781d-7ffd34607825 1739->1741 1740->1597 1740->1741 1743 7ffd34607827-7ffd3460784c call 7ffd34606368 1741->1743 1744 7ffd34607853-7ffd34607866 call 7ffd34606580 1741->1744 1743->1744 1744->1597
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: XR`4$`R`4
                                    • API String ID: 0-147525934
                                    • Opcode ID: 94548a8e27981f36a51d297dc1066c1935d21f9e7bfaed3b76f99bd2e64dabfb
                                    • Instruction ID: 94dd1b0ed6c65ce55cbc1d9f64181f01d0adba0d74e247a265c4fe97efd2ea33
                                    • Opcode Fuzzy Hash: 94548a8e27981f36a51d297dc1066c1935d21f9e7bfaed3b76f99bd2e64dabfb
                                    • Instruction Fuzzy Hash: 7CE10031B1CA578FEBA5AB2884B06F977D2EF97301F544479C14EC7282DE2CB8429381
                                    Function 00007FFD34608E65 Relevance: 7.8, Strings: 6, Instructions: 260COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: Jj4$8\14$@Jj4$PJj4$XNj4$`Jj4
                                    • API String ID: 0-3064649851
                                    • Opcode ID: 308f06bd856dfaae0a81a3f1f05c86182d47c584dcb15c7373447662c5d7be37
                                    • Instruction ID: ddd03c8632d6377926006f44d58ae40df2814a05cc39c180d7ddc0508113e599
                                    • Opcode Fuzzy Hash: 308f06bd856dfaae0a81a3f1f05c86182d47c584dcb15c7373447662c5d7be37
                                    • Instruction Fuzzy Hash: 40914962B0DA964FE751DF2888A96E47BD1FF53300F0400BAD548D7193EE2DB846C781
                                    Function 00007FFD3460C6FB Relevance: 5.2, Strings: 4, Instructions: 152COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1042 7ffd3460c6fb-7ffd3460c727 1046 7ffd3460c732-7ffd3460c775 1042->1046 1051 7ffd3460c777-7ffd3460c7b9 1046->1051 1052 7ffd3460c7bb-7ffd3460c7d0 1046->1052 1051->1052 1055 7ffd3460c7d6-7ffd3460c7ff 1052->1055 1056 7ffd3460c857-7ffd3460c860 1052->1056 1062 7ffd3460c801-7ffd3460c843 1055->1062 1063 7ffd3460c845-7ffd3460c855 1055->1063 1062->1063 1063->1056
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: 0`j4$0`j4$8aj4$8aj4
                                    • API String ID: 0-418450594
                                    • Opcode ID: 77f9b252e62e29d7849db20ba0a110a4062a9dc266f32bff3ac4094d5dff65e7
                                    • Instruction ID: b4b281cf48caf407eaa2eb4f8c6be11121a28cb095188cd6a247b87c16cf5a84
                                    • Opcode Fuzzy Hash: 77f9b252e62e29d7849db20ba0a110a4062a9dc266f32bff3ac4094d5dff65e7
                                    • Instruction Fuzzy Hash: 0D414452B1CE5A4FE798EF2C48E66F577C1EB9A240B94017AD50CC3286DD19EC424381
                                    Function 00007FFD346058A9 Relevance: 4.1, Strings: 3, Instructions: 315COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1069 7ffd346058a9-7ffd346058d1 1070 7ffd346058d8-7ffd346058da 1069->1070 1071 7ffd34605969-7ffd34605972 1070->1071 1072 7ffd346058e0-7ffd346058fb 1070->1072 1074 7ffd34605914-7ffd34605929 1072->1074 1075 7ffd346058fd-7ffd34605912 1072->1075 1078 7ffd3460592b-7ffd34605966 1074->1078 1079 7ffd34605973-7ffd346059b2 1074->1079 1075->1074 1078->1071 1085 7ffd346059fc-7ffd346059ff 1079->1085 1086 7ffd346059b4-7ffd346059cb 1079->1086 1089 7ffd34605a7b 1085->1089 1090 7ffd34605a01 1085->1090 1092 7ffd34605be8-7ffd34605bfa 1086->1092 1093 7ffd346059d1-7ffd346059d7 1086->1093 1094 7ffd34605a7c-7ffd34605a7d 1089->1094 1095 7ffd34605a47-7ffd34605a54 1090->1095 1096 7ffd34605a03-7ffd34605a0b 1090->1096 1093->1092 1097 7ffd346059dd-7ffd346059e3 1093->1097 1104 7ffd34605a63-7ffd34605a69 1094->1104 1105 7ffd34605a7f-7ffd34605a86 1094->1105 1098 7ffd34605a57-7ffd34605a5f 1095->1098 1096->1094 1099 7ffd34605a0d-7ffd34605a0f 1096->1099 1097->1092 1103 7ffd346059e9-7ffd346059ef 1097->1103 1098->1104 1101 7ffd34605a8b-7ffd34605a94 1099->1101 1102 7ffd34605a11 1099->1102 1107 7ffd34605a96-7ffd34605a98 1101->1107 1102->1098 1106 7ffd34605a13-7ffd34605a17 1102->1106 1103->1092 1108 7ffd346059f5-7ffd346059fb 1103->1108 1110 7ffd34605a88 1105->1110 1106->1110 1111 7ffd34605a19-7ffd34605a1e 1106->1111 1114 7ffd34605a9f-7ffd34605aa8 1107->1114 1108->1085 1112 7ffd34605a6c-7ffd34605a7a 1108->1112 1110->1101 1113 7ffd34605a20-7ffd34605a25 1111->1113 1111->1114 1112->1089 1113->1107 1115 7ffd34605a27-7ffd34605a2c 1113->1115 1117 7ffd34605aad-7ffd34605ac8 1114->1117 1116 7ffd34605a2e-7ffd34605a42 1115->1116 1115->1117 1116->1092 1116->1095 1117->1092 1121 7ffd34605ace-7ffd34605ad4 1117->1121 1121->1092 1122 7ffd34605ada-7ffd34605ae0 1121->1122 1122->1092 1123 7ffd34605ae6-7ffd34605aec 1122->1123 1123->1092 1124 7ffd34605af2-7ffd34605b40 1123->1124 1124->1092
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: P'04$0_4$2_4
                                    • API String ID: 0-3674959081
                                    • Opcode ID: c7ec1f41316688bcaf17a8219672ae78f794fe4416198638838301ddeeb11eb5
                                    • Instruction ID: dfa61519b39789cde1ab10de7a1fc48756995e4a1109be536a1bdd4d01ef5d03
                                    • Opcode Fuzzy Hash: c7ec1f41316688bcaf17a8219672ae78f794fe4416198638838301ddeeb11eb5
                                    • Instruction Fuzzy Hash: 7C9106B2A0DA5A4FEBA5EF1884F24F573D1EF57310B04057AD54AC7582EE2DF80A8781
                                    Function 00007FFD34606BD6 Relevance: 2.7, Strings: 2, Instructions: 162COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: PM/4$XM/4
                                    • API String ID: 0-4056937192
                                    • Opcode ID: 33ed145aa3ce5309eeb728b8ac6889a3aa941f8acb4e22d6ece5b9f57c14d600
                                    • Instruction ID: 0de0ef41cc7cf7371522987199208fda55c3d33d9e6441375df741ac8bc5cd4e
                                    • Opcode Fuzzy Hash: 33ed145aa3ce5309eeb728b8ac6889a3aa941f8acb4e22d6ece5b9f57c14d600
                                    • Instruction Fuzzy Hash: 5E512572B1CAA68BEBA5AF2844E52F433C1EF96304F14457ED48AD72D2DD2CAC419341
                                    Function 00007FFD34602909 Relevance: 2.6, Strings: 2, Instructions: 121COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: (]14$HQ/4
                                    • API String ID: 0-3033221142
                                    • Opcode ID: 3da543540bfc33b850ae5cee26a2886e8088a4ee0d34ddbdad1ea489d6951852
                                    • Instruction ID: fd1700e6ff6ae705724b20299cd90a62e18ae50587ec9d1bbea5813414c5dfb5
                                    • Opcode Fuzzy Hash: 3da543540bfc33b850ae5cee26a2886e8088a4ee0d34ddbdad1ea489d6951852
                                    • Instruction Fuzzy Hash: 15310872B1CA5A5FEB94EE1C98969F573D1FF962147440579E40AC3282EE29FC038340
                                    Function 00007FFD3460D0D0 Relevance: 1.8, Strings: 1, Instructions: 564COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: paj4
                                    • API String ID: 0-3184044303
                                    • Opcode ID: 4d3a67451026e51c60e9d22f2d1ade2d6ff6c6a2835a97a3ab3be7a25765f203
                                    • Instruction ID: 56e671442567779dfb4c42093a3066c4361b7733747f5266012d816f21d15a28
                                    • Opcode Fuzzy Hash: 4d3a67451026e51c60e9d22f2d1ade2d6ff6c6a2835a97a3ab3be7a25765f203
                                    • Instruction Fuzzy Hash: CC22C170A1C55A4FEBA8EF24C8A57E977E1EF56301F4001B9D14EE32D2DE3CA9468B41
                                    Function 00007FFD342F8014 Relevance: 1.7, APIs: 1, Instructions: 178COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4069523734.00007FFD342F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD342F0000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd342f0000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID: MitigationPolicyProcess
                                    • String ID:
                                    • API String ID: 1088084561-0
                                    • Opcode ID: 18fd4e20f1a7bc029d4f45e7a7edfce7bb6a2fa6836f2008addca4bb06f04789
                                    • Instruction ID: fca0ec607234309d807645860d776fb0108eb8c23a4f784d2f66b2ca5e916195
                                    • Opcode Fuzzy Hash: 18fd4e20f1a7bc029d4f45e7a7edfce7bb6a2fa6836f2008addca4bb06f04789
                                    • Instruction Fuzzy Hash: 0F515C31D0CB498FDB14AFA8984A5E9BBE0EF56310F44017FE449D3192DF68A8568B91
                                    Function 00007FFD3460911C Relevance: 1.6, Strings: 1, Instructions: 387COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: H,j4
                                    • API String ID: 0-4027934674
                                    • Opcode ID: cabeca7c75a3f1c46b38084dafd44c8b9a7736e56d6981860d19b01a530e839a
                                    • Instruction ID: a99db6bfb0489435f025449c983fdd8f053b361a6b3c302d2786a6cd6ec27aa6
                                    • Opcode Fuzzy Hash: cabeca7c75a3f1c46b38084dafd44c8b9a7736e56d6981860d19b01a530e839a
                                    • Instruction Fuzzy Hash: D6C11431B0C95A4FEB98EF2888E56F933D1EFA6304F1441B9D10DC3296DE28AC469741
                                    Function 00007FFD3460D453 Relevance: 1.5, Strings: 1, Instructions: 291COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: paj4
                                    • API String ID: 0-3184044303
                                    • Opcode ID: a44eb0fb5d9cf3340aa1604c17673e9d26c089716d0a1918cf27a36e7865c40d
                                    • Instruction ID: de8631ae2b7412705c74ddea8ecbc1eae60eea647752a7af3bc46e3f4576ef5a
                                    • Opcode Fuzzy Hash: a44eb0fb5d9cf3340aa1604c17673e9d26c089716d0a1918cf27a36e7865c40d
                                    • Instruction Fuzzy Hash: 15A1B130B1C51A4BEB68EF58CCA57F976E1FF96301F900179E14AE32C2DE2C69468B51
                                    Function 00007FFD3460AC56 Relevance: 1.5, Strings: 1, Instructions: 290COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: H,j4
                                    • API String ID: 0-4027934674
                                    • Opcode ID: 4e188c2e96f42ecc70038bd1ed0b91b22d36512ff0a0c0bc0e55087b64775efc
                                    • Instruction ID: 06b7e37b92c9e6bb7b370f07a6cd8bb286d8a5b8fb99fa108e99e628d4d384f2
                                    • Opcode Fuzzy Hash: 4e188c2e96f42ecc70038bd1ed0b91b22d36512ff0a0c0bc0e55087b64775efc
                                    • Instruction Fuzzy Hash: 92919031B1C91A8FEF94EF6C88A5BA973E2EFA9340F5441B5D00DD3296DD28BC429741
                                    Function 00007FFD3460298F Relevance: 1.4, Strings: 1, Instructions: 182COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: M/4
                                    • API String ID: 0-3399262825
                                    • Opcode ID: da24684b256368c86efcee5136f0bd85bc0eb194c79dbcfdc484bd092ec58fe5
                                    • Instruction ID: cc66335791e8c3cd2a2f391b0ec0b6c6ba28f30cfa73d9b9211ffacea5ac648c
                                    • Opcode Fuzzy Hash: da24684b256368c86efcee5136f0bd85bc0eb194c79dbcfdc484bd092ec58fe5
                                    • Instruction Fuzzy Hash: 6351A772B0D9454FDB98DF28C8A5AA177D1FF96314B0401ADD44ED7286CE29FC46C740
                                    Function 00007FFD34609056 Relevance: 1.3, Strings: 1, Instructions: 76COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: 8\14
                                    • API String ID: 0-2526292865
                                    • Opcode ID: dda7f9388d0bcb4e40fabbd5f8e2f79e58edb8835a37547ebde597e797a35b00
                                    • Instruction ID: b1327dc0407441aa68128b9f1e222ed2fe403fdebcc8fc4ea6136903596c64b1
                                    • Opcode Fuzzy Hash: dda7f9388d0bcb4e40fabbd5f8e2f79e58edb8835a37547ebde597e797a35b00
                                    • Instruction Fuzzy Hash: BF21A461B1CA9A8FEBD4DF1C88E96E533D2FF9A704F1440B9D41DC3286DE25A8468741
                                    Function 00007FFD34605372 Relevance: .3, Instructions: 348COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: dd10f2b040b48542e42d1e63aa9a240fe3e3d032db385e541c25bbee1bf26176
                                    • Instruction ID: 9600fd832af0f4929c3e4236010c80b9a676038f5271c5c79e379ea963e29f3e
                                    • Opcode Fuzzy Hash: dd10f2b040b48542e42d1e63aa9a240fe3e3d032db385e541c25bbee1bf26176
                                    • Instruction Fuzzy Hash: 30C19E3871CB198FDEDCEF18C0A1AA573E2FF65704B6509ADD059CB296CA25F842CB41
                                    Function 00007FFD34603CA5 Relevance: .3, Instructions: 301COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 20e1e0627b9d507c3e77a17f28f521c876d179e0c5a56762eaf8109bb1a6bb23
                                    • Instruction ID: 7a1c379f8f2137ed007867d100cee00f22ee29aaabadddf6ed28b01f4be3d6ce
                                    • Opcode Fuzzy Hash: 20e1e0627b9d507c3e77a17f28f521c876d179e0c5a56762eaf8109bb1a6bb23
                                    • Instruction Fuzzy Hash: B6A1643470DA498FDBDDEF18C4A56A177E1FF9A304B2445A9C05DCB29BCA29E887C740
                                    Function 00007FFD346075A9 Relevance: .2, Instructions: 249COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 5ad7df281b3e64ab3b071be2fa3d23a2ea60e1bd3dc34011916276c551bed0aa
                                    • Instruction ID: b773b5128328a5d49bf879171028f8e40f569e1cd38ee66618ea542f78c6720d
                                    • Opcode Fuzzy Hash: 5ad7df281b3e64ab3b071be2fa3d23a2ea60e1bd3dc34011916276c551bed0aa
                                    • Instruction Fuzzy Hash: 92819931B1CD278EE7A5AF2880B17F972D2EF97345F544438D60ED3282DE2DB841A281
                                    Function 00007FFD346076E7 Relevance: .2, Instructions: 180COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 944969df495ffb996eda49249e39c1dbae7b1a27a4d73c2208ce7ca249d8eeae
                                    • Instruction ID: 5a3d9cc7791a14e34ec3c1d542a7c7ebb4a7da966a2b97b9c44084d8d3221eaa
                                    • Opcode Fuzzy Hash: 944969df495ffb996eda49249e39c1dbae7b1a27a4d73c2208ce7ca249d8eeae
                                    • Instruction Fuzzy Hash: AF516331B1C92B8AEBA5AF2480F16F972D2EF97345F544439D50ED32C2DE2DB842E641
                                    Function 00007FFD34605EB9 Relevance: .1, Instructions: 139COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: f93be88c6d89f7d8256d2a366f32fb298d0fa246cd1c966e6f2cd211ddc94ad6
                                    • Instruction ID: b6c7f435674c8842d9a994e71b6c8bf611ddef4bd31c3e562928ee1423e19a1b
                                    • Opcode Fuzzy Hash: f93be88c6d89f7d8256d2a366f32fb298d0fa246cd1c966e6f2cd211ddc94ad6
                                    • Instruction Fuzzy Hash: 8E4121B170CA498FDBC4DF1888B4AA53B91FF5A314B14059DD55EC72D2CB39E852CB01
                                    Function 00007FFD34604638 Relevance: .1, Instructions: 134COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 962681292b84711d8e88ac26046d7eeea3141df2c17d02703a795dfe3e3eed6a
                                    • Instruction ID: 62f349505feeb0896ebfc52ce4868a125abac70215e5153b8b34ac65a76254c4
                                    • Opcode Fuzzy Hash: 962681292b84711d8e88ac26046d7eeea3141df2c17d02703a795dfe3e3eed6a
                                    • Instruction Fuzzy Hash: 4631F052B1DD9A4FEBA4AF2C48E56F423C1DFA7340B08017AE14CC7297ED1DA8028741
                                    Function 00007FFD3460B6A5 Relevance: .1, Instructions: 131COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 4867cbfb301ae3c98d827d6537446f042cb28e6460e6b8cd6b2c8b404c49983a
                                    • Instruction ID: 80c9d5ecc66e93c9b28799afd39d57b8b8d41919f59c0ccef0b0dc3a5ada9545
                                    • Opcode Fuzzy Hash: 4867cbfb301ae3c98d827d6537446f042cb28e6460e6b8cd6b2c8b404c49983a
                                    • Instruction Fuzzy Hash: A1312531B1CE1A4FE790EF6C84E56B9B3D1EB9A614B54457AC40DC3292EE29EC828740
                                    Function 00007FFD3460D84B Relevance: .1, Instructions: 102COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 75d847b7a74a39095c4ab9793e4357d4d1d32cf9685c142b157152b36945e345
                                    • Instruction ID: 023c5c0f4cd4ae9524e06359ea042db0c0d1eedf20dfad997e6a6f5ec8f69a73
                                    • Opcode Fuzzy Hash: 75d847b7a74a39095c4ab9793e4357d4d1d32cf9685c142b157152b36945e345
                                    • Instruction Fuzzy Hash: DF313E71A089298FEBE4EF18C4D87A477E1EB59300F4045B9D54DE76A2DE38AD809B40
                                    Function 00007FFD346049FD Relevance: .1, Instructions: 97COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 1e89e5862b23d7ee60c617d84ebc44d88bfd51a36dd5d6da65ff07950b38cd02
                                    • Instruction ID: ffb26aea797d3ff3e31d23d0ab90c787862d9b3ba9f9216a177de47a724c1d61
                                    • Opcode Fuzzy Hash: 1e89e5862b23d7ee60c617d84ebc44d88bfd51a36dd5d6da65ff07950b38cd02
                                    • Instruction Fuzzy Hash: 27217F32E0D9995FDB55DF7844A56F97BE0EF87210B0501F7C448D7096DE2DB8068740
                                    Function 00007FFD34605B49 Relevance: .1, Instructions: 93COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 14e55a89c439207400c4916e74b30ea954411c87af50e39d5c6ccae590f0d596
                                    • Instruction ID: 322f79efe220d601ce75b22a8ca81a87e0f9b977dfcdac3f75c0dd3b0a9438ad
                                    • Opcode Fuzzy Hash: 14e55a89c439207400c4916e74b30ea954411c87af50e39d5c6ccae590f0d596
                                    • Instruction Fuzzy Hash: 8D21D372B0CE164BEF94EF1CA8B38F573D0EB42310B44056AE54AC2587DE1AF8429681
                                    Function 00007FFD3460C23A Relevance: .1, Instructions: 87COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ecd50e9e31ef048738198e8613a1beaa91b285f818d8ab1c25d15baab172cb71
                                    • Instruction ID: c85c7a4768a3a462df3669506bc38c0a8161fa9e07b8db6c6f52c489407f3734
                                    • Opcode Fuzzy Hash: ecd50e9e31ef048738198e8613a1beaa91b285f818d8ab1c25d15baab172cb71
                                    • Instruction Fuzzy Hash: 6B21052270DA494FE799EB7C94A927527D2EF9B25470405BBC10DD72A3EC2DA8469340
                                    Function 00007FFD34604CB9 Relevance: .1, Instructions: 84COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b36429e34be87fd80a3c1e7da5726fa4005628438ee88ace131e4de894128461
                                    • Instruction ID: bc114177f0145db1f8cbcb3d619a93be205e23a13ea1ec28621493df4cf120f9
                                    • Opcode Fuzzy Hash: b36429e34be87fd80a3c1e7da5726fa4005628438ee88ace131e4de894128461
                                    • Instruction Fuzzy Hash: C4210021B1EA5A1FE3A5AB6888B12B0B7D1FF6A310F4401BAD54DC32C3EE1DAC408351
                                    Function 00007FFD3460D81F Relevance: .1, Instructions: 83COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 783fd389dbfb70da56f79e5de54195b8b66e34231dfa3fa195837387e2362cf6
                                    • Instruction ID: d26c8a101e5cd1c1bf20aeff99c36a49b053f5b8be5cbfe503107467664fe73b
                                    • Opcode Fuzzy Hash: 783fd389dbfb70da56f79e5de54195b8b66e34231dfa3fa195837387e2362cf6
                                    • Instruction Fuzzy Hash: 4F31FF71A099198FDBE4EF18C8A9BE877E0EF59300F4041E9D44DD3262DE34AD819B00
                                    Function 00007FFD34600175 Relevance: .1, Instructions: 76COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: be240a28594512b19f51566b31d7966cadf26e97b11b14970670848267aae779
                                    • Instruction ID: c0fa7c3cda8af90b60127c671c1c12738790f8ace03992088e4a64977d58f2f4
                                    • Opcode Fuzzy Hash: be240a28594512b19f51566b31d7966cadf26e97b11b14970670848267aae779
                                    • Instruction Fuzzy Hash: 6B11E431A0DD994FEB94EF6898A56F97BE1EF96300F0400BBD14DC3193CE29A8058341
                                    Function 00007FFD34605318 Relevance: .1, Instructions: 73COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: f641c5d0f17d784bbafbab57004fe03112e90776270bd0f5907069a6a4a57bdd
                                    • Instruction ID: fdfc5e540f7c28361dec63b0bb3f2f830e8d8fd1b6d402f003e5ca499c634e51
                                    • Opcode Fuzzy Hash: f641c5d0f17d784bbafbab57004fe03112e90776270bd0f5907069a6a4a57bdd
                                    • Instruction Fuzzy Hash: 5B11B23171CD184FE794EF28D8A86B6B3D2EBA9356F14017ED84DD32A5DE2AA840C740
                                    Function 00007FFD34605C00 Relevance: .1, Instructions: 72COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 153db96127eca9b0b36663af6b10ee04b08e084861e295d12b33e7e529dbd1ef
                                    • Instruction ID: 7805242195a078ab6d66d37e5d541c3c64745a301cf3a02df69d96cca6fbe581
                                    • Opcode Fuzzy Hash: 153db96127eca9b0b36663af6b10ee04b08e084861e295d12b33e7e529dbd1ef
                                    • Instruction Fuzzy Hash: F5117481E1CA524FE785EF2C04F25F56BD1EF97210B1440BAD008C318BDC2CD8869350
                                    Function 00007FFD34607F19 Relevance: .1, Instructions: 71COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ef5ee7946573919a40f452225ee59cb6d34bca13ad79f75c59a05b038be93a4c
                                    • Instruction ID: 84cde21919e8ba27fd195e5a4d789ad3fc63963943e6505d89f261c1a5f41756
                                    • Opcode Fuzzy Hash: ef5ee7946573919a40f452225ee59cb6d34bca13ad79f75c59a05b038be93a4c
                                    • Instruction Fuzzy Hash: A711E43060CA444FD795DB28C0A86B1BBD2FF9A315B1401FED58DCB2A3DA29A941C741
                                    Function 00007FFD34605D4D Relevance: .1, Instructions: 67COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 91211fb81a7c85104e018ad47cddc481d6b3494affb85c61887368f37033e3cd
                                    • Instruction ID: 7c2236bf79fe7933583e263573fcef762286678047d2c6681f2da0bab225de48
                                    • Opcode Fuzzy Hash: 91211fb81a7c85104e018ad47cddc481d6b3494affb85c61887368f37033e3cd
                                    • Instruction Fuzzy Hash: B011AFB2E0DA484BEF81DF584CB91E93BA0EF56304F05009BE558E31A3DA25A801CB09
                                    Function 00007FFD34600FF8 Relevance: .1, Instructions: 64COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 4ad424fd99275431ec53079a1ea6817036a9b2f0d40584d04afcba96a7238595
                                    • Instruction ID: 064817241d277772c80721fea715d0fd8578736b274ad0896ec76672106a463b
                                    • Opcode Fuzzy Hash: 4ad424fd99275431ec53079a1ea6817036a9b2f0d40584d04afcba96a7238595
                                    • Instruction Fuzzy Hash: 05112181B1CE564AEB84EF2C04F65FA27D4EF97204B5444BBD10CC328ACC2CD8869351
                                    Function 00007FFD34602A37 Relevance: .1, Instructions: 61COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e24499dd6492cebc827ec38d90b6cefd5cac9b6d9260913ba962e77424c9fd23
                                    • Instruction ID: 3dc73d628373ed9a333e8af1d01cc34c2d0ef8198e768267139136f1b973d111
                                    • Opcode Fuzzy Hash: e24499dd6492cebc827ec38d90b6cefd5cac9b6d9260913ba962e77424c9fd23
                                    • Instruction Fuzzy Hash: DA116071B0C9568FDB94EF18C4A0BA577D1FF5A304B0441B8C84EDB286CE29FC468B40
                                    Function 00007FFD346048D0 Relevance: .1, Instructions: 60COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 4c6fb550f9326a60383c345c454f219bae909e92315f6d13978a524d2a07f214
                                    • Instruction ID: f37e00efedf13db469c617bdee35920c0d1ba46a7977f06553b70dfc9b1daea6
                                    • Opcode Fuzzy Hash: 4c6fb550f9326a60383c345c454f219bae909e92315f6d13978a524d2a07f214
                                    • Instruction Fuzzy Hash: 4C01C43170CD080FDBE4EA2CD868BB577D1EFD9315F54057ED84DD32A5DA16A8418300
                                    Function 00007FFD34602AA0 Relevance: .1, Instructions: 60COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 253e727751c915ac76acec36126ff5b8b49ec867149c01ffe2c37ad4f506d9c6
                                    • Instruction ID: a7db27edc0a8678b60c7802ba141f41997c22781467d5939d520308c3344562e
                                    • Opcode Fuzzy Hash: 253e727751c915ac76acec36126ff5b8b49ec867149c01ffe2c37ad4f506d9c6
                                    • Instruction Fuzzy Hash: 86116071B089558FDB94EF18C4A0BA177D1FF5A304B0441A8C84EDB286CE29EC468B40
                                    Function 00007FFD34604C29 Relevance: .1, Instructions: 58COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e040ca55f1e28f9684baa9c1fb831d0c2add6231c6282c5cc762988114a31e97
                                    • Instruction ID: 0da78e3347a2e6bd408e22a6e85c8ecfc988e5d18f590f4020590739ac51387b
                                    • Opcode Fuzzy Hash: e040ca55f1e28f9684baa9c1fb831d0c2add6231c6282c5cc762988114a31e97
                                    • Instruction Fuzzy Hash: F8112125B0CB670BE7799B2950F03F427E2EF87240F5982BAC40EC21E2CD6D9C81A340
                                    Function 00007FFD346048B5 Relevance: .1, Instructions: 56COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 1a9f0dd997b6571bf315e91eeb34def6bcc184d4c70f4b9fbd6214a3cd9dff22
                                    • Instruction ID: 60d19ec974169313a05bc3877882a033e12f4e9f50e82c8358242b8ab8a2ca81
                                    • Opcode Fuzzy Hash: 1a9f0dd997b6571bf315e91eeb34def6bcc184d4c70f4b9fbd6214a3cd9dff22
                                    • Instruction Fuzzy Hash: 2201F92160DBC40FE7D1DB3858A51F13FE0EF97214B0801FBD988C71A3DA199945C301
                                    Function 00007FFD3460AF86 Relevance: .1, Instructions: 54COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 26217fc87ef84087a3ba96ff69605e3b2df5e474495c52963c0ab2626f1e9d04
                                    • Instruction ID: ada3d71f650fcc59950ccf8bce2d43aaf2c50077f97dc5177e6c22bfdf919798
                                    • Opcode Fuzzy Hash: 26217fc87ef84087a3ba96ff69605e3b2df5e474495c52963c0ab2626f1e9d04
                                    • Instruction Fuzzy Hash: 3601F561B1CDAB4BE6A4EF1C58E15A533C1EF66708B5488BDD11ED3286ED1DFC068340
                                    Function 00007FFD34603F50 Relevance: .1, Instructions: 53COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: cd0316ce68848457bc5835d87196e54c28a03ce8970e3da78cbbb64e358ea1f0
                                    • Instruction ID: c5a188e7a3bd626ca1ea9db0c368541fbea484591979cac1aba4aa518bbad158
                                    • Opcode Fuzzy Hash: cd0316ce68848457bc5835d87196e54c28a03ce8970e3da78cbbb64e358ea1f0
                                    • Instruction Fuzzy Hash: B101FE12F0CE6609EED51B2825B12FC07E19FD3262F450076DA4CC71C3CE5D5CC66251
                                    Function 00007FFD3460CD1D Relevance: .0, Instructions: 48COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: f6f1e7e1758f4dcbd2072684e7156a8cb4f89c3ecd2f74d25483e62221cbdc9c
                                    • Instruction ID: 989b58a8fa093e6403efe013a34d399ee75bc369d810ac8d29e4e9e1e1e6d94e
                                    • Opcode Fuzzy Hash: f6f1e7e1758f4dcbd2072684e7156a8cb4f89c3ecd2f74d25483e62221cbdc9c
                                    • Instruction Fuzzy Hash: 69115E35A08A9D8FDB59DF18C8B96E9B7F0FF55301F0001AAC04AE3691DF342985DB01
                                    Function 00007FFD3460D9FC Relevance: .0, Instructions: 48COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 4003be50198e8af88b2f2e92987e16cf8dda7ee200d7f108d619e588e15310c3
                                    • Instruction ID: 903053c4e1e90432f4d2cfa5ebde614cb6c429203601bc2edec20d3463362cbb
                                    • Opcode Fuzzy Hash: 4003be50198e8af88b2f2e92987e16cf8dda7ee200d7f108d619e588e15310c3
                                    • Instruction Fuzzy Hash: 79011E71E5892E4EEBA4EF1888A97F8B3A1EF96315F0001FAD11DE3151DE386DC18B00
                                    Function 00007FFD3460134F Relevance: .0, Instructions: 45COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b4e4a2b8d291cd8222c2580fae1992e93d76597ef6c7472072c2c83ceb12828a
                                    • Instruction ID: 97a5bde17abed0b2c5f47859dfccfd8967ad16360ed66a326e5e76230571899f
                                    • Opcode Fuzzy Hash: b4e4a2b8d291cd8222c2580fae1992e93d76597ef6c7472072c2c83ceb12828a
                                    • Instruction Fuzzy Hash: E601D63250C6186FCB21FF6CE4A14DA77B4FF0332871801A7D089CB162DA256545CB81
                                    Function 00007FFD3460B020 Relevance: .0, Instructions: 44COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ea377fa4c3f82b3b145ffd403e5019b7296af56ba0fd9647fb313679ddd8b18c
                                    • Instruction ID: 5326cdc6a681ae931f0cc2d6da48befd5691976a502df5ec86cb9928f22ad0d7
                                    • Opcode Fuzzy Hash: ea377fa4c3f82b3b145ffd403e5019b7296af56ba0fd9647fb313679ddd8b18c
                                    • Instruction Fuzzy Hash: 43F0AD35A0C25A4FEB4CEA44A4A17F83281DF46714F00007DDA6EC7683CE2B68179681
                                    Function 00007FFD34600955 Relevance: .0, Instructions: 41COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 622fb0a587919f30fca61f91cbef4c131ab0337c492cfa0dd955b7c79089b87c
                                    • Instruction ID: c1d93840e2d50a028dafb2b0c8b8fcfe31d67b1049b04d85f1ad2ae28a641f00
                                    • Opcode Fuzzy Hash: 622fb0a587919f30fca61f91cbef4c131ab0337c492cfa0dd955b7c79089b87c
                                    • Instruction Fuzzy Hash: 78F0A42248E2D20FD36297B088A56E47FE0AF47210B0E41FAD588CB4A3D94C58868762
                                    Function 00007FFD3460DBB0 Relevance: .0, Instructions: 40COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: c8e1b34c72523227d30c8944e490c9c536b396f486d67efc327088bec8c6ab36
                                    • Instruction ID: 83943e89b13d625f179f27ba6ab967a5c4425569d2eebea192c94ca57daa9b7b
                                    • Opcode Fuzzy Hash: c8e1b34c72523227d30c8944e490c9c536b396f486d67efc327088bec8c6ab36
                                    • Instruction Fuzzy Hash: F4E09BB214D50C6EA61CAA55AC479F7779CEB47134F40111FE18EC5002F157B5238295
                                    Function 00007FFD34603C69 Relevance: .0, Instructions: 33COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 389d601e362155abfd3478b5f2857423f65a4ab9f3624ea064c6edb5d8077124
                                    • Instruction ID: 3f07321f9059a5a04b7c3981130148a5b96d17f23e0bfa5219906876ce21b978
                                    • Opcode Fuzzy Hash: 389d601e362155abfd3478b5f2857423f65a4ab9f3624ea064c6edb5d8077124
                                    • Instruction Fuzzy Hash: A9F0A03640C68C5FCB42DB64D0A18D6BBB0EE17320B0501C7E048CB052D7218A5ACB82
                                    Function 00007FFD346007F1 Relevance: .0, Instructions: 30COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 93da8bd26feb7f110a4f84a0ec2b4511c20c51400cffaafc512577c21ccbbcea
                                    • Instruction ID: 068ae1fd4217b4fbef6a104dfe1f91781bb726d1986b830ca4f10be59fd0c98d
                                    • Opcode Fuzzy Hash: 93da8bd26feb7f110a4f84a0ec2b4511c20c51400cffaafc512577c21ccbbcea
                                    • Instruction Fuzzy Hash: BEE0D86110F7D44FDB639B3898A88E57FA0ED1322030941EFD585CF4B3E5198589D742
                                    Function 00007FFD346041D8 Relevance: .0, Instructions: 29COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 2aad39b6c04c064b6c2223f73cf9544fbf63e63b950bf3d0a58a00d2e01a3dec
                                    • Instruction ID: 4d1195a726ec318d0304edf235d1ce1fa59928422eaffb51aae6ed7d1a11b425
                                    • Opcode Fuzzy Hash: 2aad39b6c04c064b6c2223f73cf9544fbf63e63b950bf3d0a58a00d2e01a3dec
                                    • Instruction Fuzzy Hash: C5F0E232A186498BE724BB7884A62EABAE1FF45200B50097DE40DC7642EE2D9A118741
                                    Function 00007FFD34604C40 Relevance: .0, Instructions: 24COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 8a92556c40c92d269820c40c08a1ab661ee44f687635fc9a5040a2108578cdea
                                    • Instruction ID: 948ac5bec0a3be2a3598f5f6af2f9d2c33904557014998e2ee339ba224c016ba
                                    • Opcode Fuzzy Hash: 8a92556c40c92d269820c40c08a1ab661ee44f687635fc9a5040a2108578cdea
                                    • Instruction Fuzzy Hash: 3CE08C59B4C62703FB7C276674F13F560D08F46300F4982BA951AC00C5CD5D9C80A191
                                    Function 00007FFD34602B3F Relevance: .0, Instructions: 8COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: c1fcde533bb07c6520943a7e022813f6d2c70775a9f6bdb2e3dcb957858dfd7b
                                    • Instruction ID: dbf5a9249339d992659f142f3fdff1defa9d3053250a6f911f0dadf964b78467
                                    • Opcode Fuzzy Hash: c1fcde533bb07c6520943a7e022813f6d2c70775a9f6bdb2e3dcb957858dfd7b
                                    • Instruction Fuzzy Hash: 2DC09B15F1C55B8AF145EF2444F11BE15526F8A604FD04435D50ED2187CD7DB9027545
                                    Function 00007FFD34602881 Relevance: .0, Instructions: 4COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 479c009f09d8e62799bd268746a3618c9406d596a32435110bb5eb95320aee67
                                    • Instruction ID: 3ba2f9b9ff9eacadd5a461887808368547cf8f93fb10a12b07a17458fce46822
                                    • Opcode Fuzzy Hash: 479c009f09d8e62799bd268746a3618c9406d596a32435110bb5eb95320aee67
                                    • Instruction Fuzzy Hash: F7A00215F1D96785B0626B1400B11BD05414F57A00E604135D60FE1196CD9DAE43319A

                                    Non-executed Functions

                                    Function 00007FFD346131FA Relevance: 6.6, Strings: 5, Instructions: 388COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000009.00000002.4077688042.00007FFD34600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34600000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_9_2_7ffd34600000_ScreenConnect.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: Wq4$0Wq4$@Wq4$PWq4$hXq4
                                    • API String ID: 0-3734714531
                                    • Opcode ID: d1805c14697b3f75745570e1a06b74f1176a28c7a535d078d82cb39410960ce1
                                    • Instruction ID: aff1c9a534c072164d7730639e75203d6cf2ad6fd713af5ea970d30715997fb4
                                    • Opcode Fuzzy Hash: d1805c14697b3f75745570e1a06b74f1176a28c7a535d078d82cb39410960ce1
                                    • Instruction Fuzzy Hash: 65D19422A0E7E25BF723BEBC98F14E53B60EF4326971801B7D18889193DD1D754AC395